Help & Documentation
Learn how to use Towerops to monitor your network infrastructure
MikroTik Configuration
Towerops supports read-only monitoring of MikroTik RouterOS devices via SSH. In addition to SNMP polling, SSH access allows Towerops to retrieve detailed system information and create configuration backups of your MikroTik devices for disaster recovery and audit purposes.
Read-Only Access
Towerops currently operates in read-only mode for MikroTik devices. Configuration changes, reboots, and other administrative actions are not supported. This ensures your device configurations remain unchanged by monitoring operations.
Cloud or Agent-Based Connections
Both SNMP polling and SSH connections to MikroTik devices can be performed from either Towerops cloud infrastructure or your remote poller (agent). For publicly accessible devices, cloud polling is the simplest option. For devices on private networks or when you prefer to keep SSH credentials on your local network, deploy a remote poller. The device assignment determines which poller handles both SNMP and SSH operations.
Security Best Practices
For security purposes, it is strongly recommended to create a dedicated read-only user account for Towerops rather than using an administrator account. This follows the principle of least privilege and minimizes potential security risks. Even though Towerops only performs read-only operations, limiting the account permissions provides defense in depth.
Creating a Read-Only User
Connect to your MikroTik device via SSH or terminal and execute the following commands to create a read-only user named towerops :
Step 1: Create a new user group with read-only permissions
/user group add name=readonly policy=ssh,read,test,api
Step 2: Create the monitoring user with a strong password
/user add name=towerops password=YOUR_STRONG_PASSWORD group=readonly
Step 3: Verify the user was created successfully
/user print detail where name=towerops
Permissions Explained
The readonly group includes the following permissions. Note that while these permissions are granted to the user account, Towerops only performs read operations and does not make any configuration changes:
| Permission | Description |
|---|---|
| ssh | Allow SSH access to the device |
| read | Allow viewing configuration and status (read-only) |
| test | Allow executing diagnostic commands (ping, traceroute, etc.) |
| api | Allow API access for automated monitoring |
Important Notes
- The read-only user cannot modify device configuration
- No write, reboot, or sensitive permissions are granted
- Use a strong, unique password for the monitoring account
- Consider restricting SSH access by source IP if possible
Configuring in Towerops
After creating the read-only user, configure SSH credentials in Towerops:
Organization-Level Configuration
Navigate to Organization Settings → MikroTik tab to set default SSH credentials for all MikroTik devices in your organization.
Site-Level Configuration
Navigate to Sites → select a site → Edit to override credentials for all devices at a specific location.
Device-Level Configuration
When editing a MikroTik device, you can specify unique SSH credentials that override organization and site defaults.
Security Recommendations
- Always use SSL/TLS for SSH connections (API-SSL on port 8729)
- Store credentials at the organization or site level when possible
- Rotate passwords periodically following your security policies
- Monitor access logs for unauthorized SSH connection attempts
- Consider using SSH keys instead of passwords (if supported by your setup)