MikroTik security findings, explained
Every finding the audit can report has its own page: what it means, why it matters, what it looks like in Winbox, and the exact RouterOS commands that fix it. Written for people who run a MikroTik router, not only for security specialists.
SSH accepts sessions with no encryption (allow-none-crypto)
Your router's SSH service will accept a client that asks for the "none" cipher, so a badly configured tool could send passwords and commands in clear text. The setting is a leftover from old RouterOS versions and nothing needs it.
SSH port forwarding (tunnelling) is enabled
With SSH forwarding enabled, anyone who can log in to the router over SSH can tunnel arbitrary traffic through it and reach networks the firewall would otherwise keep them out of. Few setups need it; here is how to turn it off and what to use instead.
SSH strong-crypto is not enabled
By default the RouterOS SSH server still accepts legacy algorithms such as SHA-1, small Diffie-Hellman groups and CBC ciphers. Setting strong-crypto=yes limits it to modern ones. Here is what changes and what might stop connecting.
New article every other day · RSS