Weak passwords on VPN / PPP accounts

What the audit found

One or more accounts under PPP → Secrets — the user database for your L2TP, PPTP, SSTP, OpenVPN or PPPoE server — have a weak password. The report lists the affected account names and how many of the total are weak. Typical problems are passwords that are short, that consist of a name or a dictionary word, that are digits only, or that simply repeat the user name.

The audit rates this high regardless of exposure, because a VPN server is by definition reachable from outside. Passwords are only checked when the export was made with sensitive values shown.

Why it matters

The firewall on your router exists to keep the internet out of your LAN. A VPN server is a deliberate door through that wall, and a PPP secret is the key. Whoever has a valid user name and password does not just reach the router — they are placed inside the network, with an internal address, able to reach file servers, printers, cameras, the accounting PC and the router's own management interface as if they were sitting at a desk.

VPN servers face the same automated password guessing as every other internet-facing login. Attackers try user names that are easy to guess (admin, vpn, test, first names, the company name) with lists of common passwords. Short passwords, words, names and digit-only strings fall to such an attack within minutes to hours. Some VPN protocols make it worse: with PPTP or plain L2TP the authentication exchange can be captured and the password recovered offline, so a weak one is found even faster.

The accounts most likely to be weak are the ones nobody remembers: a secret created for a contractor three years ago, a test user, a site-to-site tunnel set up in a hurry. They are also the ones nobody notices being used.

What it looks like in Winbox

Open PPP → Secrets. Each row is an account with Name, Password (dots unless you tick Show passwords), Service and Profile. Also look at the Active Connections tab to see who is logged in right now.

The Last Logged Out column helps identify accounts that have not been used for months.

How to fix it

For each weak account, set a new random password under PPP → Secrets. Use a passphrase of four or five unrelated words, or sixteen or more random characters from a password manager. Do not derive the new password from the old one, and do not reuse a password from any other system. Repeat for every account the report names.

While you are in the list, disable or remove accounts that are no longer needed. Give each user their own account rather than a shared one, so a leaked password can be revoked without disturbing everyone. Where possible, pin the account to a fixed Remote Address and a profile that limits what it can reach, so that a compromised account lands in a corner of the network rather than the whole of it.

Changing a PPP secret disconnects nothing until the user next reconnects, and it does not affect Winbox or SSH access, so Safe Mode is not required. Do tell the users before you change their passwords, and send the new ones through a channel other than email. If the accounts belong to a PPTP server, see the separate finding about PPTP: a strong password helps, but the protocol itself should be replaced.

Afterwards, connect to the VPN with the old password from a client — it should be rejected — and with the new one, which should succeed. Check that no unneeded accounts remain enabled, then re-run the audit with a fresh export that includes sensitive values; the finding should be gone.

The full MKRouterKit report gives the exact commands for your configuration — with your interface names and subnets filled in, in the order that will not lock you out.

FAQ

The weak accounts are for site-to-site tunnels between our own routers. Does that matter?

Yes, if anything, more. A site-to-site account typically has broad access on both ends and is never watched by a person. Anyone who guesses it becomes a third site on your network. Give those accounts a long random password; the routers do not mind typing it.

Can I use RADIUS or a user manager instead of local secrets?

You can, and for more than a handful of users it is easier to manage. The password rules are the same wherever the accounts live, so move them and then make sure the new source enforces length and randomness.

Some users have short passwords because their VPN client makes them hard to type. What can I do?

Prefer a word-based passphrase — long, but easy to type on a phone — and a VPN client that stores it. If the client is the real limitation, this is a good moment to move those users to WireGuard, which uses keys instead of passwords.