SSH key authentication replaces the password prompt with a cryptographic key pair. Instead of typing a password every time you connect to a router, the client proves its identity with a private key that never leaves your machine.
In this guide, we will generate an SSH key pair on Ubuntu 24.04, upload the public key to a MikroTik router, import it for a RouterOS user and finally disable password authentication so that only key-based logins are accepted.
Requirements
Before starting, make sure you have a machine running Ubuntu 24.04 with the OpenSSH client installed, and a MikroTik router running RouterOS 6 or RouterOS 7 that is reachable over the network.
You will also need a RouterOS user account with the ssh, read and write policies. In this guide the user is nocnmt and the router address is 192.168.11.1.
Check that the SSH client is available on Ubuntu:
If the command is not found, install the client package:
Generate an SSH Key Pair on Ubuntu
Generate a 4096-bit RSA key pair with ssh-keygen. RSA is the safest choice because it is supported by every RouterOS version, including RouterOS 6:
The utility asks where to store the key and whether to protect it with a passphrase. Press Enter to accept the default path and leave the passphrase empty for a fully unattended login:
A passphrase adds a second layer of protection in case the private key file is ever stolen. It has to be entered on every connection unless ssh-agent is used, so for automation and scripted backups an empty passphrase is the usual choice.
The key was generated as root in the example above, which means it is stored in /root/.ssh. If you generate the key as a regular user, the files are placed in the home directory of that user and only that user will be able to use them.
Using an Ed25519 Key Instead
RouterOS 7 also accepts Ed25519 keys. They are shorter, faster and considered the modern default:
The resulting files are named id_ed25519 and id_ed25519.pub. Use these names instead of id_rsa in the commands that follow. If your router still runs RouterOS 6, stay with the RSA key.
Review the Generated Key Files
List the contents of the .ssh directory:
Two files were created. id_rsa is the private key: it stays on the Ubuntu machine and must never be copied to the router or shared with anyone. id_rsa.pub is the public key, and this is the file that gets uploaded to the MikroTik router.
Display the public key to confirm it is a single line starting with ssh-rsa:
Verify that the permissions are correct. OpenSSH refuses to use a private key that is readable by other users:
Upload the Public Key to the MikroTik Router
Copy the public key to the root of the router file system with scp. This is the last time a password will be requested:
Ubuntu 24.04 ships with OpenSSH 9.x, where scp uses the SFTP protocol by default. RouterOS 6 does not provide an SFTP subsystem, so the transfer may fail with subsystem request failed on channel 0. In that case force the legacy SCP protocol with the -O option:
As an alternative, the file can be dragged into the Files window in Winbox, which produces exactly the same result.
Log in to the router and confirm that the file has arrived:
Import the Public Key in RouterOS
Still on the router, import the uploaded file and bind it to the user account:
The user parameter is the RouterOS user the key belongs to. A key imported for one user will not authenticate any other user, so repeat the import for every account that needs key-based access.
Verify the imported key:
The output lists the user, the key type and the key bit count. Once the key is stored in the configuration, the uploaded file is no longer needed and can be removed:
A key that was imported by mistake can be deleted by its number:
Test the Passwordless Login
Back on the Ubuntu machine, connect to the router:
The RouterOS console should open without a password prompt. If the key is stored under a non-default name, point to it explicitly:
Single commands can now be executed remotely without any interaction, which is what makes scripted backups and monitoring possible:
If the login still asks for a password, run the client in verbose mode to see which key was offered and how the router answered:
Create an SSH Config Entry (Optional)
When several routers are managed from the same machine, an entry in ~/.ssh/config saves typing the user, address and key on every connection:
Add a host block for the router:
Set the permissions required by OpenSSH:
The router can now be reached by its alias:
Disable Password Authentication on the Router
As long as password login remains enabled, the router is still exposed to brute-force attempts. After confirming that the key works, force RouterOS to accept public key authentication only:
It is also worth enabling the stronger cipher and key exchange set, which disables the legacy algorithms in the SSH daemon:
Review the current SSH service settings:
Important: keep the current session open and verify the key login from a second terminal before closing it. If the key is not working and password login has already been disabled, the only remaining ways in are Winbox, the web interface or a serial console.
Access to the SSH service should also be limited to trusted networks. Restrict the service to a management subnet:
Changing the default port reduces the noise from automated scanners:
Troubleshooting
Permission denied (publickey) - the key was imported for a different RouterOS user, or the client is connecting with a different key. Compare the user name in the connection string with the output of /user ssh-keys print.
The router still asks for a password - the client did not offer the key. Check the output of ssh -v and confirm that the private key exists in the home directory of the user running the command. A key generated as root is not visible to a regular user.
subsystem request failed on channel 0 - OpenSSH 9 tried to use SFTP against a RouterOS 6 device. Repeat the transfer with scp -O.
no matching host key type found - the router offers an algorithm that modern OpenSSH no longer enables by default. Connect once with the algorithm added explicitly and plan a RouterOS upgrade:
Bad permissions / UNPROTECTED PRIVATE KEY FILE - the private key is readable by other users. Restore the permissions with chmod 600 ~/.ssh/id_rsa.
WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED - the router was reinstalled or replaced and its host key is different. Remove the stale entry:
Conclusion
The Ubuntu machine now authenticates to the MikroTik router with an SSH key instead of a password, and the router no longer accepts password logins at all.
The same key pair can be imported on every router in the network, which makes automated configuration backups, scripted changes and monitoring possible without storing a single password in a script.