WardtermSSH client
EN
Download

SSH "no matching key exchange method found" or "no matching host key type found": how to fix it

The server only offers old algorithms that your OpenSSH client no longer enables by default. To reach that one host, add the algorithm from Their offer with a + in its Host block, for example KexAlgorithms +diffie-hellman-group14-sha1. This weakens only that connection. The real fix is to update the device or its SSH settings.

Updated . Each error and each + option was reproduced with OpenSSH 10.3 on macOS against a throwaway OpenSSH 10.0 server on Debian 13, set to offer only the old algorithm.

The messages

Unable to negotiate with 203.0.113.10 port 22: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,ext-info-s,kex-strict-s-v00@openssh.com
Unable to negotiate with 203.0.113.10 port 22: no matching host key type found. Their offer: ssh-rsa
Unable to negotiate with 203.0.113.10 port 22: no matching cipher found. Their offer: aes128-cbc
Unable to negotiate with 203.0.113.10 port 22: no matching MAC found. Their offer: hmac-md5

Before logging in, client and server must agree on a list of algorithms. This message means they have nothing in common, and Their offer tells you what the server can do. OpenSSH still includes many old algorithms, but it does not use them unless you ask. This often happens with old network gear, printers, storage boxes and old Linux systems, often right after your client was updated.

Names such as ext-info-s and kex-strict-s-v00@openssh.com in the offer are protocol markers, not algorithms you can pick. Ignore them.

Allow it for one host

Each message maps to one option:

MessageOption
no matching key exchange method foundKexAlgorithms
no matching host key type foundHostKeyAlgorithms
no matching cipher foundCiphers
no matching MAC foundMACs

Try it once on the command line, copying the name from the offer:

ssh -o KexAlgorithms=+diffie-hellman-group14-sha1 user@203.0.113.10

An old device often needs several, and they show up one at a time, because the client stops at the first mismatch. Add each to ~/.ssh/config:

Host old-switch
    HostName 203.0.113.10
    User user
    KexAlgorithms +diffie-hellman-group14-sha1
    HostKeyAlgorithms +ssh-rsa
    Ciphers +aes128-cbc

Keep the +. It adds to the default list, so the modern algorithms stay first and are used as soon as the device supports them. Without it, you replace the whole list.

Keep this in a named Host block and never under Host *, which would lower the bar for every server. Also, ssh uses the first value it finds for each option, so put this block above any general block that sets the same option.

Your RSA key is refused with no explanation

If an old server only understands ssh-rsa signatures for user keys, the client simply says Permission denied (publickey), with no mention of algorithms. We got this with a server limited to ssh-rsa. Adding this line for the host fixed it:

PubkeyAcceptedAlgorithms +ssh-rsa

ssh-dss has no workaround

OpenSSH 10.0 removed DSA completely. A client from version 10 cannot be told to use it:

command-line line 0: Bad key types '+ssh-dss'.

If a device offers only ssh-dss, update the device. Until then, the only way in is an older client, for example in a virtual machine on a trusted network.

See what each side supports

What your client can do at all, including what it does not enable by default:

ssh -Q kex
ssh -Q HostKeyAlgorithms
ssh -Q cipher
ssh -Q mac

What your client would really offer to this host:

ssh -G server | grep -E '^(kexalgorithms|hostkeyalgorithms|ciphers|macs) '

Everything the server offers, all at once rather than one error at a time:

ssh -vv user@server 2>&1 | grep -A9 'peer server KEXINIT'

What you are accepting

These algorithms are disabled for a reason. The weakness applies to that connection only:

  • diffie-hellman-group1-sha1 uses a 1024-bit group and SHA-1.
  • ssh-rsa signs with SHA-1. OpenSSH disabled it by default in version 8.8. The RSA key itself is not the problem: a modern server uses the same key with rsa-sha2-256 or rsa-sha2-512. For the same problem with user keys, see no mutual signature supported.
  • CBC ciphers and hmac-md5 are old designs that newer modes replaced.

Treat it as temporary, and keep such a device on a management network and away from the open internet.

The real fix on the device

  1. Update it. Firmware updates often add modern algorithms. Check the vendor's documentation for SSH or management hardening.
  2. Check its settings. Many devices support better algorithms that are simply turned off. On a Linux server, this shows what is active: 
    sudo sshd -T | grep -iE '^(kexalgorithms|hostkeyalgorithms|ciphers|macs) '
    Remove any old KexAlgorithms, HostKeyAlgorithms, Ciphers or MACs lines from /etc/ssh/sshd_config and its include folder to return to the defaults.
  3. Generate a modern host key if the server has none: 
    sudo ssh-keygen -t ed25519 -N '' -f /etc/ssh/ssh_host_ed25519_key
sudo systemctl restart sshd
    The unit is called ssh on Debian and Ubuntu. Clients may then show a changed host key warning, so plan for that.
  4. Remove the workaround from your config and connect again to confirm.

Since OpenSSH 10.1, a connection that works but uses an older key exchange prints this:

** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html

The session does connect, and the fix is on the server. What it means and how to fix or silence it: the post-quantum key exchange warning.

Questions

Is it safe to enable diffie-hellman-group14-sha1?

Only as a stopgap for one old device on a trusted network. It relies on SHA-1, so keep it in that host's own Host block and never under Host *.

Why did this start after an update?

Newer OpenSSH clients stop offering old algorithms by default. The server did not change: your client no longer accepts what it offers.

What does the + before an algorithm mean?

It adds the algorithm to the default list instead of replacing the list, so modern algorithms stay first and are used once the device supports them.

Sources

More in Error messages

All guides