How Are you Mass On-Boarding with Random Default Passwords?

RouterOS General
1

How are you all on-boarding/configuring hundreds of devices quickly now that there is a default randomly created password?

It used to be just have a script log in and do its thing, but now someone has to open the tag, read the password, key it in – hope they got it right. WAY TOO TIME CONSUMING and no way to automate it, unless MIkroTik can somehow give us a list of the password to MAC address table or something.

This is one of the stupidest things I’ve ever seen from what should be a high level tech company making products for high-level tech companies.

How are you all dealing with this?

2

why do you care about such a nonsense? It is EU desicision and law it schould prevent to hack new router connected to network and it is working…

3

Because it’s nonsense… an EU decision should not be forced on users who do not adhere to EU anarchy.

4

It is actually also law in california (US): https://techcrunch.com/2018/10/05/california-passes-law-that-bans-default-passwords-in-connected-devices/ as well as UK.
I don’t know that the EU rule is already in effect, but the rule in California is.

I understand that this rule is complicating provisioning, but I can understand the reasoning behind it.

5

For a commodity device. These are not commodity devices.

6

Netinstall will sort you. That’s what people use for any mass deployments anyway because of need for custom defconf. No mass deployment can be done with stock defconf.

7

Well it kinda means approaches that used external scripts (e.g. SSH, telnet, etc.) can’t work anymore…so if that what someone was doing…that likely have to change as a result of this change.

BUT netinstall is likely better approach anyway. You kinda want to control the version deployed, and not rely on the version shipped by factory (which changes depending on when ordered). And netinstall is much easy now that are non-Windows options for it.

There is another thread where netinstall+random default this is discussed:
http://forum.mikrotik.com/t/routers-coming-with-default-passwords/165186/1

I personally have used the branding kit with a replacement for the default-configuration file. So the random default are pretty manageable since I can add our own account to the config in the default configuration and remove the admin one. See:
http://forum.mikrotik.com/t/default-configuration/165596/1

8

I get that Flashfig is an option, but we’ve also removed a lot of things that can be done because of this now random password. There needs to be a way to purchase these units as professional units sold to professional installers without a default password.