How to Enable SSH on the Xiaomi BE3600 2.5GbE
This is a quick guide for advanced users. If you get stuck, leave a comment with the exact step and error.
I. Requirements
- Xiaomi BE3600 running firmware 1.0.65.
- MobaXterm, PuTTY, PowerShell, or an equivalent terminal application.
If the firmware is newer than the version above, downgrade it with MiWiFi RepairTool.
II. Enabling SSH
- Log in to the management interface. The default IP is 192.168.31.1, and the password is the password you created during the initial router setup.
- After logging in, the URL should look like this:
http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router
- The text highlighted in red is the token. Copy it.
Open a Terminal, replace the token, and run the following requests in order:
- Command 1:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/xqsystem/start_binding” -d “uid=1234&key=1234’%0Anvram%20set%20ssh_en%3D1%0A’”
- Command 2:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/xqsystem/start_binding” -d “uid=1234&key=1234’%0Anvram%20commit%0A’”
- Command 3:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/xqsystem/start_binding” -d “uid=1234&key=1234’%0Ased%20-i%20’s%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg’%20%2Fetc%2Finit.d%2Fdropbear%0A’”
- Command 4:
curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/arn_switch” -d “uid=1234&key=1234’%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A’”
After command 4, SSH should be enabled. Log in with user root and use the serial number to calculate the password.
Nhập SN của Router Xiaomi để tính toán mật khẩu root SSH.
SSH will not start automatically after a reboot, so the steps above must be repeated.
To keep SSH enabled, connect to the router over SSH with a Terminal and run:
zz=$(dd if=/dev/zero bs=1 count=2 2>/dev/null) ; printf '\xA5\x5A%c%c' $zz $zz | mtd write - crash rebootAfter the router reboots, log in to SSH again and run:
nvram set ssh_en=1 nvram set telnet_en=1 nvram set uart_en=1 nvram set boot_wait=on nvram commit bdata set ssh_en=1 bdata set telnet_en=1 bdata set uart_en=1 bdata set boot_wait=on bdata commit rebootAfter the router reboots again, log in to SSH and run:
mtd erase crash rebootGood luck!
Comments & Discussion
Share your thoughts, ask questions and feedback