Security concern export hide-sensitive

Hi,

In this Forum, users are used to present their config with the command " export hide-sensitive ".

From my point of view, this functionality is needed, but still present some sensitive data, therefore I would suggest hiding such data, or even better create a logic of sensitivity (0 = every thong, 1, hide only password, 2: hide others…)

  • Serial nummer:

this field appears on the top of the export. We know that it can be used for DDNS service. I do not feel confident publishing my Firewall rules on top of the DDNS that help to reach it from the Internet…

  • Zerotier Network:


/zerotier interface add instance=zt1 mac-address=1E:47:79:47:47:47 name=zerotier1 network=#################

I personaly found dangerous publishing the ID of the zerotier network, as this one is the way to request (or even sometimes “join”) the private-VPN.

  • Zerotier Identity:


/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" \
    identity="22262a9999:0:bef297a315f08d99960666693196ea5f8cca1c13398252f20cf\
    28eb5898f3e3ddd0b8f28670a82b73e5df0a0d456aaaa740b88b076334d5d08908b5cabb0f\
    f90:1b72d26f5c28955403b26c090cfd366af994f74f4a4c2cafe25ceadbf5efaa74cf8eee\
    7549125ccc4b3edbd81583386e4bb5cb2e000005630c61e70e3bfde990" name=zt1 \
    port=9993

I guess this section stand for the “private key” used “somewhere” by Zerotier to identify the client. Therefore, should not appear in the export.

I hope Mikrotik will improve that, in later versions.

Default behavior has changed from ROS6 to ROS7 from show-sensitive to hide-sensitive.
But I guess there is some consistency check required indeed as to what is exported under which condition.

Best to send your request to support@mikrotik.com and point them to this thread.