Paswordless public key-based SSH login on router with Asus Merlin firmware

Question

I'm trying to enable passwordless SSH login on my ASUS RT-AC68U home router which runs version 384.4_2 of Asuswrt-Merlin firmware (the most recent one at the time of posting this). Having read many posts and howtos (including this one), I still can't get it working.

I use PUTTYGEN to generate a pair of RSA-2048 keys, save the public key at ~/.ssh/authorized_keys on the router, then try to connect with PUTTY, which I've limited to RSA only. As PUTTY negotiates the session encryption, it prompts to accept the public key provided by the server. I expect it to be my key from ~/.ssh/authorized_keys but instead I'm always seeing the dropbear's own public key (from /etc/dropbear/dropbear_rsa_host_key). I know it's that one by running dropbearkey -y -f /etc/dropbear/dropbear_rsa_host_key.

The permission for ~/.ssh folder is set to 700, for ~/.ssh/authorized_keys to 600. The key is saved via the router's Web UI in the correct format (i.e., ssh-rsa AAAA...5iYw== rsa-key-20180401, no line breaks). I tried both root and admin as the SSH user. I also tried everything from scratch, after resetting the router to the factory settings, with the same result.

Is there anything I'm missing? At this point, I think my only option would be to extract the dropbear's private key from /etc/dropbear/dropbear_rsa_host_key and use it instead of generating my own.

Answer 1

Put your public key in /etc/dropbear/authorized_keys

edit:

I originally thought dropbear was not reading ~/.ssh even though it should, so i pointed the default directory /etc/dropbear/. authorized_keys is not there by default so it isn't so obvious.

rereading the question i realized you were confusing host keypairs with login keypairs.

you need to accept the routers host keypair (/etc/dropbear/dropbear_rsa_host_key) and place your public key on the router in either location' authorized_keys file and you should be good to go.