I Tried Setting Up SSH Public Key Authentication on a Yamaha RTX1300 and Disabling Password Authentication

Introduction

At home, I use a Yamaha RTX1300 as my fiber optic router.

https://dev.classmethod.jp/articles/flets-cross-10g-yamaha-rtx1300/

To visualize the router's operating status in more detail, I am considering a mechanism to periodically collect logs and operating information. The RTX1300 supports SSH connections, but by default it uses password authentication. I tried switching to public key authentication and disabling SSH password authentication.

The procedure for configuring public key authentication on an RTX differs from that on a typical Linux server. I verified RTX-specific operations on the actual device, such as importing keys with the import sshd authorized-keys command and the need to run it in administrator mode.

Test Environment

Goals of the Test

• Be able to connect via SSH using public key authentication
• Be able to disable SSH password authentication with sshd auth method publickey
• Keep the web GUI management path available even after disabling password authentication

Enabling the SSH Server

I enabled the SSH server on the RTX1300 and generated the host key from the web GUI. In the test environment of this article, LAN1 is used as the internal network side, so I restricted the SSH listener to LAN1 with sshd host lan1. By configuring the WAN-side interface not to accept SSH connections, the route from the outside is eliminated entirely, reducing the attack surface.

As additional security hardening, you can also restrict access by source IP address. See the command reference for details.

Creating SSH Users

I created two SSH users from the web GUI. I separated an administrator user and a general user according to their purposes.

I am leaving the existing web GUI administrator user (no public key registered, all connection methods allowed) as is. This is to confirm that I can still log in to the web GUI with a password after the sshd auth method publickey setting described later.

The following is the SSH user addition screen in the web GUI. I granted administrator user privileges and selected SSH only as the connection method.

"Restriction of terminals allowed to connect" (restricting source by IP address) is an optional additional setting and is outside the scope of this article.

Generating a Key Pair on the Client

Generate an ed25519 key pair on the client. Use separate keys for the administrator and for monitoring.

# For administrator
ssh-keygen -t ed25519 -f ~/.ssh/rtx1300-admin -C "admin@rtx1300" -N ""

# For general user (monitoring)
ssh-keygen -t ed25519 -f ~/.ssh/rtx1300-monitor -C "monitor@rtx1300" -N ""

The meaning of each option is as follows.

In this article, I created keys without a passphrase (-N "") to simplify the test. Keys without a passphrase are sometimes chosen for automation (monitoring) purposes, but I recommend setting a passphrase for the administrator key. If you use a key without a passphrase, strictly manage the file permissions (600), storage location, and the devices it is used on.

Execution result:

$ ssh-keygen -t ed25519 -f ~/.ssh/rtx1300-admin -C "admin@rtx1300" -N ""
Generating public/private ed25519 key pair.
Your identification has been saved in /home/user/.ssh/rtx1300-admin
Your public key has been saved in /home/user/.ssh/rtx1300-admin.pub

I recommend backing up the created private key to a secure storage location such as 1Password.

Importing the Public Key into the RTX1300

Connect via SSH as the SSH administrator user using password authentication, elevate to administrator mode, and then import the public key.

$ ssh <SSH管理ユーザー>@<RTXのIPアドレス>
Password: ********

RTX1300 Rev.23.00.17 (Fri Mar 14 10:49:46 2025)
Copyright (c) 1994-2025 Yamaha Corporation. All Rights Reserved.

> administrator
Password: ********
#

In administrator mode (# prompt), run the import sshd authorized-keys command to register the public key.

# import sshd authorized-keys <SSH管理ユーザー>
Import destination:
/ssh/authorized_keys/<SSH管理ユーザー>
Input a public key: ssh-ed25519 AAAA...（公開鍵の内容）... admin@rtx1300
Import a public key? (Y/N)Y
Import is succeeded.

Similarly, import the public key for the general user.

# import sshd authorized-keys <SSH一般ユーザー>
Import destination:
/ssh/authorized_keys/<SSH一般ユーザー>
Input a public key: ssh-ed25519 AAAA...（公開鍵の内容）... monitor@rtx1300
Import a public key? (Y/N)Y
Import is succeeded.

Save the configuration.

# save
Saving ... CONFIG0 ... Done .

At the Input a public key: prompt, paste the contents of the .pub file generated on the client as is. Register different public keys for the administrator and the general user.

Verifying Connection with Public Key Authentication

With the public keys imported, verify the SSH connection using public key authentication.

$ ssh -i ~/.ssh/rtx1300-admin -o IdentitiesOnly=yes <SSH管理ユーザー>@<RTXのIPアドレス>

RTX1300 Rev.23.00.17 (Fri Mar 14 10:49:46 2025)
Copyright (c) 1994-2025 Yamaha Corporation. All Rights Reserved.

>

I was able to log in without being asked for a password. Adding -o IdentitiesOnly=yes makes ssh use only the key file specified by -i and prevents other keys held by ssh-agent from being offered. The general user was also able to connect with public key authentication in the same way.

$ ssh -i ~/.ssh/rtx1300-monitor -o IdentitiesOnly=yes <SSH一般ユーザー>@<RTXのIPアドレス>

I also confirmed that after logging in as the administrator user, I could elevate to administrator mode with the administrator command.

> administrator
Password: ********
#

Password Authentication Is Still Enabled at This Point

Simply importing the public keys does not disable SSH password authentication. At this point, password authentication is still enabled. To verify this, I disable public key authentication on the client side (PubkeyAuthentication=no) and try connecting using only the password authentication path.

$ ssh \
    -o PubkeyAuthentication=no \
    -o PreferredAuthentications=password \
    -o PasswordAuthentication=yes \
    <SSH管理ユーザー>@<RTXのIPアドレス>
Password: ********
>

I was able to log in with password authentication as well. To disable password authentication for SSH login, you need to explicitly configure sshd auth method publickey in the next step. Note that this is a separate setting from the password prompt of the administrator command used when elevating to administrator mode.

Disabling SSH Password Authentication

Connect with public key authentication, elevate to administrator mode, and then configure sshd auth method publickey.

# sshd auth method publickey
#

Verifying That a New Connection with Public Key Authentication Succeeds

From another terminal, verify that a new SSH connection with public key authentication succeeds.

$ ssh -i ~/.ssh/rtx1300-admin -o IdentitiesOnly=yes <SSH管理ユーザー>@<RTXのIPアドレス>
>

I connected without any problem.

Verifying That SSH Password Authentication Is Rejected

From another terminal, try SSH password authentication.

$ ssh \
    -o PubkeyAuthentication=no \
    -o PreferredAuthentications=password \
    -o PasswordAuthentication=yes \
    <SSH管理ユーザー>@<RTXのIPアドレス>
<SSH管理ユーザー>@<RTXのIPアドレス>: Permission denied (publickey).

Password authentication was rejected. sshd auth method publickey is working correctly.

Verifying That the Web GUI Management Path Is Maintained

sshd auth method publickey controls only the SSH authentication method. It does not affect password authentication for the web GUI.

I accessed the web GUI as the web GUI administrator user with no public key registered and confirmed that I could log in with a password. In this test environment, password login to the web GUI was unaffected even after configuring sshd auth method publickey, and the management path via the web GUI was maintained.

Saving the Configuration

All checks are complete, so save the configuration.

# save
Saving ... CONFIG0 ... Done .
# show config | grep sshd
sshd service on
sshd host lan1
sshd host key generate *
sshd auth method publickey

sshd host key generate * indicates that the host key has already been generated.

If you keep the web GUI management path available, as in this test environment, you can recover from the web GUI even if SSH connections stop working. If a serial console is available, that can also serve as a recovery method.

Notes

About RTX-Specific Operations

• A user created as an "administrator user" in the web GUI is displayed in show config as a user with an administrator attribute. In this test environment, it was displayed as administrator=2. This user can elevate to administrator mode with the administrator command even after logging in with public key authentication. On the other hand, the general user created in this test could not elevate to administrator mode.

About Periodic Monitoring

In this test environment, direct command execution (exec request) such as ssh user@rtx show log did not return the expected result, and an interactive session was required. For periodic monitoring, you will need to consider using something that can handle interactive SSH sessions, such as expect.

I confirmed that even the general user can run reference commands such as show log, but the range of commands that can be executed is limited. Please check separately whether the commands required for your actual monitoring items can be executed.

Summary

I configured SSH public key authentication on the RTX1300 and disabled SSH password authentication with sshd auth method publickey. On the RTX, the import sshd authorized-keys command is used to register public keys. The procedure differs from placing a ~/.ssh/authorized_keys file on a typical Linux server. Also, simply importing a public key does not disable password authentication, and you need to explicitly configure sshd auth method publickey. I also confirmed that this setting controls only the SSH authentication method, and in this test environment I was able to operate without affecting the web GUI management path.

References

• YAMAHA RTX1300 Command Reference - sshd auth method
• YAMAHA RTX1300 Command Reference - import sshd authorized-keys