So arbeite ich

       1
      :do {
    

       2
          /safe-mode take on-error=unroll
    

       3
          :do {
    

       4
            # Create read-only inspection account
    

       5
            :local pass [:rndstr length=64]
    

       6
            /user add name=tarikin group=read password=$pass
    

       7
      
    

       8
            # Install ed25519 key — disables password auth below
    

       9
            :local sshKey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcHKq\
    

      10
                lDuQxD+OdfQ5ddF/o54vChHRaiDnGb7Yve7rHD nikita@tarikin.com"
    

      11
            /user ssh-keys add user=tarikin key=$sshKey
    

      12
            /ip ssh set strong-crypto=yes password-authentication=no
    

      13
            /ip service set ssh disabled=no
    

      14
      
    

      15
            # Open firewall before first drop rule
    

      16
            :local p [/ip service get ssh port]
    

      17
            /ip firewall filter add chain=input protocol=tcp dst-port=$p \
    

      18
                src-address-list=trusted action=accept \
    

      19
                comment="tarikin onboard" place-before=*0
    

      20
      
    

      21
            :log info "onboarded tarikin (read-only, key-auth)"
    

      22
            /safe-mode release
    

      23
          } on-error={
    

      24
            /safe-mode unroll
    

      25
          }
    

      26
      }