MikroTik Manager

1. Architecture Overview

MikroTik Manager is a fully self-hosted network management application distributed as a Docker container. It runs entirely within the customer's own infrastructure.

2. Data Residency & Privacy

3. Authentication & Authorization

3.1 User Authentication

• JWT-based authentication — short-lived access tokens (15 min) + refresh tokens (7 days)
• bcrypt password hashing — passwords are never stored in plaintext
• Automatic token refresh on expiration
• Refresh tokens invalidated on password change — refresh tokens carry the password-change timestamp; the refresh endpoint rejects any token issued before the user's most recent password update
• Auto-generated secrets on fresh installs — JWT_SECRET and ENCRYPTION_KEY are auto-generated and persisted to data/.secrets.json (file mode 0600) when not supplied via environment, eliminating the public-default risk
• Admin auto-seed only on empty database — the default admin/admin user is created once on first install; deleting it does not re-seed on the next restart

3.2 Role-Based Access Control

3.3 Device Credential Security

• Device passwords encrypted at rest using AES-256-GCM
• Each encrypted value uses a unique initialization vector (IV)
• Encryption key configurable via environment variable
• Credentials decrypted only in memory at the moment of device communication

Recommended: create a dedicated MikroTik user group with minimal policies:

/user/group/add name=manager-group policy=ssh,reboot,read,write,sensitive,rest-api,policy,!local,!telnet,!ftp,!test,!winbox,!password,!web,!sniff,api,!romon

4. Network Security

4.1 Transport Encryption

• HTTPS/TLS — optional TLS server on port 3443
• WebSocket Secure (WSS) — automatic over HTTPS
• Supports custom certificates or auto-generated self-signed
• HTTP and HTTPS can run in parallel for migration

4.2 Device Communication

4.3 Network Exposure

• No inbound connections required from outside the network
• No outbound connections to external services
• Designed to run behind a reverse proxy for production

5. Data Protection

Encryption at Rest

Encryption in Transit

6. Container Security

• Base image: node:22-alpine — minimal attack surface
• Multi-stage build — build dependencies excluded from final image
• Non-root execution — runs as non-privileged user
• Minimal packages — Alpine-based with no extras
• No privileged flags — no host network access required
• Only required ports exposed (3000 HTTP, 3443 HTTPS)
• Data persistence via Docker volume mount

7. Dependency Management

• Runtime dependencies pinned in package-lock.json
• No external API calls — fully self-contained
• Key dependencies: express, better-sqlite3, node-ssh, net-snmp, jsonwebtoken, bcrypt, ws

8. Supply Chain Security

MikroTik Manager minimizes supply chain risk through controlled dependencies, reproducible builds, and a fully self-contained distribution model.

8.1 Docker Image Integrity

• Official base image — built on node:22-alpine from Docker Hub official library
• Multi-stage build — build tools and dev dependencies are excluded from the final image
• Immutable tags — each release is tagged with a specific version (e.g., v1.17.0), never overwritten
• GitHub distribution — images distributed via GitHub Container Registry (ghcr.io), tied to the official repository

8.2 Dependency Controls

• Locked dependencies — package-lock.json ensures reproducible installs with exact versions and integrity hashes
• Minimal dependency tree — only essential runtime packages, no unnecessary transitive dependencies
• No post-install scripts — no npm lifecycle scripts that execute arbitrary code during installation
• No CDN or external assets — all frontend assets bundled locally, no runtime fetches from third-party servers

8.3 Build Process

• Reproducible builds — identical source + lockfile produces identical output
• No remote code execution — the build process does not download or execute code outside of pinned npm packages
• Single author — all code written and reviewed by the maintainer, no external contributors with commit access

8.4 Runtime Isolation

• No auto-updates — the application never downloads or applies updates by itself
• No plugin system — no mechanism for loading external code at runtime
• No outbound connections — the container makes zero network calls outside the customer's network

9. OWASP Top 10 Coverage

10. Deployment Recommendations

11. Compliance Notes

12. Vulnerability Reporting

To report a security vulnerability, contact: ihor@hreskiv.pl

We take security reports seriously and will respond within 48 hours.