Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,48 @@
+# SSH Key Deployment on RouterOS 7 — Reference
+
+## Methods (use in order of reliability)
+
+### Method 1: /user/ssh-keys/add (ROS7 native, preferred for inline)
+```
+/user/ssh-keys/add user=admin key="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..." comment="ITPP access key"
+```
+This accepts inline key text. More reliable over SSH pipes than `import`.
+
+### Method 2: File-based via WinBox (most reliable)
+```
+/file/add name=itpp-key.pub contents="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..."
+/user/ssh-keys/import public-key-file=itpp-key.pub user=admin
+/file/remove [find name="itpp-key.pub"]
+```
+
+**CRITICAL: The correct ROS7 parameter is `public-key-file=` NOT `file=`.** Using `file=` alone causes "expected end of command" errors.
+
+## CRITICAL: Key content verification
+
+This is the #1 failure mode. After importing a key but before declaring success:
+
+1. Check which key files exist on the server: `ls /root/.ssh/*.pub`
+2. Check the content of the key you INTEND to use: `cat ~/.ssh/<key>.pub`
+3. Compare that base64 string to what was sent to the router
+4. Test immediately: `ssh -i ~/.ssh/<key> admin@<tunnel-ip> "/system/identity/print"`
+
+**The router accepts ANY key during import — it does NOT validate. A key mismatch is the most common reason "import said OK, but SSH still asks for password."**
+
+## Lockout prevention
+
+**Do NOT change the admin password to a temporary password for SSH key setup.** The correct sequence:
+
+1. Verify key content (cat the .pub file)
+2. Import the key (add or import command)
+3. Test the key immediately (ssh -i command) — confirm keyless login works
+4. Only then let the user change the password back
+
+**Why:** Once an SSH key is imported, RouterOS disables password auth for that user. If the key doesn't match, and the password was changed to something unknown, the router is locked out from SSH until someone has WinBox access.
+
+## ssh-copy-id does NOT work with RouterOS
+
+RouterOS does not understand POSIX shell commands. Never use `ssh-copy-id` against a MikroTik. Always use native `/user/ssh-keys/add` or `/user/ssh-keys/import`.
+
+## Strategy for SSH-only key setup (no WinBox available)
+
+Use `/user/ssh-keys/add` which accepts inline key text. This is more likely to work over an SSH pipe than `import` (which expects a file reference). If you have PTY access (`ssh -tt`), `import` works fine — but for scripting/pipe mode, `add` is more reliable.