Locking access to routerboard

Hardware MikroTik hardware general
1

Does anyone have any idea how one might ‘lock’ a routerboard from being accessible to anyone unauthorised?

The reason we need this is we are migrating to a licensed band, and don’t want anyone poking around and re-using boards/cards purchased from us in our band in unauthorised applications.

You know hoe people are - someone will realise that it can do a broad range of frequencies once the upgrade license has been installed, and might use it on their own…

I need a permanent lock that will not allow a hard-reset/reprogram…

We intend using the RB112, and I thought removing the jumper and/or resistor in-line may be a bit of a deterrent to all but the most determined hackers.

Any other less hackable suggestions?

2

netinstalling it will always clear away your settings, unless you also solder off the serial port and deny admin access (so that he can not turn on boot from network :slight_smile:

3

Good thing you mentioned that - hadn’t thought of netinstall/serial

4

complete locking of the board, even if it would be possible, would bring many issues - for example troubleshooting it.

5

no - I don’t mean complete lock - only lock to unauthorised access.

Obviously us as the suppliers would retain admin rights…

6

What’s the possibilty of including a ‘disable hardware reset’ switch in future versions of MT? :wink: :smiling_imp:
(with a warning of “disable at your own risk!”)

Regarding the serial port - I guess one could just disable it in the OS rather than de-soldering it? Would this work?

7

GWISA, could you specify, what do you want to restrict ?(Physical access or IP acccess) ?

8

We’d like to restrict any kind of re-configuring possibilities by a client. Once a CPE has been set up, it must not be accessible at all by a client - only by ourselves for re-programming/whatever.

I do not want any possibility of the board being reset and reconfigured in unauthorised applications, especially as the license upgrade opens many more frequencies outside of the unlicensed bands…

9

first, disable admin user, make a user for yourself, and make a read-only user for client.

that will take care of reconfiguration, but will not take care of reinstall. maybe you can disable the serial ports.

10

And preventing hard reset? Remove resistor & jumper?

11

I guess you can use script with netinstall, script that will set configuration to RouterOS.
The particular configuration will be restored, when router is reseted.

12

oh yes! when you install RouterOS with netinstall, and use a script - that script will be loaded after reset. even the hard reset.

13

Aha! I’ll try that again… didn’t have success with that when i tried it some time back.

Does this mean that the router cannot be reset at all, unless the /sys reset command is used? And that would obviously only be accessible by the admin…

14

no, unless you reinstall it again with a different script.

15

Another AHA!

/sys routerboard settings set enable-jumper-reset=no

Bingo!