RouterOS has built in SSH server that is enabled by default and is listening for incoming connections on port TCP/22. It is possible to change the port and disable the server under Services menu.
|allow-none-crypto (yes|no; Default: no)||Whether to allow connection if cryptographic algorithms are set to none.|
|always-allow-password-login (yes | no; Default: no)||Whether to allow password login at the same time when public key authorization is configured.|
|forwarding-enabled (both | local | no | remote; Default: no)||Allows to control which SSH forwarding method to allow:|
|host-key-size (1024 | 1536 | 2048 | 4096 | 8192; Default: 2048)||What RSA key size to use when host key is being regenerated.|
|strong-crypto (yes | no; Default: no)||Use stronger encryption, HMAC algorithms, use bigger DH primes and disallow weaker ones:|
|export-host-key (key-file-prefix)||Export public and private RSA/DSA keys to files. Command takes one parameter:|
|import-host-key (private-key-file)||Import and replace private DSA/RSA key from specified file. Command takes one parameter:|
|regenerate-host-key ()||Generated new and replace current set of private keys (DSA, RSA) on the router. Be aware that previously imported keys might stop working.|
Example of importing public key for user admin
Generate SSH keys on the client device (the device you will connect from). Upload the public SSH key to the router and import it.
It is able to connect to remote host and initiate ssh session. IP address supports both IPv4 and IPv6.
In this case user name provided to remote host is one that has logged into the router. If other value is required, then user=<username> has to be used.
For testing or security reasons it may be required to log-in to other host using certain source address of the connection. In this case src-address=<ip address> argument has to be used. Note that IP address in this case supports both, IPv4 and IPv6.
in this case, ssh client will try to bind to address specified and then initiate ssh connection to remote host.
Example of importing private key for user admin
First of all, export currently generated SSH keys to a file:
Two files admin_rsa and admin_rsa.pub will be generated. The pub file needs to be trusted on the SSH server side (how to enable SSH PKI on RouterOS) The private key has to be added for the particular user.
Only user with full rights on the router can change 'user' attribute value under /user ssh-keys private
After the public key is installed and trusted on the SSH server, a PKI SSH session can be created.
To execute remote command it has to be supplied at the end of log-in line
If the server does not support pseudo-tty (ssh -T or ssh host command), like mikrotik ssh server, then it is not possible to send multiline commands via SSH
For example, sending command
"/ip address \n add address=220.127.116.11/24" to MikroTik router will fail.
If you wish to execute remote commands via scripts or scheduler, use command ssh-exec.
Command ssh-exec is a non-interactive ssh command, thus allowing to execute commands remotely on a device via scripts and scheduler.
The command will return two values:
Example: Code below will retrieve interface status of ether1 from device 10.10.10.1 and output the result to "Log"
For security reasons, plain text password input is not allowed. To ensure safe execution of the command remotely, use SSH PKI authentication for users on both sides.
the user group and script policy executing the command requires test permission