WinBox Authentication with 2FA?

RouterOS General
1

Hello dear Community

I am interested whether if it is possible to use 2FA while logging into RouterOS via winbox? like receiving a push code into some kind of authenticator app and etc…

Thanks

2

Hi,

Simple answer is: No.

3

And yet ... with some workaround it can be done.

Enter ... Radius.

1 Like
4

https://www.incognia.com/the-authentication-reference/what-are-the-key-differences-between-2fa-and-mfa

OTP is almost as weak as password as if someone gets your OTP hashkey, they could generate your OTP passkeys. I use MFA TOTP with User-Manager but my problem is every admin could see anyone else keys and passwords. Additional problem is the MSCHAPv2 auth, so we must store passwords in cleartext.

1 Like
5

(moved)

6

False...

@holvoetn I thought someone would add the link to my guide, but nothing... :cry:

7

Apologies, I did search for it but yours did not pop up.
Sorry about that.

8

I was kidding! All good :upside_down_face:

9

@sandro1992 It should rightly be remembered (as per link):

Caveats:
Obviously, every time you open the terminal from WebFig/Winbox,
or when you reboot the device upon reconnection,
it will ask for the password again and you must use a new... OTP...
BUT this is precisely the point of using 2FA, One Time Password, so that a password is only valid once...
(or at least the OTP are 1 milion numbers that not deterministically repeats at least every 347d 5h 20m valid for just 1m30s)

10

You can do it with user manager. I use it for VPNs, password + Google auth.

11

@abbio90 Già scritto......... incluso la guida per farlo........

12

@sandro1992 News? Or is it just post & disappear?

13

Could you also update your guide and add a big warning that the device must have NTP client properly setup and must be able to synchronize the time after boot before accepting logins? Many devices that MikroTik sell have no battery to keep a RTC running, and will have wrong date and time at boot. If left powered off for too long (a few minutes), without proper time synchronization, all the expected OTP codes will no longer match.

1 Like
14

This is only a related thing, but I was very pleased to see that v7.21beta2 introduced support for ed25519-sk ssh keys (keys requiring attestation through FIDO2, e.g. using a Yubikey.)

For me at least this solves this whole area of problems wonderfully. Combined with an ssh tunnel, which is available in all Windows and standard CLI implementations, this is easily used to secure winbox access.

Additionally, this doesn’t rely on the clock being correct. And additionally, ssh through its fingerprint verification protects against man-in-the-middle attacks, which winbox doesn’t do.

1 Like
15

Done, check if is ok...

1 Like