From b13751e6d1dcd5052979161adc873b93744f264c Mon Sep 17 00:00:00 2001
From: ssmithx <atobitcoin@proton.me>
Date: Sun, 26 Jul 2026 23:07:17 +0000
Subject: [PATCH] first of openwrt-tollgate-UI enhancements

---
 scripts/gl-inet-enable-ssh.sh | 85 +++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100755 scripts/gl-inet-enable-ssh.sh

diff --git a/scripts/gl-inet-enable-ssh.sh b/scripts/gl-inet-enable-ssh.sh
new file mode 100755
index 00000000..d4ed4560
--- /dev/null
+++ b/scripts/gl-inet-enable-ssh.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# ./gl-inet-enable-ssh.sh <password> [router-ip]
+#
+# Defaults to 192.168.8.1. It does:
+#
+# 1. Completes OOBE/init (sets password + enables SSH)
+# 2. Challenge-response login
+# 3. Explicitly enables SSH via API
+# 4. Verifies SSH is working
+#
+# Needs curl, python3, openssl, sshpass, and md5sum on the machine running it.
+
+set -euo pipefail
+
+ROUTER="${GL_ROUTER:-192.168.8.1}"
+PASSWORD="${1:?Usage: $0 <password> [router-ip]}"
+HOST="${2:-$ROUTER}"
+
+challenge() {
+  curl -sk "http://$HOST/rpc" \
+    -H "Content-Type: application/json" \
+    -d "{\"jsonrpc\":\"2.0\",\"method\":\"challenge\",\"params\":{\"username\":\"root\"},\"id\":1}"
+}
+
+login() {
+  local hash="$1"
+  curl -sk "http://$HOST/rpc" \
+    -H "Content-Type: application/json" \
+    -d "{\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"username\":\"root\",\"hash\":\"$hash\"},\"id\":2}"
+}
+
+rpc_call() {
+  local sid="$1" module="$2" method="$3" params="$4"
+  curl -sk "http://$HOST/rpc" \
+    -H "Content-Type: application/json" \
+    -d "{\"jsonrpc\":\"2.0\",\"method\":\"call\",\"params\":[\"$sid\",\"$module\",\"$method\",$params],\"id\":3}"
+}
+
+# Step 1: Complete OOBE / init (enables SSH)
+echo "Initializing router..."
+INIT=$(curl -sk "http://$HOST/rpc" \
+  -H "Content-Type: application/json" \
+  -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"call\",\"params\":[\"\",\"ui\",\"init\",{\"lang\":\"en\",\"username\":\"root\",\"password\":\"$PASSWORD\",\"security_rule\":0}]}")
+echo "$INIT"
+
+if echo "$INIT" | grep -q '"error"'; then
+  echo "Init returned error (may already be initialized), continuing..."
+fi
+
+sleep 1
+
+# Step 2: Challenge-response login
+echo "Logging in..."
+CHALLENGE=$(challenge)
+SALT=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['salt'])")
+NONCE=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['nonce'])")
+ALG=$(echo "$CHALLENGE" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['alg'])")
+
+CIPHER=$(openssl passwd "-$ALG" -salt "$SALT" "$PASSWORD" 2>/dev/null)
+HASH=$(printf "root:%s:%s" "$CIPHER" "$NONCE" | md5sum | cut -d' ' -f1)
+
+LOGIN=$(login "$HASH")
+SID=$(echo "$LOGIN" | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['sid'])" 2>/dev/null)
+
+if [ -z "$SID" ]; then
+  echo "Login failed: $LOGIN"
+  echo "SSH should still be enabled from the init call. Try: ssh root@$HOST"
+  exit 1
+fi
+
+echo "Logged in. SID: $SID"
+
+# Step 3: Enable SSH explicitly
+echo "Enabling SSH..."
+SSH_RESULT=$(rpc_call "$SID" "system" "set_settings" '{"key":"ssh","value":{"enable":true}}')
+echo "$SSH_RESULT"
+
+# Step 4: Verify SSH
+echo "Verifying SSH on $HOST:22..."
+if sshpass -p "$PASSWORD" ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no root@$HOST "echo SSH OK" 2>/dev/null; then
+  echo "Done. SSH is enabled on root@$HOST"
+else
+  echo "SSH port not responding yet. May need a moment or SSH may already be enabled."
+  echo "Try: ssh root@$HOST"
+fi