How to Enable SSH on the Xiaomi BE3600 2.5GbE

💡 Mẹo hay

This is a quick guide for advanced users. If you get stuck, leave a comment with the exact step and error.

I. Requirements

Xiaomi BE3600 running firmware 1.0.65.
MobaXterm, PuTTY, PowerShell, or an equivalent terminal application.

If the firmware is newer than the version above, downgrade it with MiWiFi RepairTool.

II. Enabling SSH

Enable SSH version 1.0.87 updated at the end of the article
Log in to the management interface. The default IP is 192.168.31.1, and the password is the password you created during the initial router setup.
- After logging in, the URL should look like this:

http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/web/home#router

The text highlighted in red is the token. Copy it.

Open a Terminal, replace the token, and run the following requests in order:

Command 1:

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/xqsystem/start_binding” -d “uid=1234&key=1234’%0Anvram%20set%20ssh_en%3D1%0A’”

Command 2:

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/xqsystem/start_binding” -d “uid=1234&key=1234’%0Anvram%20commit%0A’”

Command 3:

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/xqsystem/start_binding” -d “uid=1234&key=1234’%0Ased%20-i%20’s%2Fchannel%3D.*%2Fchannel%3D%22debug%22%2Fg’%20%2Fetc%2Finit.d%2Fdropbear%0A’”

Command 4:

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/misystem/arn_switch” -d “uid=1234&key=1234’%0A%2Fetc%2Finit.d%2Fdropbear%20start%0A’”

After command 4, SSH should be enabled. Log in with user root and use the serial number to calculate the password.

🔐 Tra cứu mật khẩu SSH từ Serial Number

Nhập SN của Router Xiaomi để tính toán mật khẩu root SSH.

SSH will not start automatically after a reboot, so the steps above must be repeated.

To keep SSH enabled, connect to the router over SSH with a Terminal and run:

zz=$(dd if=/dev/zero bs=1 count=2 2>/dev/null) ; printf '\xA5\x5A%c%c' $zz $zz | mtd write - crash    reboot

After the router reboots, log in to SSH again and run:

nvram set ssh_en=1    nvram set telnet_en=1    nvram set uart_en=1    nvram set boot_wait=on    nvram commit    bdata set ssh_en=1    bdata set telnet_en=1    bdata set uart_en=1    bdata set boot_wait=on    bdata commit    reboot

After the router reboots again, log in to SSH and run:

mtd erase crash    reboot

Some new production Xiaomi BE3600 2.5GbE may come with firmware 1.0.87 preinstalled or you may have upgraded to it. In this case, the curl commands above will not work. Please use the following commands instead:

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/xqsystem/start_binding” -d “uid=1234&key=%27%20%3C(nvram%20set%20ssh_en%3D1)%20%23”

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/xqsystem/start_binding” -d “uid=1234&key=%27%20%3C(nvram%20commit)%20%23”

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/xqsystem/start_binding” -d “uid=1234&key=%27%20%3C(sed%20-i%20%27s/channel%3D.*/channel%3D%22debug%22/g% 27%20/etc/init.d/dropbear)%20%23”

curl -X POST “http://192.168.31.1/cgi-bin/luci/;stok=d2d55f6e595e236044bfff0b444e2c51/api/xqsystem/start_binding” -d “uid=1234&key=%27%20%3C(/etc/init.d/dropbear%20start)%20%23”

Good luck!

How to Enable SSH on the Xiaomi BE3600 2.5GbE

I. Requirements

II. Enabling SSH

Comments & Discussion