Community discussions

MikroTik App
 
fleg
newbie
Topic Author
Posts: 26
Joined: Mon Nov 06, 2017 12:31 pm

Admin script in jobs after log in

Mon Jan 25, 2021 9:49 pm

Is this normal? I can see in my some gws when I log in (via winbox) I can see new job(s)...see attach.
obrázek_2021-01-25_203649.png
I`m confused because I tried about 10 MTs and there are half to half....somewhere I can see jobs after log in somewhere not).
Btw there are various ROS (6.43 yes, 6.47.8 yes, 6.48 yes, 6.44.5 yes, 6.45.5 no, 6.43.rc66 no, 6.43.8 no, 6.47.7 no...etc)....all in public IP.
You do not have the required permissions to view the files attached to this post.
 
User avatar
Jotne
Forum Guru
Forum Guru
Posts: 1915
Joined: Sat Dec 24, 2016 11:17 am
Location: jo.overland at gmail.com

Re: Admin script in jobs after log in

Tue Jan 26, 2021 8:34 am

On what version do you see this problem? Older version of Mikrotik are vulnerable for attack using Winbox.
What are listed in the Script tab?
Upgrade all routers to at least 6.45, I would suggest 6.47.9

Do you have access to the router using public IP to Winbox?
You should use VPN instead.

If you need to use Winbox and can not use VPN.

1. Use another port than default.
2. Use port knocking. This prevents someone from seeing open ports.
3. Use a long and good password.
4. Use access list to prevent any random internet from accessing your router.
5. Log everything. (See my signature for example.)
6. Upgrade firmware to latest stable release
7. ++++
 
Why do not use Splunk to monitor your MikroTik Router(s)? Look at this page in how to set it up.

MikroTik->Splunk
 
 
fleg
newbie
Topic Author
Posts: 26
Joined: Mon Nov 06, 2017 12:31 pm

Re: Admin script in jobs after log in

Tue Jan 26, 2021 9:16 am

Couldn`t see the versions mate? There are various ROS versions.
Of course mostly I`m using connection only from VPN range.
I know known ROS vulne. because I had hacked several gws a few year ago;o)
 
User avatar
tomaskir
Trainer
Trainer
Posts: 1151
Joined: Sat Sep 24, 2011 2:32 pm
Location: Slovakia

Re: Admin script in jobs after log in  [SOLVED]

Tue Jan 26, 2021 11:49 pm

Do you have the terminal window open in Winbox?

Each terminal in Winbox spawns it's own job - maybe you had a saved session that contained terminals, so when you logged in, Winbox re-launched those terminal windows, and that's why you see active jobs?
Unimus - configuration management, automation and backup solution
Mass Config Push, network-wide RouterOS upgrades, and more!
 
fleg
newbie
Topic Author
Posts: 26
Joined: Mon Nov 06, 2017 12:31 pm

Re: Admin script in jobs after log in

Wed Jan 27, 2021 10:00 am

Do you have the terminal window open in Winbox?

Each terminal in Winbox spawns it's own job - maybe you had a saved session that contained terminals, so when you logged in, Winbox re-launched those terminal windows, and that's why you see active jobs?
You`re right, Great work.

Who is online

Users browsing this forum: nescafe2002, Sajad2010 and 18 guests