From 2d373da676aad9f54b7414fd79dfdf69457eefb7 Mon Sep 17 00:00:00 2001 From: scossa Date: Thu, 19 Dec 2024 01:23:32 +0100 Subject: [PATCH] hardeningsara --- README.md | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/README.md b/README.md index e69de29..556ff54 100644 --- a/README.md +++ b/README.md @@ -0,0 +1,42 @@ +# Hardening Mikrotik con Sara + +## Fai il backup del mikrotik e installa sara +### Fai il backup verbose del mikrotik in modo da generare un .rsc invece di un .backup +``` +/export verbose file=mybackup +``` +### Scarica il backup da webgui +"File" (nel menu a sx) > "Download" in corrispondenza del backup salvato +### Installa sara +``` +# kali (e parrot?): +sudo apt update && sudo apt install sara -y +# altri: +via python3 https://github.com/casterbyte/sara +``` +### Testa la configurazione del mikrotik con sara +``` +sara --config-file /home/$USER/Downloads/mybackup.rsc +``` + +## ESEMPI: +### Disabilita i servizi inutili +``` +/ip service set telnet disabled=yes +/ip service set ftp disabled=yes +#/ip service set www disabled=no (la 80 รจ da tenere aperta per l'accesso remoto default e non chiuderci fuori) +/ip service set www-ssl disabled=yes +/ip service set api disabled=yes +/ip service set api-ssl disabled=yes +#/ip service set winbox disabled=no (l'accesso via ethernet l2 potremmo volerlo tenere abilitato per evitarci l'hard reset) +``` +### Impedisci attacchi al bootloader... +``` +/system routerboard upgrade #(se non hai >=6.49.17) +/system reboot #(se non hai >=6.49.17) +/system routerboard settings set protected-routerboot=enabled +``` +#### ... quindi verifica +``` +/system routerboard settings print +```