I’m following this guide and I’ve followed all the steps even up to making SSH keys on the router using CLI & dropbear. Yet when I go to terminal and do root@ it still asks me for a password. What am I doing wrong?
Are you using OpenWrt ubus call system board
Please add 3x -v parameter to ssh command to see why key was rejected.
Yes i am using Openwrt version 24.10.0 When i used the triple -v it showed alot from me looking at the output was i not supposed to name the ssh keys? Just leave it as it said in the guide id_.pub? i assumed i could name them kind of like PGP keys.
3x -v output
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files
debug1: /etc/ssh/ssh_config line 21: Applying options for *
debug2: resolve_canonicalize: hostname 192.168.1.1 is address
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/anon/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/anon/.ssh/known_hosts2'
debug3: ssh_connect_direct: entering
debug1: Connecting to 192.168.1.1 [192.168.1.1] port 22.
debug3: set_sock_tos: set socket 3 IP_TOS 0x10
debug1: Connection established.
debug1: identity file /home/anon/.ssh/id_rsa type -1
debug1: identity file /home/anon/.ssh/id_rsa-cert type -1
debug1: identity file /home/anon/.ssh/id_ecdsa type -1
debug1: identity file /home/anon/.ssh/id_ecdsa-cert type -1
debug1: identity file /home/anon/.ssh/id_ecdsa_sk type -1
debug1: identity file /home/anon/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /home/anon/.ssh/id_ed25519 type -1
debug1: identity file /home/anon/.ssh/id_ed25519-cert type -1
debug1: identity file /home/anon/.ssh/id_ed25519_sk type -1
debug1: identity file /home/anon/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /home/anon/.ssh/id_xmss type -1
debug1: identity file /home/anon/.ssh/id_xmss-cert type -1
debug1: identity file /home/anon/.ssh/id_dsa type -1
debug1: identity file /home/anon/.ssh/id_dsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.9p1 Trisquel_GNU/Linux_11.0-8
debug1: Remote protocol version 2.0, remote software version dropbear
debug1: compat_banner: no match: dropbear
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.1.1:22 as 'root'
debug3: record_hostkey: found key type ED25519 in file /home/anon/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from 192.168.1.1
debug1: load_hostkeys: fopen /home/anon/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: have matching best-preference key type ssh-ed25519-cert-v01@openssh.com, using HostkeyAlgorithms verbatim
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,sntrup761x25519-sha512@openssh.com,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha256,kexguess2@matt.ucc.asn.au,kex-strict-s-v00@openssh.com
debug2: host key algorithms: ssh-ed25519,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes256-ctr
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes256-ctr
debug2: MACs ctos: hmac-sha2-256
debug2: MACs stoc: hmac-sha2-256
debug2: compression ctos: none
debug2: compression stoc: none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug3: kex_choose_conf: will use strict KEX ordering
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:KVK42Pp65KaEbL52jGF4OUUsUpSerc3a4TpS+AAef3E
debug3: record_hostkey: found key type ED25519 in file /home/anon/.ssh/known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from 192.168.1.1
debug1: load_hostkeys: fopen /home/anon/.ssh/known_hosts2: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: Host '192.168.1.1' is known and matches the ED25519 host key.
debug1: Found key in /home/anon/.ssh/known_hosts:1
debug3: send packet: type 21
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: ssh_fetch_identitylist: agent contains no identities
debug1: Will attempt key: /home/anon/.ssh/id_rsa
debug1: Will attempt key: /home/anon/.ssh/id_ecdsa
debug1: Will attempt key: /home/anon/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/anon/.ssh/id_ed25519
debug1: Will attempt key: /home/anon/.ssh/id_ed25519_sk
debug1: Will attempt key: /home/anon/.ssh/id_xmss
debug1: Will attempt key: /home/anon/.ssh/id_dsa
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,ssh-rsa>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,password
debug3: start over, passed a different list publickey,password
debug3: preferred gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: /home/anon/.ssh/id_rsa
debug3: no such identity: /home/anon/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /home/anon/.ssh/id_ecdsa
debug3: no such identity: /home/anon/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/anon/.ssh/id_ecdsa_sk
debug3: no such identity: /home/anon/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /home/anon/.ssh/id_ed25519
debug3: no such identity: /home/anon/.ssh/id_ed25519: No such file or directory
debug1: Trying private key: /home/anon/.ssh/id_ed25519_sk
debug3: no such identity: /home/anon/.ssh/id_ed25519_sk: No such file or directory
debug1: Trying private key: /home/anon/.ssh/id_xmss
debug3: no such identity: /home/anon/.ssh/id_xmss: No such file or directory
debug1: Trying private key: /home/anon/.ssh/id_dsa
debug3: no such identity: /home/anon/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
Please post the output of these commands —
https://openwrt.org/docs/guide-user/security/dropbear.public-key.auth#troubleshooting
None of your keys are present or used.
How did you named your local ssh key? How does your ssh client config look like? How do you specify the key you want to use?
1 Like
Log in as user anon on the machine you want to use as a terminal and generate the missing SSH keys.
ssh-keygen
Copy the content of id_rsa.pub to /etc/dropbear/authorized_keys on the OpenWrt device.
cat ~/.ssh/id_rsa.pub | ssh root@192.168.1.1 'cat >> /etc/dropbear/authorized_keys'
That should be enough.
3 Likes
Ok so user error (per usual) i did not have the SSH keys in the proper folder on my PC. I had them registered on the router properly. Once i placed them in /.ssh and did ssh root @openwrt.lan it worked.
One more question is it necessary to make keys on the router itself using dropbear if you already generated them on your PC? On the guide it make it seem like you have to do both?
This log line suggests there's already an existing key on the router.
Therefore, you don't need to create a new one.
1 Like
The host key for the router is generated on the router by dropbear.
And no,like your local user, the default root user on OpenWrt does not has a private ssh user key by default. If you need one feel free to generate and transfer the key material however it pleases you...
1 Like
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.