Main Content

Mikrotik – RouterOS SSH Public Key Authentication

If you intent to make use of a RSA key make sure you are running RouterOS 6.31 version or above, otherwise you may receive an error like this one unable to load key file (incorrect passphrase?) !. If the installation needs to be update then refer to this post on How to Upgrade RouterOS from the Command Line. NOte: you need access to a Linux system to generate the private and public key pair.

Key Generation

Use the ssh-keygen command to generate an RSA key pair. This step is almost automated for you just wait.

lventura@SF-DEV:~$ ssh-keygen -t rsa

You can view the key pair in their respective directory. Remember: is meant to be public and will be the file we upload to the remote system.

lventura@HM-R:~/scripts $ ls ~/.ssh
authorized_keys  id_rsa  known_hosts

The key pair will reside in the ~/.ssh found in the users home directory. Use SCP to copy the public key pair from the Linux system over to the Mikrotik RouterOS system just change the IP address to that of your router.

lventura@SF-DEV:~$ scp ~/.ssh/

Now log-in to RouterOS and import key we just uploaded. I’m importing a key for the user admin you can change this to the of any other user.

RouterOS Key Import

[admin@HM-GW] > /user ssh-keys import user=admin

Let’s view the user new SSH key.

[admin@HM-GW] > /user ssh-keys print
Flags: R - RSA, D - DSA
 #   USER                       BITS KEY-OWNER
 0 R admin                      2048

New Key Test

Using an SSH client with the new private SSH key attempt to log-in to RouterOS, if successful you shouldn’t be prompted for a password.