The 'diffie-hellman-group1-sha1' algorithm is used on most Cisco routers, firewalls and switches, so may be added to 'all hosts'. This example only allows 'diffie-hellman-group1-sha1' for a specific host, and sets a default username - connect with ssh cs1k HostkeyAlgorithms +ssh-dss ( for MacOS Ventura use HostkeyAlgorithms +ssh-rsa )Ĭiphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc KexAlgorithms +diffie-hellman-group1-sha1Ī 'better' solution is to create ~/.ssh/config with those two lines, or better yet, applied more specifically: # settings for all hosts Their offer: ssh-dssĮnter the command: sudo nano /etc/ssh/ssh_config and add the following two lines to the end of the file: HostkeyAlgorithms +ssh-dss ( for MacOS Ventura use HostkeyAlgorithms +ssh-rsa ) Their offer: diffie-hellman-group1-sha1 Unable to negotiate with x.x.x.x port 22: no matching host key type found. Unable to negotiate with x.x.x.x port 22: no matching key exchange method found.

If an SSH connection is refused with one of the following errors, the fix is to re-enable them in ssh_config. Sierra (macOS 10.12) uses OpenSSH v7.2 (El Capitan used OpenSSH v6.9) which no longer supports some of the older, less secure algorithms by default.

Ssh for mac os x