Panduan Management User & Hak Akses MikroTik
Management user dan hak akses adalah aspek kritis dalam administrasi jaringan MikroTik. Artikel ini akan membahas secara detail tentang cara mengelola user, group, hak akses, dan keamanan akses di MikroTik RouterOS.
Konsep Dasar User Management di MikroTik
MikroTik RouterOS memiliki sistem autentikasi user yang memungkinkan administrator untuk membuat multiple user dengan hak akses yang berbeda-beda. Setiap user dapat memiliki group, policy, dan restrictions yang spesifik.
Hierarki User Management:
Users → Groups → Policies → Restrictions ↓ ↓ ↓ Password Permissions Time/Address Limits
Tabel Default User MikroTik
| Username | Default Password | Group | Hak Akses | Rekomendasi Keamanan |
|---|---|---|---|---|
| admin | [kosong] | full | Full access tanpa restrictions | Ganti password, batasi akses |
| user | Tidak ada | read | Read-only access | Buat password kuat |
| write | Tidak ada | write | Read + Write tanpa policy | Hapus jika tidak digunakan |
Cara Membuat User Baru
Metode 1: Menggunakan Winbox/Webfig
Step-by-Step Winbox:
- System → Users
- Klik tombol "+" (Add New)
- Isi field:
- Name: nama_user
- Group: pilih group
- Password: password_kuat
- Confirm Password: ulangi
- Apply → OK
Step-by-Step Webfig:
- System → Users
- Klik "Add New"
- Form akan muncul:
- Username: technician
- Password: *******
- Group: pilih dari dropdown
- Submit
Metode 2: Menggunakan Terminal/CLI
[admin@MikroTik] > user add [admin@MikroTik] > user add name=junioradmin group=full password=Password123 [admin@MikroTik] > user add name=monitor group=read password=Monitor456 [admin@MikroTik] > user add name=technician group=technician password=Tech@2024
Management Group dan Hak Akses
Default Groups di MikroTik
| Group Name | Policy | Hak Akses | Keterangan |
|---|---|---|---|
| full | full | Semua hak akses | Administrator penuh |
| read | read | Read-only | Hanya lihat, tidak bisa edit |
| write | write | Read + Write tanpa policy | Bisa edit tapi terbatas |
| policy | Custom | Sesuai policy yang ditentukan | Flexible permissions |
Cara Membuat Custom Group
[admin@MikroTik] > user group add name=hotspot-admins policy=local,hotspot,read [admin@MikroTik] > user group add name=network-tech policy=ip,interface,read,write [admin@MikroTik] > user group add name=monitoring policy=read,!local,!ssh,!telnet,!ftp,!reboot
Policy dan Permission System
Daftar Policy yang Tersedia
| Policy | Description | Menu yang Diizinkan |
|---|---|---|
| local | Local user management | System → Users, Groups |
| password | Change passwords | Change own password |
| sniff | Packet sniffer | Tools → Packet Sniffer |
| test | Testing tools | Tools → Ping, Traceroute |
| romon | RouterOS monitoring | RoMON functionality |
| read | Read-only access | View all configurations |
| write | Write access | Modify configurations |
| policy | Policy management | Manage user policies |
| ssh | SSH access | Access via SSH |
| telnet | Telnet access | Access via Telnet |
| ftp | FTP access | File transfer via FTP |
| api | API access | REST API access |
| winbox | Winbox access | Access via Winbox |
| webfig | Webfig access | Access via Web browser |
| api-ssl | API SSL access | API with SSL encryption |
| dude | The Dude access | The Dude monitoring |
| bandwidth-test | Bandwidth test | Tools → Bandwidth Test |
| sensitive | Sensitive data access | View passwords/certificates |
Contoh Konfigurasi Policy untuk Role Berbeda
Network Technician
Policy: ip,interface,wireless, read,write,test,!local, !ssh,!telnet,!ftp,!api
Bisa konfig IP, interface, wireless, testing tools
Hotspot Administrator
Policy: hotspot,read,write,local, !ssh,!telnet,!winbox
Hanya manage hotspot, tidak bisa akses system
Monitoring User
Policy: read,!write,!local,!ssh, !telnet,!ftp,!api,!winbox
Hanya lihat status, tidak bisa konfigurasi
Advanced User Restrictions
1. Time-based Restrictions
[admin@MikroTik] > user set monitor allowed-days=mon,tue,wed,thu,fri [admin@MikroTik] > user set monitor allowed-hours=08:00-17:00 [admin@MikroTik] > user set junioradmin allowed-hours=09:00-18:00
2. Address-based Restrictions
[admin@MikroTik] > user set admin address=192.168.88.0/24 [admin@MikroTik] > user set technician address=10.10.10.50 [admin@MikroTik] > user set monitor address=0.0.0.0/0
3. Service-based Restrictions
[admin@MikroTik] > user set junioradmin disabled=no [admin@MikroTik] > user set junioradmin group=full [admin@MikroTik] > user set junioradmin winbox=yes [admin@MikroTik] > user set junioradmin ssh=yes [admin@MikroTik] > user set junioradmin telnet=no [admin@MikroTik] > user set junioradmin web=yes [admin@MikroTik] > user set junioradmin api=no
Password Policy dan Keamanan
| Setting | Default | Rekomendasi | Command |
|---|---|---|---|
| Minimum Password Length | 0 | 8 | /user set admin password-min-length=8 |
| Password Complexity | Tidak ada | Enable | Via script/3rd party |
| Maximum Failed Login | Unlimited | 3 | /user set admin max-failed-logins=3 |
| Lockout Time | 0 | 300 detik | /user set admin lockout-time=5m |
| Password Aging | Tidak ada | 90 hari | Manual monitoring |
| Session Timeout | 00:00:00 | 15 menit | /user set admin session-timeout=15m |
Best Practices Password Security
- Ganti password default admin (yang kosong)
- Gunakan password kuat minimal 12 karakter
- Kombinasikan huruf besar, kecil, angka, simbol
- Jangan gunakan password yang sama dengan service lain
- Enable failed login limit untuk prevent brute force
- Gunakan 2FA/MFA jika memungkinkan
- Regular password rotation setiap 90 hari
Remote Access Management
1. Restrict Access by IP Address
[admin@MikroTik] > /ip service [admin@MikroTik] > set telnet disabled=yes [admin@MikroTik] > set ftp disabled=yes [admin@MikroTik] > set api disabled=yes [admin@MikroTik] > set winbox address=192.168.88.0/24 [admin@MikroTik] > set ssh address=10.10.10.0/24 [admin@MikroTik] > set www-ssl address=0.0.0.0/0
2. Change Default Ports
[admin@MikroTik] > /ip service set winbox port=8292 [admin@MikroTik] > /ip service set ssh port=2222 [admin@MikroTik] > /ip service set www port=8080 [admin@MikroTik] > /ip service set www-ssl port=8443
Monitoring dan Audit Log
1. View Active Sessions
[admin@MikroTik] > /user active print Flags: R - radius # USER ADDRESS VIA SERVICE LOGIN-TIME 0 admin 192.168.88.100 winbox winbox jun/05/2024 10:30:12 1 technician 10.10.10.50 ssh ssh jun/05/2024 09:15:45
2. View Login History
[admin@MikroTik] > /log print where topics=system,info 10:30:12 system,info user admin logged in from 192.168.88.100 via winbox 09:15:45 system,info user technician logged in from 10.10.10.50 via ssh 08:45:22 system,info user monitor login failed from 192.168.88.150
3. Setup Syslog for Audit
[admin@MikroTik] > /system logging add topics=system action=remote remote=10.10.10.100 [admin@MikroTik] > /system logging add topics=system,info action=memory [admin@MikroTik] > /system logging add topics=system,warning action=email
Contoh Implementasi Role-based Access Control (RBAC)
Scenario: Perusahaan dengan 3 Departemen
| Role | Username | Group | Policy | Restrictions |
|---|---|---|---|---|
| Network Admin | netadmin | full | full | Address: admin-office/32 Time: 24/7 |
| IT Support | itsupport | tech-support | ip,interface,read,write,test | Address: 192.168.1.0/24 Time: 08:00-20:00 Days: Mon-Sat |
| Hotspot Manager | hotspotmgr | hotspot-admin | hotspot,read,write,local | Address: hotspot-office/32 Service: webfig only |
| Monitoring | monitor | read-only | read,!write,!local | Address: NOC-room/32 Service: ssh,winbox |
| Guest Viewer | guest | guest-view | read,!sensitive | Address: guest-wifi/24 Time: 09:00-17:00 |
Konfigurasi CLI untuk Scenario Diatas:
# Buat custom groups [admin@MikroTik] > /user group add name=tech-support policy=ip,interface,read,write,test,!local,!ssh,!api [admin@MikroTik] > /user group add name=hotspot-admin policy=hotspot,read,write,local,!ssh,!telnet [admin@MikroTik] > /user group add name=read-only policy=read,!write,!local,!ssh,!winbox [admin@MikroTik] > /user group add name=guest-view policy=read,!sensitive,!write # Buat users dengan groups [admin@MikroTik] > /user add name=itsupport group=tech-support password=IT@Supp0rt! [admin@MikroTik] > /user add name=hotspotmgr group=hotspot-admin password=Hot$pot2024 [admin@MikroTik] > /user add name=monitor group=read-only password=M0nit0r#123 [admin@MikroTik] > /user add name=guest group=guest-view password=GuestView01 # Set restrictions untuk IT Support [admin@MikroTik] > /user set itsupport address=192.168.1.0/24 allowed-hours=08:00-20:00 allowed-days=mon,tue,wed,thu,fri,sat # Set restrictions untuk Hotspot Manager [admin@MikroTik] > /user set hotspotmgr address=192.168.2.50 winbox=no ssh=no telnet=no web=yes api=no # Set restrictions untuk Guest [admin@MikroTik] > /user set guest address=192.168.10.0/24 allowed-hours=09:00-17:00
Backup dan Restore User Configuration
1. Export User Configuration
[admin@MikroTik] > /export file=user-backup show-sensitive [admin@MikroTik] > /export compact file=user-config # Hasil export akan berisi: /user group add name=full policy=local,telnet,password,policy,test,winbox,password,web-ssl,api,... /user add name=admin group=full address=192.168.88.0/24 password="plain_text_password"
2. Backup via Winbox/Webfig
Winbox Method:
- Files → New Terminal
- Ketik:
/export file=user-backup - Files → user-backup.rsc
- Klik Download
Webfig Method:
- System → Scripts
- Add New Script
- Name: backup-users
- Source:
/export file=users-$(/system clock get date)-backup - Run Script
- Files → Download backup file
Troubleshooting User Access Issues
| Masalah | Penyebab Umum | Solusi | Command Diagnosa |
|---|---|---|---|
| Login gagal | Password salah, user disabled, restrictions | Reset password, cek status user | /user print/log print where message~"login" |
| Akses ditolak | IP tidak diizinkan, waktu tidak sesuai | Cek address dan time restrictions | /user print detail |
| Menu tidak muncul | Policy tidak mengizinkan | Edit group policy | /user group print |
| Session timeout cepat | Session-timeout setting | Adjust session-timeout | /user print where name=username |
| User terkunci | Max failed logins tercapai | Reset lockout, increase limit | /user printCek kolom "disabled" |
Script Automation untuk User Management
Script: Auto-create Standard Users
# Script untuk membuat standard users [admin@MikroTik] > /system script add name=create-standard-users source={ :local adminPass "Admin@2024!" :local techPass "Tech#2024!" :local monitorPass "Monitor$2024" :if ([:len [/user find name=admin]] = 0) do={ /user add name=admin group=full password=$adminPass } /user add name=technician group=full password=$techPass address=192.168.88.0/24 /user add name=monitor group=read password=$monitorPass address=192.168.88.100 /user set monitor winbox=yes web=yes ssh=no telnet=no :log info "Standard users created successfully" }
Script: User Access Report
[admin@MikroTik] > /system script add name=user-access-report source={ :log info "=== USER ACCESS REPORT ===" :log info "Total Users: $[/user print count-only]" :foreach i in=[/user find] do={ :local userName [/user get $i name] :local userGroup [/user get $i group] :local userAddr [/user get $i address] :local userDisabled [/user get $i disabled] :log info "User: $userName | Group: $userGroup | Address: $userAddr | Disabled: $userDisabled" } :log info "Active Sessions: $[/user active print count-only]" /user active print }
Best Practices Security Checklist
✅ Checklist Keamanan User Management
- ✅ Ganti password default admin
- ✅ Non-aktifkan user default yang tidak digunakan
- ✅ Buat custom groups dengan least privilege principle
- ✅ Set address restrictions untuk semua user
- ✅ Enable session timeout (15-30 menit)
- ✅ Set max failed logins (3-5 attempts)
- ✅ Non-aktifkan services yang tidak digunakan (telnet, ftp, api)
- ✅ Change default ports (ssh, winbox, web)
- ✅ Enable logging untuk semua login attempts
- ✅ Regular audit user accounts dan permissions
- ✅ Backup user configuration regularly
- ✅ Gunakan password policies yang kuat
Kesimpulan
Management user dan hak akses di MikroTik RouterOS adalah komponen kritis untuk keamanan jaringan. Dengan menerapkan Role-Based Access Control (RBAC), principle of least privilege, dan regular audits, Anda dapat memastikan keamanan jaringan tetap terjaga.
Rekomendasi: Mulailah dengan membuat standard operating procedure (SOP) untuk user management, implementasikan monitoring dan logging, serta lakukan regular review terhadap user accounts dan permissions.
Action Items untuk Implementasi
- Audit semua user accounts yang ada
- Non-aktifkan/hapus user yang tidak diperlukan
- Buat custom groups sesuai kebutuhan organisasi
- Implementasikan address dan time restrictions
- Setup logging dan monitoring untuk user activities
- Buat backup dan recovery procedure
- Dokumentasikan semua user accounts dan permissions
🔐 Amankan Jaringan dengan Manajemen Pengguna yang Tepat!!
User management yang baik adalah fondasi keamanan jaringan yang solid. Implementasikan dengan konsisten dan lakukan regular review.
