Community discussions

MUM Europe 2020
 
FIPTech
Member
Member
Topic Author
Posts: 469
Joined: Tue Dec 22, 2009 1:53 am

User with default Safe Mode

Wed Feb 16, 2011 10:31 pm

It could be usefull to have a user setting to enable safe mode on the account.

So that each time this user connect he is in safe mode.
 
User avatar
nest
Forum Veteran
Forum Veteran
Posts: 816
Joined: Tue Feb 27, 2007 1:52 am
Location: UK
Contact:

Re: User with default Safe Mode

Fri Feb 18, 2011 1:00 am

If you mean, a user that can not damage anything by accident? Give them only read access. If they also need to make changes, but only rarely, give them two accounts. One read only one for general day to day use and a full one for when they know exactly what they wish to change.

If they cannot be trusted to use safe mode by immediately clicking on it after logon, what can they be trusted with? :lol:
Ron Touw - Mikrotik Certified Trainer
LinITX.com - MultiThread Consultants
Get your MikroTik RBs and Training: http://linitx.com/category/166
Largest Official UK MikroTik Distributor
IRC channel: #routerboard on irc.z.je (IPv4), 6.irc.z.je (IPv6)
 
FIPTech
Member
Member
Topic Author
Posts: 469
Joined: Tue Dec 22, 2009 1:53 am

Re: User with default Safe Mode

Fri Feb 18, 2011 1:19 am

I prefer trusting machines than myself or other users.

Read only is rarely used in the field simply because if you need to make a modification then you need to logoff and logon.

I think than default safe mode can be interesting.

Having to drive 300 or 500 km to a remote site because you forgotted to use safe mode is no good...


I prefer things that are safe by default, and removing safe mode if needed.
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Re: User with default Safe Mode

Fri Feb 18, 2011 4:01 am

I would like this. I forget safe mode all the time.
Specific answers require specific questions. When in doubt, post the output of "/ip address print detail", "/ip route print detail", "/interface print detail", "/ip firewall export", and an accurate network diagram.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24381
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: User with default Safe Mode

Fri Feb 18, 2011 7:49 am

Don't forget that to apply the changes you made in Safe Mode, you need to exit it. If you never knowingly entered it, it will be hard to get out, and could cause confusion why nothing is working.
No answer to your question? How to write posts
 
fewi
Forum Guru
Forum Guru
Posts: 7734
Joined: Tue Aug 11, 2009 3:19 am

Re: User with default Safe Mode

Fri Feb 18, 2011 7:58 am

That's true, but I'd rather apply changes twice than lock myself out. Or at least have the option to.
Specific answers require specific questions. When in doubt, post the output of "/ip address print detail", "/ip route print detail", "/interface print detail", "/ip firewall export", and an accurate network diagram.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 24381
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: User with default Safe Mode

Fri Feb 18, 2011 8:25 am

Currently we can't do it, as safe mode utilizes the not-so-advanced "history" menu and undo function. If two people use safe mode at the same time, things will break. We are planning to make a new and advanced command history system where this will be possible, but that's for v6
No answer to your question? How to write posts
 
FIPTech
Member
Member
Topic Author
Posts: 469
Joined: Tue Dec 22, 2009 1:53 am

Re: User with default Safe Mode

Fri Feb 18, 2011 10:22 am

The safe mode button could be flashing and orange when in safe mode. So that you can't miss it.

Then allowing default safe mode by user basis could be interesting as well, so that if you don't like it you can disable it for you.


As we are in management things, i think it could be usefull for V6 to have a better remote console terminal, with shared session and more than one screen possible like localy, something we can have easily with "screen" terminal deamon under Linux.

Fisrt user enter "screen", second enter "screen -r -x" and you are in the same terminal session. Usefull for learning or checking things between technicians. It's even possible with screen to record terminal session. Something that could be usefull for support.

We could have as well something like : "a user is actually online on this router, do you want to share the console session with him ?"
 
User avatar
nest
Forum Veteran
Forum Veteran
Posts: 816
Joined: Tue Feb 27, 2007 1:52 am
Location: UK
Contact:

Re: User with default Safe Mode

Sat Feb 19, 2011 8:38 pm

I have found the system of a 'read-only' account very straightforward. I use it for all day to day business, I can see most things with no problems and cannot break anything! I found in the past that it far too easy to make changes to the order of firewall rules by accidentally drag and dropping rules when moving the mouse cursor using my laptop trackpad. So a read account is perfect for investigation and just looking.

When I am ready to make a change, it only takes a few seconds to log back in with a full account to make those changes.

I have only ever used safe mode for performing changes where I think it might possibly go wrong and it will take too long to drive (or with two customers) to fly to the radio site to repair the damage I caused.

For me, there is a list of many other things that can be improved with Winbox before spending time developing a change to this one! :-)
Ron Touw - Mikrotik Certified Trainer
LinITX.com - MultiThread Consultants
Get your MikroTik RBs and Training: http://linitx.com/category/166
Largest Official UK MikroTik Distributor
IRC channel: #routerboard on irc.z.je (IPv4), 6.irc.z.je (IPv6)
 
Gesha24
just joined
Posts: 7
Joined: Sun Sep 15, 2013 8:35 pm

Re: User with default Safe Mode

Sun Sep 15, 2013 9:01 pm

Any news on this feature? This is probably one of main features that prohibits me from considering Mikrotik devices for any kind of serious production usage (yes, I am spoiled by Juniper's commit confirmed that saved my ass a couple of times).

Let me explain why - when you are rested and your brain is working, you are very unlikely to make a mistake in config that would render the device unusable. However when you are tired, that's when you forget to click the safe mode button and that's exactly when you have the highest risk of making a serious mistake during the configuration.

I personally can settle for the same way safe mode is working now, just with an option in Winbox at the startup saying "launch in safe mode" that would simply click the safe mode button for me in the beginning. If somebody else is editing in safe mode - I will get an error message, which will at least give me a reminder (plus I would prefer to know that somebody is changing settings along side with me anyways). To save the changes I would need to click "safe mode" button - that's similar to clicking "apply" or "save configuration" in other GUIs, which is something everyone is used to.

P.S. Maybe I didn't look hard enough, but while I could find a note saying that default timeout for safe mode is 9 minutes, I couldn't find any information on where and how to change those settings.
 
pkelly1603
Frequent Visitor
Frequent Visitor
Posts: 78
Joined: Mon Jun 15, 2009 11:13 pm

Re: User with default Safe Mode

Fri Nov 11, 2016 5:30 pm

Let me give another reason this is important:

We have a NOC with many people having access to many routers. Our core infrastructure is redundant enough and locked down so no one can login and cause major damage in the core.

However, any users could write a script to cause serious damage to the endpoint devices (Mikrotik routers on customer premise). We've never had an issue with a malicious technician in ~15 years but it is an outlying risk. In order to provide the best service, we want our technicians to have access to these routers. Any tech has enough access to destroy all routers in a matter of minutes. If safe mode was required for these users, it would be much more difficult to cause serious damage.

For this purpose, safemode would have to be required (not just default) for specified users. Maybe "Safemode required" could be a permission setting on the group policy?
 
User avatar
Sn1p3r
Frequent Visitor
Frequent Visitor
Posts: 59
Joined: Thu Mar 10, 2011 5:50 pm
Location: Croatia
Contact:

Re: User with default Safe Mode

Sat Nov 12, 2016 12:52 am

I'm reading this topic and still cannot decide would it be better to have safe mode activated by default.
But for sure would be great that you can chose which user would have safe mode by default.

Like someone said before, driving 400-500km to remote site is hassle, why not to save it?
You have one user which you use for critical things and one which you use for monitoring/small changes.
 
pants6000
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Fri Sep 26, 2014 5:30 am

Re: User with default Safe Mode

Sat Nov 19, 2016 12:37 am

I think this would be an awesome feature!
 
User avatar
G2Dolphin
Member Candidate
Member Candidate
Posts: 157
Joined: Sun May 17, 2015 6:03 pm
Location: Moscow, Russia

Re: User with default Safe Mode

Mon Nov 21, 2016 8:08 am

I agree. While "require safe-mode" policy in user management can be somewhat hard to implement, I believe another tiny Winbox checkbox
that would simply click the safe mode button for me in the beginning
is really useful and easy implementation of that idea. And if this really will came handy for many users it can grow up in advanced safe-mode policies.
Home: RB3011UiAS-IN (2011 case+3011-RM), hAP ac, mAP2n/mAP2nD, GrooveA-52HPn, hEX (r3), hAP lite, RB951G-2HnD
Work: RB2011UiAS-RM / UiAS-2HnD-IN, RB951G-2HnD, hEX (r3), CRS125-24G-1S-2HnD-IN, CCR1009-8G-1S-1S+
 
Stril
Member Candidate
Member Candidate
Posts: 124
Joined: Fri Nov 12, 2010 7:18 pm

Re: User with default Safe Mode

Tue Jan 24, 2017 7:12 pm

Hi!

Are there any plans to add that option? I think most "enterprise hardware" has the standard behaviour:

- Changes in Config are volatile until you "safe to bootconfig"

I really like that behaviour as a lockout can always made undone by letting someone power-cycle the device.

Safe Mode is a good thing, too, but it should be possible to make it "default".

Regards,

Stril
 
User avatar
bajodel
Long time Member
Long time Member
Posts: 545
Joined: Sun Nov 24, 2013 8:30 am
Location: Italy

Re: User with default Safe Mode

Thu Jan 26, 2017 7:29 am

.. cut..
I personally can settle for the same way safe mode is working now, just with an option in Winbox at the startup saying "launch in safe mode" that would simply click the safe mode button for me in the beginning. If somebody else is editing in safe mode - I will get an error message, which will at least give me a reminder (plus I would prefer to know that somebody is changing settings along side with me anyways). To save the changes I would need to click "safe mode" button (better if orange flashing) - that's similar to clicking "apply" or "save configuration" in other GUIs, which is something everyone is used to.
..cut..
+1 .. probably easy to implement and a good start
 
lamno
just joined
Posts: 4
Joined: Fri Feb 12, 2010 11:21 am

Re: User with default Safe Mode

Fri May 04, 2018 7:56 pm

i think mikrotik should make a limiting feature. For example user A login there are some mikrotik features that are forced hidden like mangle's page, routing's page etc

Who is online

Users browsing this forum: Bing [Bot] and 172 guests