DropBear SSH public key authentication

If you do not have a public key yet, create one.

$ ssh-keygen -t dsa    

Create key

Followed by a fingerprint and random art image of the key.

Copy the public key with scp to OpenWrt:

$ scp ~/.ssh/id_dsa.pub root@    


ssh to the router (requires a password, as the key has not been added to authorized_keys yet).

$ ssh root@    


Add the key to authorized_keys. If not exists, it will be created. Adjust its permissions.

# cd /etc/dropbear
# cat /tmp/id_*.pub >> authorized_keys
# chmod 0600 authorized_keys    

Add to authorised keys

Now ssh works from a local machine to the router, and no password is sent in the clear or encrypted, instead you’ll be asked for the passphrase you entered when you created the key in the first step. You can repeat this from each machine that you wish to be able to access the router, and add the keys as above.

Running SSH on another port

SSH access

That of course changes how you ssh to the router:

$ ssh root@ -p 22222    

Whitelisting IP’s

Allow SSH only from trusted (whitelisted) IP’s, and drop any other request to port 22. If doing that from a Local Area Network (LAN) you will need to set a static DHCP address first. dnsmasq is default running on OpenWrt; it allocates IP addresses in the range of to .250 on the internal interface to connected hosts. Pick an IP address outside these, like

Create a /etc/lists/whitelist.conf with in it:                        ## A trusted IP                        ## Another trusted IP    

And open up /etc/firewall.user and add:

WHITELIST=$(sed 's/#.*//' /etc/lists/whitelist.conf)

for IP in ${WHITELIST}; do
    iptables -t nat -A prerouting_rule -i $WAN -s $IP -p tcp --dport 22 -j ACCEPT
    iptables        -A input_rule      -i $WAN -s $IP -p tcp --dport 22 -j ACCEPT