Unable to login via IP address using winbox or ssh

Hi,

I am running RouterOS v6.49 18 on a cAP ac, and winbox 4.2 on Debian Linux.
Services enabled are SSH and WinBox, set to allow connections from 0.0.0.0/0.
I have confirmed that the password is valid via MAC connection on WinBox.
The cAP is on the 10.69.3.0 subnet. I am on the 10.69.2.0 subnet.
The firewall is passing all internal traffic between these subnets. I have tested and confirmed this.

I have configured the cAP as only an access point. Eth and wlan interfaces are on bridge. I have disabled the cAP internal firewall rule regarding WAN access that was autocreated, as the cAP is attached directly on ETH1 to a separate firewall device. I have added cAP internal firewall rules to disable administrative access to the cAP over wifi.

I am able to access the cAP directly over ETH2 on a direct connection using WinBox and a MAC address.
I can ping the cAP from the 10.69.2.0 subnet.
I can connect via ssh to the cAP from the firewall directly on the 10.69.3.0 subnet, I get a login, and then permission denied when I submit the password.
I get permission denied when attempting password login on from my workstation on the 10.69.2.0 network over ssh.
I've monitored ssh connections on the cAP to confirm the firewall is not blocking these attempts.
Login over IP using WinBox from the 10.69.3.0 network results in "username or password wrong".

It appears nothing in the firewall rules is blocking my login.
I have checked the services SSH and WINBOX, and set them to allow connections from 0.0.0.0/0, then disabled and enabled the services. This didn't change anything.

I would like to know what settings I could change, or other possible features that could be blocking remote password authentication.

Did you give the cAP an SSH key, attached to the RouterOS user?

Is the output of ssh -v rosuser@10… enlightening?

ssh -vvvv showed key exchange happening. The failure is when I enter the known valid password. I have not added my personal ssh pubkey to the admin account. Allow ssh login with password is checked on the cAP.

Try adding -o PubkeyAuthentication=noto the command.

Already tried that, which was why I was posting here. Sorry.