I'm trying to enable passwordless SSH login on my ASUS RT-AC68U home router which runs version 384.4_2 of Asuswrt-Merlin firmware (the most recent one at the time of posting this). Having read many posts and howtos (including this one), I still can't get it working.

I use PUTTYGEN to generate a pair of RSA-2048 keys, save the public key at ~/.ssh/authorized_keys on the router, then try to connect with PUTTY, which I've limited to RSA only. As PUTTY negotiates the session encryption, it prompts to accept the public key provided by the server. I expect it to be my key from ~/.ssh/authorized_keys but instead I'm always seeing the dropbear's own public key (from /etc/dropbear/dropbear_rsa_host_key). I know it's that one by running dropbearkey -y -f /etc/dropbear/dropbear_rsa_host_key.

The permission for ~/.ssh folder is set to 700, for ~/.ssh/authorized_keys to 600. The key is saved via the router's Web UI in the correct format (i.e., ssh-rsa AAAA...5iYw== rsa-key-20180401, no line breaks). I tried both root and admin as the SSH user. I also tried everything from scratch, after resetting the router to the factory settings, with the same result.

Is there anything I'm missing? At this point, I think my only option would be to extract the dropbear's private key from /etc/dropbear/dropbear_rsa_host_key and use it instead of generating my own.

  • 1
    Extracting drop ears private key won't help. Have you considered flashing kong dd-wrt. Adding your public keys via the web interface is trivial with that.
    – davidgo
    Commented Apr 1, 2018 at 0:05
  • @davidgo, I haven't tried dd-wrt, but i did try extracting dropbear's private key and use it with putty and it actually works. Just not happy that the private key lives in the router itself.
    – noseratio
    Commented Apr 1, 2018 at 2:12

2 Answers 2


Put your public key in /etc/dropbear/authorized_keys


I originally thought dropbear was not reading ~/.ssh even though it should, so i pointed the default directory /etc/dropbear/. authorized_keys is not there by default so it isn't so obvious.

rereading the question i realized you were confusing host keypairs with login keypairs.

you need to accept the routers host keypair (/etc/dropbear/dropbear_rsa_host_key) and place your public key on the router in either location' authorized_keys file and you should be good to go.

  • 1
    re reading your question it looks like you are not accepting the dropbear servers host key. Is that correct? your login keypair is different from the host keypair. Unless I'm still misunderstanding, you should accept the host public key, and login without a password via your public key on the host as an authorized_key. Commented Apr 1, 2018 at 22:02
  • that was it, thank you! Previously the host public key was cached by putty, I guess I once accepted and saved it. Then I forgot it's a legit part of the authentication sequence and rather was expecting my key in the first place there. Now feel pretty stupid :) If you edit your answer and include your comment, I'd be happy to accept it.
    – noseratio
    Commented Apr 2, 2018 at 0:45
  • 1
    awesome. glad i could help. don't feel dumb, i do stuff like this to myself everyday, its always obvious when someone else is doing it :D Commented Apr 2, 2018 at 1:10

There is one very important tid bit of information missing in T.B post above. To get ssh working on ausus merlin 386.3_2 and most likely other releases "One Has To Enable the Jiffs Partition in the router. I only enabled Jiffs but did not format it because there are config files etc there already and they might become another headache if deleted.

Enable the Jiffs Partition from with in asus merlin wui, should be above the ssh field under administration.

Feel Free to post this little tid bit of information.. it is kind of like missing syntax in some complicated how to...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .