I am setting up a script on a Mikrotik Switch that will reboot an Ubiquiti AP. However in order to do that I need to create an rsa-key that will allow them to authenticate before running the reboot command. How would I create an rsa key that is compatible with both devices so I can run the command.. Currently when I create a key on the Mikrotik Switch I try to add it to the Unifi Controller>Settings>Advanced, I get an error “Please enter a valid SSH key” and when I create a putty key, it works with the unifi controller software, however I get an error "unable to load key file(wrong format or bad phrase) on the Mikrotik Switch. Any help would be greatly appreciated… Thanks!
SOLUTION:
Incase someone runs into the same issue and needs to reboot a group of Ubiquiti AP’s from a Mikrotik Script, this is how it ended up working, Praise the Lord. ![]()
We started by going to the Windows command prompt and running the following command
C:\Users\User> ssh-keygen -t rsa -b 2048 -m PEM
Enter file in which to save the key (C:\Users\User/.ssh/id_rsa):test
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in test
Your public key has been saved in test.pub
The key fingerprint is:
SHA256:Ny3l3slom6tJkcvlmBmSQiiRPjQD70U17CTr46gVHIU domain\User@computername
The key’s randomart image is:
±–[RSA 2048]----+
|…oooo |
| .E+..o. |
| o+oo=. . |
| oo+… . = |
| +o . S B + |
| .o . + & + . |
| .o . B = + |
| .. . . o o |
|.. o.+. |
±—[SHA256]-----+
You will be able to find the file test and test.pub in your "C:\Users\user" folder not the .ssh folder(as indicated above).. at least that is where I found the file. ![]()
Once you locate the files upload the Private key(test) to your Mikrotik Device and Copy the text out of your Public Key(test.pub) and paste it in Unifi Controller Settings>System>Advanced Under the Device Authentication >SSH Keys(Give it a name and paste in the key in the field below the name)
Then on the Mikrotik you need to go to the main menu System>Users>SSH Private Keys (Tab)> Click “Import SSH Private Key” Button… Choose the User you want to assign the Key to and select your Private key file(test) that you uploaded earlier…(Passphrase and Key Owner can be left empty) Now click the “Import SSH Private Key” Button
To test to make sure that your new RSA key is working you can open a terminal and enter the following command:
(The command below should Manually reboot your AP at this IP, just change the IP to an AP on your network:)
/system ssh 192.168.1.77 user=User command=reboot
(The User above is whatever your User Name is under “Device SSH Authentication” that we referenced above in your Unifi Controller)
Now you are ready to create the Script on your Mikrotik to reboot your ubiquiti equipment by going to the Main Menu>System>Scripts, once in the Scripts List click the + Give it a Name “Reboot All APs” and paste the following script into the source:
:local ip 192.168.1.77;
do {
:global lastping [/ping address=$ip count=1 as-value]
:local status ($lastping->“status”)
:if (status != “timeout”) do={
/system ssh-exec $ip user=User command=reboot
:delay 30s;
}
:set ip ($ip + 1);
} while=($ip != 192.168.1.180)
This Script pings before trying to connect to see if the AP is available so that the script won’t crash if a device fails or goes offline for some reason and won’t respond or if you hit an ip in the range that is not currently assigned to anything.
All that needs to be done to use this script is to change the User to your User in your unifi controller under “Device SSH Authentication” as detailed above(Default is Admin) and change the starting ip to the lowest IP, the IP of your first AP and end it with an IP that is after the Final AP on the range… because the final IP is just a termination IP and the command doesn’t get sent to it. Hopefully all of your AP’s are in the same range because that is needed for this script to work properly… I have not tried it on a network where aps and other devices are mixed in… this setup will be a huge blessing for us… hopefully this helps someone. ![]()