Manual:IP/SSH: Difference between revisions
| Line 34: | Line 34: | ||
|desc=Allows to control which SSH forwarding method to allow: | |desc=Allows to control which SSH forwarding method to allow: | ||
* <var>no</var> - SSH forwarding is disabled; | * <var>no</var> - SSH forwarding is disabled; | ||
* <var>local</var> - Allow SSH clients to originate connections from the server; | * <var>local</var> - Allow SSH clients to originate connections from the server(router), this setting controls also dynamic forwarding; | ||
* <var>remote</var> - Allow SSH clients to listen on the server and forward incoming connections; | * <var>remote</var> - Allow SSH clients to listen on the server(router) and forward incoming connections; | ||
* <var>both</var> - Allow both local and remote forwarding methods. | * <var>both</var> - Allow both local and remote forwarding methods. | ||
}} | }} | ||
Revision as of 09:54, 29 April 2019
Summary
This menu controls if ssh server behaviour regarding port forward and authentication methods.
Settings
| Property | Description |
|---|---|
| allow-none-crypto (yes|no; Default: yes) | Whether to allow connection if cryptographic algorithms are set to none. |
| always-allow-password-login (yes | no; Default: no) | Whether to allow password login at the same time when public key authorization is configured. |
| forwarding-enabled (both | local | no | remote; Default: no) | Allows to control which SSH forwarding method to allow:
|
| host-key-size (1024 | 1536 | 2048 | 4096 | 8192; Default: 2048) | What RSA key size to use when host key is being regenerated. |
| strong-crypto (yes | no; Default: no) | Use stronger encryption, HMAC algorithms, use bigger DH primes and disallow weaker ones:
|
Commands
| Property | Description |
|---|---|
| export-host-key (key-file-prefix) | Export public and private RSA/DSA keys to files. Command takes one parameter:
|
| import-host-key (private-key-file) | Import and replace private DSA/RSA key from specified file. Command takes one parameter:
|
| regenerate-host-key () | Generated new and replace current set of private keys (DSA, RSA) on the router. Be aware that previously imported keys might stop working. |
Note: When connecting from RouterOS built in client to router with strong crypto disabled, temporary strong crypto must be disabled on connecting router too. Reason is that strong crypto forces algorithms which are not supported when this feature is disabled.
Example
Local forwarding
To use local forwarding from Linux host using OpenSSH client type in following command:
ssh <remote_user>@<remote_host> -L <local_port>:<remote_host>:<remote_port>
where:
- remote_user - username on the router
- remote_host - routers address (router should be able to resolve host name if address is not an IP address)
- local_port - local port that your host will listen on
- remote_port - port on the router
For example, if user requires telnet to router, but you do not want to allow it to be plain text, Following can be done:
ssh admin@192.168.88.1 -L 3000:192.168.88.1:23
now when user uses telnet localhost 3000" it will log in the router using telnet over encrypted tcp connection.
Note: we fully support SFTP v3 as described in draft-ietf-secsh-filexfer-02.txt other versions can cause problems
Remote Forwarding
SSH from the client makes a tunnel that opens up a new port on the server (router), and connects it to a local port on the client,
ssh <remote_user>@<remote_host> -R <remote_port>:localhost:<local_port>
where:
- remote_user - username on the router
- remote_host - routers address (router should be able to resolve host name if address is not an IP address)
- local_port - local port that your host will listen on
- remote_port - linked port on the router
For example, ssh opens port 9000 on the router to forward it to localhosts port 3000:
ssh admin@192.168.88.1 -R 9000:localhost:3000
Dynamic Forwarding
Dynamic forwarding turns SSH client into SOCKS proxy. On RouterOS dynamic forwarding can be controlled with the same settings as local forwarding. Use of dynamic forwarding:
ssh -N -D <local_port> -l <user> <remote_address>
Where:
- local_port - local port that your host will listen on
- user - username on the router
- remote_address - routers address
For example:
ssh admin@192.168.88.1 -N -v -D 9999
Now you can use local port 9999 to fetch files:
curl -x socks5h://localhost:9999 https://download.mikrotik.com/routeros/winbox/3.18/winbox.exe