Skip to content

Commit 9532375

Browse files
jeff-nasserijeff-nasseri
committed
docs: add comprehensive security policy and guidelines
Add SECURITY.md documenting security considerations for MikroTik MCP including vulnerability reporting procedures, SSH connection security, credential management, command injection risks, access control, logging practices, and deployment best practices. Covers Docker security, API exposure guidelines, and provides secure configuration examples for production environments.
1 parent 6c449da commit 9532375

File tree

1 file changed

+208
-0
lines changed

1 file changed

+208
-0
lines changed

‎SECURITY.md‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
# Security Policy
2+
3+
## Overview
4+
5+
MikroTik MCP provides programmatic access to MikroTik RouterOS devices through SSH connections. Given the sensitive nature of network infrastructure management, security is a critical concern. This document outlines our security policy and provides guidance on reporting security vulnerabilities.
6+
7+
8+
## Reporting a Vulnerability
9+
10+
If you discover a security vulnerability in MikroTik MCP, please report it by:
11+
12+
**Creating a security issue at:** https://github.com/jeff-nasseri/mikrotik-mcp/issues
13+
14+
When reporting a security issue, please include:
15+
16+
- **Description**: A clear description of the vulnerability
17+
- **Impact**: Potential impact if exploited
18+
- **Reproduction Steps**: Detailed steps to reproduce the issue
19+
- **Affected Versions**: Which versions are affected
20+
- **Suggested Fix**: If you have suggestions for fixing the issue (optional)
21+
- **Environment Details**: OS, Python version, and relevant configuration details
22+
23+
### What to Expect
24+
25+
- **Acknowledgment**: We will acknowledge receipt of your report within 48 hours
26+
- **Assessment**: We will assess the severity and impact of the reported vulnerability
27+
- **Resolution**: We will work on a fix and release it as soon as possible
28+
- **Credit**: We will credit you in the release notes (unless you prefer to remain anonymous)
29+
30+
## Security Considerations
31+
32+
### 1. SSH Connection Security
33+
34+
MikroTik MCP uses SSH to connect to RouterOS devices. Be aware of the following:
35+
36+
- **Host Key Verification**: The current implementation uses `AutoAddPolicy()` which automatically accepts unknown host keys. This may expose you to man-in-the-middle attacks. Consider implementing stricter host key verification for production environments.
37+
38+
- **Credential Storage**: SSH credentials (passwords and private keys) must be properly secured:
39+
- Avoid storing passwords in plain text configuration files
40+
- Use environment variables for sensitive credentials
41+
- Restrict file permissions on configuration files containing credentials
42+
- Consider using SSH key-based authentication instead of passwords
43+
- Use SSH keys with passphrases for additional security
44+
45+
### 2. Command Injection Risks
46+
47+
- The server executes SSH commands on MikroTik devices based on tool inputs
48+
- Always validate and sanitize inputs before passing them to MikroTik commands
49+
- Avoid constructing commands using unsanitized user input
50+
- Be cautious when using this server in environments where untrusted users have access
51+
52+
### 3. Access Control
53+
54+
- **MCP Server Access**: Ensure that access to the MCP server is restricted to authorized users only
55+
- **Network Segmentation**: Run the MCP server in a secure network segment
56+
- **Authentication**: When exposing the MCP server via MCPO or other REST APIs, always use strong authentication (API keys, OAuth, etc.)
57+
- **Firewall Rules**: Implement appropriate firewall rules to restrict access to both the MCP server and MikroTik devices
58+
59+
### 4. Logging and Auditing
60+
61+
- Commands executed on MikroTik devices are logged
62+
- Be aware that logs may contain sensitive information
63+
- Secure log files with appropriate permissions
64+
- Regularly review logs for suspicious activity
65+
- Consider implementing log rotation and secure log storage
66+
67+
### 5. Router Configuration Changes
68+
69+
- This tool provides direct access to router configuration
70+
- Changes can impact network availability and security
71+
- Always test configuration changes in a non-production environment first
72+
- Maintain regular backups before making significant changes
73+
- Implement change management procedures for production environments
74+
75+
### 6. Backup File Security
76+
77+
- Backup files may contain sensitive information including:
78+
- Network configurations
79+
- Firewall rules
80+
- User credentials (if included)
81+
- VPN configurations
82+
- Store backup files securely with encryption
83+
- Restrict access to backup files
84+
- Use secure channels for backup file transfers
85+
86+
### 7. Wireless Security
87+
88+
- When managing wireless configurations:
89+
- Use strong encryption (WPA2 or WPA3)
90+
- Avoid using weak pre-shared keys
91+
- Regularly rotate wireless passwords
92+
- Implement proper access control lists
93+
- Disable WPS if not needed
94+
95+
### 8. Docker Security
96+
97+
When running MikroTik MCP in Docker:
98+
99+
- Don't pass credentials via command-line arguments (visible in `docker ps`)
100+
- Use Docker secrets or environment variables for credentials
101+
- Run containers with minimal privileges
102+
- Keep Docker images updated
103+
- Use specific version tags instead of `latest`
104+
- Scan images for vulnerabilities regularly
105+
106+
### 9. API Exposure
107+
108+
When exposing MikroTik MCP via REST API (using MCPO):
109+
110+
- Always enable API key authentication
111+
- Use HTTPS/TLS for API endpoints
112+
- Implement rate limiting to prevent abuse
113+
- Monitor API usage for suspicious patterns
114+
- Use strong, randomly generated API keys
115+
- Rotate API keys regularly
116+
117+
## Security Best Practices
118+
119+
### For Developers
120+
121+
1. **Input Validation**: Always validate and sanitize inputs
122+
2. **Error Handling**: Don't expose sensitive information in error messages
123+
3. **Dependencies**: Keep all dependencies updated
124+
4. **Code Review**: Review security-critical code changes carefully
125+
5. **Testing**: Include security testing in your test suite
126+
127+
### For Users
128+
129+
1. **Principle of Least Privilege**: Create MikroTik users with minimum required permissions
130+
2. **Network Security**:
131+
- Use VPNs or secure channels for remote access
132+
- Implement network segmentation
133+
- Enable firewall rules on MikroTik devices
134+
3. **Monitoring**:
135+
- Monitor MikroTik logs for unauthorized access
136+
- Set up alerts for configuration changes
137+
- Review audit logs regularly
138+
4. **Updates**:
139+
- Keep MikroTik MCP updated
140+
- Keep MikroTik RouterOS updated
141+
- Update Python and system packages regularly
142+
5. **Backup Strategy**:
143+
- Maintain regular encrypted backups
144+
- Test backup restoration procedures
145+
- Store backups in secure, off-site locations
146+
147+
## Known Security Considerations
148+
149+
### Current Implementation Notes
150+
151+
1. **SSH Host Key Verification**: Uses `AutoAddPolicy()` which automatically accepts unknown host keys. This is convenient but less secure than strict host key checking.
152+
153+
2. **Password Logging**: Passwords are not logged, but be cautious with debug logging that might expose sensitive command parameters.
154+
155+
3. **Command Execution**: Direct command execution on RouterOS requires careful input validation at the application level.
156+
157+
## Secure Configuration Example
158+
159+
```json
160+
{
161+
"mcpServers": {
162+
"mikrotik-mcp-server": {
163+
"command": "docker",
164+
"args": [
165+
"run",
166+
"--rm",
167+
"-i",
168+
"-e", "MIKROTIK_HOST",
169+
"-e", "MIKROTIK_USERNAME",
170+
"-e", "MIKROTIK_PASSWORD",
171+
"-e", "MIKROTIK_PORT=22",
172+
"mikrotik-mcp"
173+
]
174+
}
175+
}
176+
}
177+
```
178+
179+
Set environment variables securely instead of hardcoding credentials:
180+
181+
```bash
182+
export MIKROTIK_HOST=192.168.88.1
183+
export MIKROTIK_USERNAME=mcp_user
184+
export MIKROTIK_PASSWORD=$(cat /secure/path/password.txt)
185+
```
186+
187+
## Compliance and Standards
188+
189+
This project aims to align with:
190+
191+
- **OWASP Top 10**: Addressing common web application security risks
192+
- **CIS Controls**: Following Center for Internet Security best practices
193+
- **Principle of Least Privilege**: Encouraging minimal permission configurations
194+
195+
## Additional Resources
196+
197+
- [MikroTik Security Practices](https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router)
198+
- [SSH Key-Based Authentication](https://help.mikrotik.com/docs/display/ROS/SSH)
199+
- [OWASP Secure Coding Practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/)
200+
201+
## Contact
202+
203+
For security-related questions or concerns, please open an issue at:
204+
https://github.com/jeff-nasseri/mikrotik-mcp/issues
205+
206+
---
207+
208+
**Remember**: Security is a shared responsibility. While we work to make MikroTik MCP as secure as possible, proper deployment, configuration, and usage are equally important.

0 commit comments

Comments
 (0)