SSH Access and Hardening for OpenWrt

Connect over SSH for the first time

OpenWrt uses Dropbear, a lightweight SSH server. On a fresh install it listens on port 22 and accepts password logins for the root user.

From a terminal on your computer, connect to the router's LAN IP. The first connection asks you to verify the host key fingerprint — check it against the one shown in LuCI under System → Administration.

ssh root@192.168.1.1

Replace 192.168.1.1 with your router's LAN address.

Generate an SSH key pair

Key-based authentication is more secure than passwords because the private key never leaves your computer. Generate a key pair on your machine if you do not already have one.

Use an ed25519 key, which is shorter and faster than RSA while remaining secure. Protect the private key with a passphrase.

ssh-keygen -t ed25519 -f ~/.ssh/openwrt_ed25519

Creates a public key at ~/.ssh/openwrt_ed25519.pub and a private key at ~/.ssh/openwrt_ed25519.

Install the public key on the router

Copy the contents of the public key file (~/.ssh/openwrt_ed25519.pub). In LuCI, go to System → Administration → SSH-Keys and paste it into the "new key" box, then click Add key.

Alternatively, append the key to /etc/dropbear/authorized_keys over SSH, then set the permissions Dropbear expects (`chmod 0700 /etc/dropbear; chmod 0600 /etc/dropbear/authorized_keys`). From that point on, logins with the matching private key work without a password.

cat ~/.ssh/openwrt_ed25519.pub | ssh root@192.168.1.1 'cat >> /etc/dropbear/authorized_keys'

Pipes your public key into the router's authorized keys file in one step.

Disable password login

Once key login works, disable password authentication to stop brute-force attempts. In LuCI, go to System → Administration and uncheck "Password authentication". Leave "Allow root login with password" unchecked as well.

Test that you can still connect with your key in a new terminal before closing the current session. If the key login fails, you will need the password to get back in.

uci set dropbear.@dropbear[0].PasswordAuth='0'
uci set dropbear.@dropbear[0].RootPasswordAuth='0'
uci commit dropbear
/etc/init.d/dropbear restart

Disables password and root-password authentication via UCI.

Change the SSH port and bind to LAN

Moving SSH off port 22 reduces noise from internet scanners, though it is not a security measure on its own. Set the port to something above 1024, and bind Dropbear to the LAN interface only so it is not reachable from the WAN at all.

The LAN interface is typically named `lan`. The `Interface` option makes Dropbear bind to the addresses of that interface, so it is not reachable from the WAN under the default firewall.

uci set dropbear.@dropbear[0].Port='2222'
uci set dropbear.@dropbear[0].Interface='lan'
uci commit dropbear
/etc/init.d/dropbear restart

Moves SSH to port 2222 and restricts it to the LAN interface. Connect with `ssh -p 2222 root@192.168.1.1`.

Configure your SSH client

To avoid remembering the port and key path, add an entry to ~/.ssh/config. This lets you type `ssh openwrt` instead of the full command.

Host openwrt
  HostName 192.168.1.1
  User root
  Port 2222
  IdentityFile ~/.ssh/openwrt_ed25519

Add this block to ~/.ssh/config, then connect with `ssh openwrt`.