System configuration and SSH admin API endpoints

These endpoints cover two functional areas: general system configuration (/sistema) and SSH administration (/administracion). Both groups communicate with the router over SSH via SystemRouterService and require an active session (see Authentication). All responses are JSON.

System configuration

GET /sistema/data

Returns the router’s current system settings read from UCI and the system clock.

Response

hostname

string

Router hostname (system.@system[0].hostname).

time

string

Current date and time on the router as returned by date.

description

string

Optional router description string.

notes

string

Free-text notes field stored in UCI.

zonename

string

Human-readable timezone name (e.g., "America/Mexico_City").

timezone

string

POSIX timezone string (e.g., "CST6CDT,M4.1.0,M10.5.0").

log_size

string

Maximum size of the in-memory log buffer in kilobytes.

log_ip

string

Remote syslog server IP address. Empty string if not configured.

log_port

string

Remote syslog server port. Empty string if not configured.

log_proto

string

Syslog transport protocol ("udp" or "tcp").

log_file

string

Path to the log file on the router. Empty string if not configured.

log_level

string

System log verbosity level as a human-readable name. One of: "Depurar", "Info", "Aviso", "Advertencia", "Error", "Critico", "Alerta", "Emergencia".

cron_level

string

Cron log verbosity. One of: "Depurar", "Normal", "Advertencia".

{
  "hostname": "OpenWrt",
  "time": "Mon May 19 10:23:45 UTC 2025",
  "description": "Lab router",
  "notes": "",
  "zonename": "UTC",
  "timezone": "UTC0",
  "log_size": "64",
  "log_ip": "",
  "log_port": "",
  "log_proto": "udp",
  "log_file": "",
  "log_level": "Depurar",
  "cron_level": "Normal"
}

POST /sistema/update

Updates one or more system settings on the router. Only fields present in the request body are updated; omitted fields are left unchanged.

Request

hostname

string

New router hostname.

description

string

New router description.

notes

string

New notes text.

zonename

string

Human-readable timezone name (e.g., "America/New_York").

timezone

string

POSIX timezone string (e.g., "EST5EDT,M3.2.0,M11.1.0").

log_size

string

Log buffer size in kilobytes.

log_ip

string

Remote syslog server IP address.

log_port

string

Remote syslog server port.

log_proto

string

Syslog protocol: "udp" or "tcp".

log_file

string

Path for the log file on the router.

log_level

string

Log verbosity level name (e.g., "Info", "Advertencia"). Mapped internally to the numeric UCI value.

cron_level

string

Cron log level name: "Depurar", "Normal", or "Advertencia".

Response

success

boolean

true on success, false on failure.

message

string

Confirmation message on success.

curl -X POST http://your-app.local/sistema/update \
  -H "Content-Type: application/json" \
  -d '{"hostname": "mi-router", "log_level": "Info"}'

{
  "success": true,
  "message": "Configuracion guardada correctamente."
}

After saving, the endpoint runs uci commit system, reloads the system service, and restarts the log daemon.

SSH administration

GET /administracion/data

Returns the current Dropbear SSH daemon configuration from UCI.

Response

port

string

SSH listening port. Defaults to "22".

passAuth

string

Whether password authentication is enabled: "on" or "off".

Whether root login is permitted: "on" or "off".

gateway

string

Whether gateway ports (remote port forwarding) are allowed: "on" or "off".

interface

string

UCI interface name Dropbear listens on. Empty string means all interfaces.

{
  "port": "22",
  "passAuth": "on",
  "rootLogin": "on",
  "gateway": "off",
  "interface": ""
}

POST /administracion/password

Changes the root password on the router using passwd.

Request

password

string

required

New password. Must be at least 4 characters. Cannot be empty.

Response

boolean

true on success.

message

string

Success confirmation. Includes a reminder to update ROUTER_PASSWORD in your .env file if the router’s actual password was changed.

curl -X POST http://your-app.local/administracion/password \
  -H "Content-Type: application/json" \
  -d '{"password": "newSecurePass123"}'

{
  "ok": true,
  "message": "Contrasena del enrutador actualizada correctamente. Actualiza tambien ROUTER_PASSWORD en tu .env si cambiaste la clave real."
}

After changing the root password, update the ROUTER_PASSWORD environment variable in your application’s .env file. If they fall out of sync the app will lose SSH connectivity to the router.

POST /administracion/ssh

Updates the Dropbear SSH daemon configuration and restarts the service to apply changes.

Request

port

integer

required

SSH port number. Must be between 1 and 65535.

passAuth

boolean

required

true to allow password authentication, false to disable it.

true to allow root login, false to deny it.

gateway

boolean

required

true to enable gateway ports (remote port forwarding), false to disable.

interface

string

UCI interface name to restrict SSH to. Omit or send empty string to listen on all interfaces.

Response

boolean

true on success.

message

string

Confirmation on success, error description on failure.

curl -X POST http://your-app.local/administracion/ssh \
  -H "Content-Type: application/json" \
  -d '{
    "port": 22,
    "passAuth": true,
    "rootLogin": false,
    "gateway": false,
    "interface": "lan"
  }'

{
  "ok": true,
  "message": "Configuracion SSH actualizada correctamente."
}

Setting passAuth to false without having a working SSH public key already uploaded will lock you out of SSH access. Upload a key with POST /administracion/key before disabling password auth.

POST /administracion/key

Uploads an SSH public key file and appends it to /etc/dropbear/authorized_keys on the router.

Request

Send as multipart/form-data.

ssh_key

file

required

SSH public key file. The key content must start with one of: ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, or ecdsa-sha2-nistp521. Keys that do not match this format are rejected with HTTP 422.

Response

boolean

true on success.

message

string

Confirmation on success, error description on failure.

curl -X POST http://your-app.local/administracion/key \
  -F "ssh_key=@/home/user/.ssh/id_ed25519.pub"

{
  "ok": true,
  "message": "Clave SSH publica agregada correctamente."
}

The endpoint uses grep -qxF to avoid adding duplicate keys. Dropbear is restarted after appending the key.

GET /administracion/keys

Returns all SSH public keys currently installed in /etc/dropbear/authorized_keys on the router.

Response

boolean

true on success.

keys

object[]

Array of parsed key objects.

Show Key object properties

integer

Line index in the authorized_keys file (0-based).

type

string

Key algorithm string (e.g., "ssh-ed25519", "ssh-rsa", "ecdsa-sha2-nistp256").

label

string

Key comment field (typically the user@host that generated the key). "Sin comentario" if absent.

bits

string

Algorithm family: "RSA", "ED25519", "ECDSA", or "SSH".

preview1

string

First 28 characters of the base64 key body followed by "...".

preview2

string

Last 28 characters of the base64 key body.

full

string

The complete key line as it appears in the authorized_keys file.

{
  "ok": true,
  "keys": [
    {
      "id": 0,
      "type": "ssh-ed25519",
      "label": "user@laptop",
      "bits": "ED25519",
      "preview1": "AAAAC3NzaC1lZDI1NTE5AAAAI...",
      "preview2": "...xYzAbCdEfGhIjKlMnOpQrSt",
      "full": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIxYz... user@laptop"
    }
  ]
}

POST /administracion/key/delete

Removes a specific SSH public key from /etc/dropbear/authorized_keys on the router. Dropbear is restarted after removal.

Request

key

string

required

The full key line to remove, exactly as it appears in the full field returned by GET /administracion/keys.

Response

boolean

true on success.

message

string

Confirmation on success, error description on failure.

curl -X POST http://your-app.local/administracion/key/delete \
  -H "Content-Type: application/json" \
  -d '{"key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIxYz... user@laptop"}'

{
  "ok": true,
  "message": "Clave SSH eliminada correctamente."
}

For the full system settings UI, see System settings and Administration.

Authentication

Router API

Dashboard API

System configuration and SSH admin API endpoints