Mikrotik - RouterOS SSH Public Key Authentication

If you intent to make use of a RSA key make sure you are running RouterOS 6.31 version or above, otherwise you may receive an error like this one unable to load key file (incorrect passphrase?) !. If the installation needs to be update then refer to this post on How to Upgrade RouterOS from the Command Line. NOte: you need access to a Linux system to generate the private and public key pair.

Key Generation

Use the ssh-keygen command to generate an RSA key pair. This step is almost automated for you just wait.

1

ssh-keygen -t rsa

You can view the key pair in their respective directory. Remember: id_rsa.pub is meant to be public and will be the file we upload to the remote system.

1
2
3

ls ~/.ssh

authorized\_keys  id\_rsa  id\_rsa.pub  known\_hosts

The key pair will reside in the ~/.ssh found in the users home directory. Use SCP to copy the public key pair from the Linux system over to the Mikrotik RouterOS system just change the IP address to that of your router.

1

scp ~/.ssh/id\_rsa.pub admin@192.168.100.1:id\_rsa.pub

Now log-in to RouterOS and import id_rsa.pub key we just uploaded. I’m importing a key for the user admin you can change this to the of any other user.

RouterOS Key Import

1

/user ssh-keys import public-key-file=id\_rsa.pub user=admin

Let’s view the user new SSH key.

1
2
3
4

/user ssh-keys print
Flags: R - RSA, D - DSA
 #   USER                       BITS KEY-OWNER
 0 R admin                      2048

New Key Test

Using an SSH client with the new private SSH key attempt to log-in to RouterOS, if successful you shouldn’t be prompted for a password.

— Apr 2, 2016