There’s what looks like a bug in the export command on RouterOS 7, with OSPF authentication keys included even when hide-sensitive is specified. Other sensitive information such as PPPoE client passwords are excluded as expected, so it looks like this is specific just to OSPF interface templates.
[me@myRouter] > export show-sensitive
/interface pppoe-client
add add-default-route=yes comment="ISP PPPoE" disabled=no interface=ether6 name=pppoe-out1 password=thisIsTotallyASecurePassword user=me@myisp.com
/routing ospf interface-template
add area=ospf-area-1 auth=sha512 auth-id=1 auth-key=goodOspfPassword disabled=no interfaces=ether1
add area=ospf-area-1 auth=sha512 auth-id=1 auth-key=goodOspfPassword disabled=no interfaces=ether2
[me@myRouter] > export hide-sensitive
/interface pppoe-client
add add-default-route=yes comment="ISP PPPoE" disabled=no interface=ether6 name=pppoe-out1 user=me@myisp.com
/routing ospf interface-template
add area=ospf-area-1 auth=sha512 auth-id=1 auth-key=goodOspfPassword disabled=no interfaces=ether1
add area=ospf-area-1 auth=sha512 auth-id=1 auth-key=goodOspfPassword disabled=no interfaces=ether2
I’m able to reproduce this on
- RB1100AHx4 (7.17 and 7.18.2)
- RB3011UiAS (7.17.2)
- CCR2004-1G-12S+2XS (7.18.2)
On RouterOS 6 (6.48.7 on RBmAPL-2nD), hide-sensitive does exclude OSPF authentication keys as expected.
(Edit) Ticket SUP-185441 is open with MikroTik Support.