User Management Explained
1. Key Concepts of User Management
User Management in MikroTik RouterOS involves creating, configuring, and managing user accounts. Key concepts include:
- User Accounts: Individual accounts with unique usernames and passwords.
- Groups: Collections of user accounts with shared permissions.
- Permissions: Access levels and privileges assigned to users or groups.
- Authentication Methods: Methods used to verify user identities, such as local authentication, RADIUS, or TACACS+.
2. User Accounts
User accounts are the foundation of user management. Each account has a unique username and password, which are used for logging into the MikroTik device. User accounts can be created, modified, or deleted as needed.
Example: To create a new user account named "admin" with the password "securepass", you would use the following command:
/user add name=admin password=securepass
3. Groups
Groups are used to manage multiple user accounts more efficiently. By assigning users to groups, you can apply permissions and policies to all members of the group at once. Common groups include "full" for administrators and "read-only" for users with limited access.
Example: To create a new group named "managers" and assign the user "admin" to this group, you would use the following commands:
/user group add name=managers
/user set admin group=managers
4. Permissions
Permissions define what actions users or groups can perform on the MikroTik device. Permissions can be assigned to individual users or groups, allowing fine-grained control over access levels. Common permissions include "read", "write", and "full".
Example: To grant the "managers" group full permissions, you would use the following command:
/user group set managers policy=full
5. Authentication Methods
Authentication methods determine how user identities are verified. MikroTik RouterOS supports local authentication, where user credentials are stored on the device, as well as external authentication methods like RADIUS and TACACS+. External authentication is useful for centralized user management.
Example: To configure RADIUS authentication with a server at 192.168.1.100, you would use the following commands:
/radius add address=192.168.1.100 secret=radiussecret
/user set admin authentication=radius