Hello everyone, and Mikrotik Staff,
Is there a way to perform a bulk device-mode upgrade for large-scale deployments, for example using FlashFig or another simple mass configuration tool?
Any suggestions or best practices would be greatly appreciated.
Regards
MikroTik doesn't give a damn about distributors or installers.
Otherwise, they wouldn't have made such a shi~~y device-mode (forced predefined activation on device update).
They only care about the "home" user who has a RouterBOARD at home to play with.
They don't care about CPEs, radio links, or whatever else,
otherwise they wouldn't have forced device-mode to be activated at will on peripherals already installed in radio links hours away by car/off-road vehicle...
Do you mean the one already installed on site (FORGET IT)
or the one you prepare before distributing to the installers (power off the device when script finish)???
You can use this on the last line of mass configuration script, simply power off the device at least within... 1 day...
/system device-mode update activation-timeout=1d mode=advanced flagged=no flagging-enabled=yes \
bandwidth-test=yes container=no email=yes fetch=yes hotspot=yes ipsec=yes l2tp=yes pptp=no \
proxy=no romon=yes scheduler=yes smb=no sniffer=yes socks=no traffic-gen=yes zerotier=yes \
install-any-version=no partitions=yes routerboard=yes authorized-public-key-hash=""
Yes, but we need a pre-staging to our default, because we remote config device located on our hub.
People that configuring the devices are different from people that manage the devices on our hub.
You can use this on the last line of mass configuration script, simply power off the device at least within... 1 day...
Nice input
To be precise and unambiguous: I literally mean removing the power without rebooting or shutting down first...
I refer to activation-timeout, as nice input.
yes, yes, is for be not ambiguos with other users that read this topic....
Do you know what the attribute authorized-public-key-hash does?
You asked the question in a past release thread, but I can't find any answers. And it's not in docs...
It apparently accepts a hash generated by e.g. from your public key.
openssl dgst -sha256 -hex ~/.ssh/id_rsa.pub
My best guess how it could probably work:
.pub file to the router./user ssh-keys private import user=<user> private-key-file=/files/id_rsa.pub
authorized-public-key-hash by/system/device-mode/update authorized-public-key-hash=<hash-of-public-key>
This probably still needs a power-cycle or mode/reset button press. However, any device mode updates after that may then be authorized using the SSH public key of executing user.
anyone wanna try in lab?
That what I've suspected since it first appeared... But I still haven't tried it ;).
But if someone already knows that be good. @rextended asked about in the 7.17 thread, but I couldn't find a reply.
Tried it on a 4011 with 7.19.2 and it didn’t seem to change the process that I could see. Asked to turn off power both when I added the hash, and after power off reboot with any changes.
Maybe someone here can get it.
I’m not sure they care about that market either, certainly lack of cloud controller for SOHO limits their use. Hobbyists must be a tiny market.
The idea is:
must be changeable only by: [..] ssh by authenticated user with authorized-public-key-hash
But is still not implemented
(that mean: no by WinBox or Web or terminal etc., only by SSH authenticated by keys...)
So if you authenticate as a user via SSH and the public user key hash matches the one stored in the "authorized-public-key-hash" field, you can change the device mode, still via reboot, but without having to press the button or suddenly turn off the power.
The only explanation I can think of for why it was abandoned is that a hacker with full control of the device still has the ability to install their own keys and perform the same process...
It's clear they started doing it without considering the consequences...
Or it has nothing to do with unlocking device-mode. And optimism authorized-public-key-hash is even about solving provisioning, perhaps misplaced 
i.e.. It could also have to do with validation of RouterOS packages, e.g. so if you need to changed the "key" used to sign NPK/etc, you need some way to update software if their signing key was ever leaked.
And currently authorized-public-key-hash is still subject the power-cycle reboot requirement, so same boat as setting any other device mode automatically during provisioning. Now assuming it's about unlocking, you be slightly better off in that could later update device-mode without power-cycle .
We just don't know what MikroTik actually intended with authorized-public-key-hash. See communication concern in many posts above. There is a simple answer, we just don't know.
While not directly helpful to @BrianHiggins, I'm still perplexed why netinstall (and flashfig) setting device-mode isn't an option. You need to press a button to start it (or have a literal out-of-box router for flashfig, or need device-mode unlocked to cause flashfig). And not easy to use netinsall/flashfig remotely either... To me, this is a different than any of key-based schemes, or even branding.
You can make device etherboot by setting routerboard boot-mode. If Hacker already has e.g. compromised Windows PC on same network (e.g. always on Remote Desktop host) it would be possible?
Except flash-boot-then-nand is default out of box...but AFAIK it clears itself once any login has occurred or reboot. And to set that or flash-boot or any boot option in /system/routerboard does require device-mode routerboard=yes which is restricted even in mode=advanced. So you'd already need to hack device-mode (or user set =yes to everything since worried about future changes, which is separate problem here). Thus netinstall (via button) or flashfig (via "one-chance") is different than keys...
Mikrotik…what the f*ck?
I have >5000 devices installed and I deploy >300 a month.
I can’t spend 5 minutes pushing the godd*mn button on every single one of them
There is a new netinstall-cli with an option of mode-script, and I believe FlashFig support this too now.
There are several thread with some "hate device-mode" messaging/themes. At this point, this thread captures the current state, along with release notes/docs on 7.22:
Perhaps best target that one for quick comment/complaints in future, or open a new topic on how new "mode-script" scheme does not work for you.
Yes, both netinstall and flashfig support device-mode configuration script from 7.22.