Overview

User Manager is RADIUS server implementation in RouterOS which provides centralized user authentication and authorization to a certain service. Having a central user database allows better track of system users and customers. As a separate package, User Manager is available on all architectures including SMIPS, however care must be taken due to limited free space available. It supports many different authentication methods including PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP-TLS, EAP-TTLS and EAP-PEAP. In RouterOS, DHCP, Dot1x, Hotspot, IPsec, PPP, Wireless are features that benefit from User Manager the most. Each user can see their account statistics and manage available profiles using WEB interface. Additionally, users are able buy their own data plans (profiles) using the most popular payment gateway - PayPal making it a great system for service providers. Customized reports can be generated to ease processing by billing department. User Manager works according to RADIUS standard defined inRFC2865andRFC3579。

Attributes

Sub-menu:/user-manager attribute

RADIUS attributes are defined authorization, information and configuration parameters that are passed between the RADIUS server and client. User Manager allows sending customized attributes defined in "attributes" menu. RouterOS has a set of predefined attributes already present, but it is also possible to add additional attributes if necessary. Predefined attributes:

Properties

Database

Sub-menu:/user-manager database

All RADIUS related information is stored in a separate User Manager's database configurable under the "database" sub-menu. "Enabled" and "db-path" are the only parameters that are not stored in User Manager's database and are stored in main RouterOS configuration table meaning that these parameters will be affected by RouterOS configuration reset. The rest of the configuration, session and payment data is stored in a separate SQLite database on devices FLASH storage. When performing any actions with databases, it is advised to make backup before and after any activity.

Properties

Read-only properties

Commands

Limitations

Sub-menu:/user-manager limitation

Limitations are used by Profiles and are linked together by Profile-Limitations. RADIUS accounting and Interim updates must be enabled to seamlessly switch between multiple limitations or disconnect active sessions whendownload-limit,upload-limitoruptime-limitis reached.

To disconnect already active sessions from User Manager,acceptmust be set toyeson RADIUS client side. If simultaneous session limits are not unlimited (shared-users) and it has reached maximal allowed number, then router will try to disconnect older user session firstly.

User-Manager attempts to disconnect active session, before new user will be accepted (when appropriate limit is set), that's why in such setups it is suggested to use 1s for /radius client timeout.

Properties

Payments

Sub-menu:/user-manager payment

Information about all received payments are available in this section.

Read-only properties

Profiles

Sub-menu:/user-manager profile

Properties

Profile Limitations

Sub-menu:/user-manager profile-limitation

Profile-Limitations table links Limitations and Profiles together and defines its validity period. When multiple Limitations are assigned to the same Profile, a user must comply with all Limitations for session to establish. This allows more complicated setups to be created, for example, separate monthly and daily bandwidth limits.

Properties

Routers

Sub-menu:/user-manager router

Here are defined all NAS devices that can use User Manager as RADIUS server.

Properties

Commands

Sessions

Sub-menu:/user-manager session

Sessions are logged only if accounting is enabled on NAS.

Read-only properties

Settings

Sub-menu:/user-manager


Properties

Advanced

Sub-menu:/user-manager advanced

Properties

Users

Sub-menu:/user-manager user

Properties

Commands

User Groups

Sub-menu:/user-manager user group

User groups defines common characteristics of multiple users such as allowed authentication methods and RADIUS attributes. There are two groups already present in User Manager calleddefaultanddefault-anonymous。

Properties

User Profiles

Sub-menu:/user-manager user-profile

This menu assigns users with a profile and tracks the status of the profile. A single user can have multiple profiles assigned, however only one can be used at the same time. A user will seamlessly be switched to the next profile when currently active profile expires without dropping the user's session.

Properties

Read-only properties

Commands

WEB Interface

Each user has access to his personal profile using a WEB interface. The WEB interface can be accessed by adding "/um/" directory to router's IP or domain, for example,http://example.com/um/。注意WEB界面是影响IP Services "www" and "www-ssl". The WEB interface can be customized using CSS, JavaScript and HTML.

Customizable file reference

Application Guides

Batch user creation

It is possible to create multiple new users with randomly generated username and password. For example, the following command will generate 3 new users with 6 lowercase symbols as the username and 6 lowercase, uppercase and numbers as the password.

/user-manager user add-batch-users number-of-users=3 password-characters=lowercase,numbers,uppercase password-length=6 username-characters=lowercase username-length=6

The command generated users can be seen by printing the user's table:

/用户管理员用户打印标志:X -禁用0不结盟运动e="olsgkl" password="86a6zH" otp-secret="" group=default shared-users=1 attributes="" 1 name="lkbwss" password="jaKY5V" otp-secret="" group=default shared-users=1 attributes="" 2 name="cwxbwu" password="a62yZd" otp-secret="" group=default shared-users=1 attributes=""

Providing NAS with custom RADIUS attributes

It is possible to send additional RADIUS attributes during authentication process to provide NAS with custom information about the session, such as what IP address should be assigned to the supplicant or what address pool to use for address assigning.

Static IP address for a user

最终用户分配一个静态IP地址,Framed-IP-Addressattribute can be used. When using static IP address allocation,shared-sessionsmust be set to 1 to prevent cases when a user has multiple simultaneous sessions, but there is only one IP address. For example:

/user-manager user set [find name=username] shared-users=1 attributes=Framed-IP-Address:192.168.1.4

Specifying address pool for group of users

We can group up multiple similar users and assign RADIUS attributes to all of them at once. First of all, create a new group:

/user-manager user group add name=location1 outer-auths=chap,eap-mschap2,eap-peap,eap-tls,eap-ttls,mschap1,mschap2,pap \ inner-auths=peap-mschap2,ttls-chap,ttls-mschap1,ttls-mschap2,ttls-pap attributes=Framed-Pool:pool1

Next step is to assign a user to the group:

/user-manager user set [find name=username] group=location1

In this case an IP address frompool1will be assigned to the user upon authentication - make surepool1is created on NAS device.

Using TOTP (time-based one time password) for user authentication

User Manager supports time based authentication token addition to user's password field that is regenerated every 30 seconds.

TOTP works by having a shared secret on the supplicant (client) and the authentication server (User Manager). To configure TOTP on RouterOS, simply set theotp-secretfor the user. For example:

/user-manager user set [find name=username] password=mypass otp-secret=mysecret

To calculate TOTP token on supplicant side, many widely available applications can be used, for example, Google Authenticator orhttps://totp.app/。Addingmysecretto TOTP token generator will provide a new unique 6 digit code that must be added to the users password.

The following example will accept user's authentication with calculated TOTP token added to the common password until a new TOTP token is generated, for example,

User-Name=username User-Password=mypass620872

Exporting user credentials

Printable login credentials for single user

To generate a single user's printable voucher card, simply use thegenerate-vouchercommand. Specify the RouterOS ID number of the user or usefindcommand to specify a username. A template is already included in User Manager's installation available in Files section of your device. You can customize the template for your needs.

/user-manager user generate-voucher voucher-template=printable_vouchers.html [find where name=username]

The generated voucher card is available by accessing the router using a WEB browser and navigating to/um/PRIVATE/GENERATED/vouchers/gen_printable_vouchers.html

By default the printable card looks like this:

It is possible to use different variables when generating vouchers. Currently, supported variables are:

$(username) - Represents User Manager username
$(password) - Password of the username
$(userprofname) - Profile that is active for the particular user
$(userprofendtime) - Profile validity end time if specified

Multiple user credential export

It is possible to generate a CSV or XML file with multiple or all user credentials at once by using theexport.xmlorexport.csvasvoucher-template。

/user-manager user generate-voucher voucher-template=export.xml [find]

The command generates an XML fileum5files/PRIVATE/GENERATED/vouchers/gen_export.xmlwhich can either be accessible by WEB browser or any other file access tools.

   olsgkl 86a6zH   lkbwss jaKY5V   cwxbwu a62yZd   username secretpassword  

Generating usage report

In cases where a presentable network usage information is required by companies billing or legal team an automated session export can be created usinggenerate-reportcommand. The command requires an input of report template - an example of the template is available inum5files/PRIVATE/TEMPLATES/reports/report_default.html。Example of the report generation:

/user-manager generate-report report-template=report_default.html columns=username,uptime,download,upload

The generated report is available by accessing the router using a WEB browser and navigating to/um/PRIVATE/GENERATED/reports/gen_report_default.html

Purchasing a profile

After logging into user's private profile by accessing the router's/um/directory using WEB browser, for example,http://example.com/um/,he will be able to see all availableProfilesin the respective menu. Profiles that have specifiedpricevalue will haveBuy this Profilebutton available.

After pressing theBuy this Profilebutton, the user will be asked to choose from available transaction service providers (currently only PayPal available) and later redirected to PayPal's payment processing page.

When the payment is completed, the User Manager will ask PayPal to approve the transaction. After approval, the profile is assigned to the user and is ready to use.

Migrating from RouterOS v6

Application Examples

Basic L2TP/IPsec server with User Manager authentication

User Manager configuration

Start off by enabling User Manager functionality.

/user-manager set enabled=yes

Allow receiving RADIUS requests from the localhost (the router itself).

/user-manager router add address=127.0.0.1 comment=localhost name=local shared-secret=test

Next, add users and their credentials that clients will use to authenticate to the server.

/user-manager user add name=user1 password=password

Configuring RADIUS client

For the router to use RADIUS server for user authentication, it is required to add a new RADIUS client that has the same shared secret that we already configured on User Manager.

/radius add address=127.0.0.1 secret=test service=ipsec

L2TP/IPsec server configuration

Configure the IP pool from which IP addresses will be assigned to the users and assign it to the PPP Profile.

/ip pool add name=vpn-pool range=192.168.99.2-192.168.99.100 /ppp profile set default-encryption local-address=192.168.99.1 remote-address=vpn-pool

Enable the use of RADIUS for PPP authentication.

/ppp aaa set use-radius=yes

Enable L2TP server with IPsec encryption.

/interface l2tp-server server set enabled=yes use-ipsec=required ipsec-secret=mySecret

That is it. Your router is now ready to accept L2TP/IPsec connections and authenticate them to the internal User Manager.