Manual:IP/SSH

Applies to RouterOS: v5

Summary

This menu controls if ssh server behaviour regarding port forward and authentication methods.

Settings

Property	Description
allow-none-crypto (yes|no; Default: yes)	Whether to allow connection if cryptographic algorithms are set to none.
always-allow-password-login (yes | no; Default: no)	Whether to allow password login at the same time when public key authorization is configured.
forwarding-enabled (both | local | no | remote; Default: remote)	Allows to control which SSH forwarding method to allow: no - SSH forwarding is disabled; local - Allow SSH clients to originate connections from the server; remote - Allow SSH clients to listen on the server and forward incoming connections; both - Allow both local and remote forwarding methods.
host-key-size (yes | no; Default: no)	What RSA key size to use when host key is being regenerate regenerated.
strong-crypto (yes | no; Default: no)	Use stronger encryption, HMAC algorithms, use bigger DH primes and disallow weaker ones: prefer 256 and 192 bit encryption instead of 128 bits; disable null encryption; prefer sha256 for hashing instead of sha1; disable md5; use 2048bit prime for Diffie Hellman exchange instead of 1024bit.

Commands

Property	Description
export-host-key (key-file-prefix)	Export public and private RSA/DSA keys to files. Command takes one parameter: key-file-prefix - used prefix for generated files, for example, prefix 'my' will generate files 'my_rsa', 'my_rsa.pub' etc.
import-host-key (private-key-file)	Import and replace private DSA/RSA key from specified file. Command takes one parameter: private-key-file - name of the private RSA/DSA key file
regenerate-host-key ()	Generated new and replace current set of private keys (DSA, RSA) on the router. Be aware that previously imported keys might stop working.

Note: When connecting from RouterOS built in client to router with strong crypto disabled, temporary strong crypto must be disabled on connecting router too. Reason is that strong crypto forces algorithms which are not supported when this feature is disabled.

Example

To use forwarding-enabled feature from Linux host using OpenSSH client this command can be used:

 ssh reamoteuser@remotehost -L port:remotehost:remoteport

where:

• remoteuser - user of router
• remotehost - router address (if host name is used in -L settings, router should be able to resolve this name)
• port - local port that your host will listen on
• remoteport - port on the router

If user requires telnet to router, but you do not want to allow it to be plain text, Following can be done:

ssh admin@192.168.88.1 -L 3000:192.168.88.1:23

now when user uses telnet localhost 3000" it will log in the router using telnet over encrypted tcp connection.

Note: we fully support SFTP v3 as described in draft-ietf-secsh-filexfer-02.txt other versions can cause problems