RouterOS SSH Line-Length Limit & Workarounds

Verified on: RouterOS 7.18.2 (CCR2004-16G-2S+)

The Problem

RouterOS commands sent via ssh <user>@<host> '<command>' are truncated at ~170 characters. Anything longer produces expected end of command (line 1 column NNN).

This bites when deploying SSH keys, writing scripts, or using :convert from=base64 with long payloads.

Workarounds

A. `/file/add name= contents=` (best for Ed25519 keys, <170 chars)

ssh shonuff@192.168.88.1 '/file/add name="wisp-key.txt" contents="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... wisp-backup"'

B. `/user ssh-keys/add user= key=` (no intermediate file)

ssh shonuff@192.168.88.1 '/user ssh-keys/add user=shonuff key="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... wisp-backup"'

C. Global var + script split (>170 chars)

Create a global variable in one SSH call, then reference it in a script in another:

# Call 1: set global
ssh ... ':global mykey "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA..."'

# Call 2: create script referencing the global
ssh ... '/system script add name=dk source=":local k \$mykey; :put \$k file=wisp-key.txt"'

# Call 3: run script
ssh ... '/system script run dk'

D. Hex-encoded script (for RSA keys, >300 chars)

Convert each byte to \XX RouterOS hex escape, write as a script, run it:

key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..."
escaped = ''.join(f'\\{b:02X}' for b in key.encode())
script = f'/system script add name=dk source=":local k \\\"{escaped}\\\"; :put \\$k file=wisp-key.txt"'

Then on RouterOS:

/system script run dk
/user ssh-keys import public-key-file=wisp-key.txt user=backup

What Does NOT Work

Method	Error	Why
`:put "data" file=file.txt`	`expected end of command (line 1 column N)`	`file=` param not supported on v7
SCP/SFTP	`exec request failed on channel 0`	No SCP subsystem on RouterOS
`:put [/file/get x contents]`	`no such item` if file missing	Fine if file exists
`:put ... file=` in RouterOS script	`syntax error`	Doesn't work in scripts either
`/tool/fetch`	`cannot open file: permission denied`	Requires `ftp` policy (not in read/write groups)

2.2 KiB Raw Permalink Blame History