Problem with multiple SSH keys

[pdc]

Hello,

I am having problems accessing SSH to an AiMesh node when I have multiple SSH Authorized Keys configured. I have configured the keys using Administration > System > Authorized Keys, one key per line.

I found that the main node (GT-AX6000 running Merlin 3004.388.7) and AiMesh node (RT-AC86U Asus F/W 3.0.0.4.386_51925) have the same nvram value, e.g.

# nvram get sshd_authkeys
ssh-rsa KEY1 comment1>ssh-rsa KEY2 comment2>ssh-rsa KEY3 comment3

On the Merlin node, this results in an authorized keys file like you'd expect:

# cat ~/.ssh/authorized_keys
ssh-rsa KEY1 comment1
ssh-rsa KEY2 comment2
ssh-rsa KEY3 comment3

However, on the AiMesh node, the nvram is not converted:

# cat ~/.ssh/authorized_keys
ssh-rsa KEY1 comment1>ssh-rsa KEY2 comment2>ssh-rsa KEY3 comment3

SSH doesn't recognize > as a key separator, so every node reboot I need to log on to fix the authorized keys file.

Is there something I'm not doing right?

 

[dave14305]

Did it ever work? What if you install Merlin on the node? Does it work then?

 

[RMerlin]

Technical limitation. To support more than one key, Asuswrt-Merlin has to encode the keys differently, and that method is not compatible with stock firmware (so, it won't work with AiMesh nodes).

 

[pdc]

@RMerlin thanks for the clarification! That's all the excuse I needed to install Merlin on the mesh node

 

[RMerlin]

@RMerlin thanks for the clarification! That's all the excuse I needed to install Merlin on the mesh node

I never tested if propagation of that setting works properly even if the node runs Asuswrt-Merlin, you will have to test it. The propagation code is closed source, so I have no idea what kind of processing it might do before transmissing settings to the nodes.

 

[RMerlin]

Someday I should see if the initial encoding issue that prevented having multiple keys has been fixed. Nvram handling code has changed a fair bit in modern HND devices versus older ARM devices. That's however quite a bit low on my lengthy ToDo list...

 

[L&LD]

Another example of where RMerlin firmware on the main and nodes is the more robust, reliable, and suggested setup from me.

 

[alan6854321]

It works for me, I have several SSH keys and they all work on the router and the node.
I have Merlin FW on both router and node.

BUT - I had to define them on the router, then add the node to AiMesh.
If I add new ones to the router, they don't propagate to the node without removing/adding it to AiMesh again.