MikroTik security findings, explained
Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.
API-SSL is enabled but nothing uses it
RouterOS enables the TLS API by default, and most routers never have an application talking to it. A management service that nothing uses is attack surface without a benefit. Disable it, or restrict it to the one address that needs it.
FTP is enabled: credentials and files travel unencrypted
The FTP service on your MikroTik is on, as it is in every factory configuration. It sends the router's admin password in plain text and is a favourite brute-force target. Disable it and use SFTP over SSH instead.
RouterOS API without TLS is enabled
The plain RouterOS API on port 8728 is switched on by default, sends logins unencrypted and gives full control to whoever authenticates. Most routers never use it. Here is how to tell whether you do, and how to close it.
SSH reachable from the whole internet
SSH is encrypted and generally well built, but a login prompt that the whole internet can see draws non-stop password guessing. Restrict the service to your management addresses, or reach it through a VPN, and keep it as your reliable back door.
Telnet is enabled: your admin password travels in plain text
Telnet gives full command-line access to your router and sends the login and every keystroke unencrypted. There is no reason to keep it on a modern RouterOS device. One command switches it off; SSH does everything Telnet did, safely.
WebFig over plain HTTP: the web interface sends your login in cleartext
The www service serves WebFig over unencrypted HTTP, so your admin login can be read on the way. WebFig has also been the way in for several RouterOS exploits. Disable it, or switch to HTTPS with a certificate and an address restriction.
WebFig over HTTPS reachable from the whole internet
WebFig on port 443 is encrypted, which is the right choice, but nothing limits who can open the login page. An internet-facing web login on a router invites password guessing and puts you one browser-side bug away from a takeover.
Winbox reachable from the internet: why it is the most attacked RouterOS service
Winbox is the tool you use to manage your MikroTik. When it is reachable from the internet, it is also the tool everybody else can use to try. Here is what the finding means and how to close it in two commands.
www-ssl is enabled without a certificate
The HTTPS web interface is enabled on your router, but no certificate is assigned to it. Without one, browsers cannot verify the router, and the service does not provide a properly authenticated encrypted session. Three commands fix it.
New article every other day · RSS