Layer 7 blocking of username by use of regxp

RouterOS Beginner Basics
1

Hello, has anyone on here been able to setup a Layer 7 blocking rule to block someone from logging in via ftp using the root account. I know there are examples of blocking based on protocol by using a regxp, however, i was looking for something based on the username i.e. root account

thanks

2

What do you mean by ‘root’ account? The built in admin account?

Either way, just edit “/user group” to create permissions for the groups, and make one that has all rights but not ftp (“!ftp”) and assign that root user to that group. No need for layer 7 rules since AAA is built in.

3

What I mean is I want an automatic way of blocking random ip addresses that show up in my logs that are attempting to log in via ftp using either root or the administrator account. I want to use a src address list, add their ip to the list based on their attempts via those accounts using a regxp in a layer 7 rule, and then drop them completely.

Make sense?

tks

4

Sort of, I guess. I can’t help with that.

5

Maybe this will help
http://wiki.mikrotik.com/wiki/Bruteforce_login_prevention_(FTP_%26_SSH)