19

My SSH connections worked well, but from last week SSH from my laptop to my board refusing connection. I can make a SSH connection from the board to laptop, but not vice-versa. I tried that with my user and root user and had same issue.

My Laptop is an Ubuntu 12.10 and my board is a Debian 6.

Here is the verbose output of SSH:

danialbehzadi@danial-HP:~$ ssh -v 192.168.1.2  
OpenSSH_5.2p1, OpenSSL 1.0.1c 10 May 2012
debug1: Reading configuration data /usr/local/etc/ssh_config
debug1: Connecting to 192.168.1.2 [192.168.1.2] port 22.
debug1: Connection established.  
debug1: identity file /home/danialbehzadi/.ssh/identity type -1  
debug1: identity file /home/danialbehzadi/.ssh/id_rsa type 1  
debug1: identity file /home/danialbehzadi/.ssh/id_dsa type -1  
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.0p1 Debian-4  
debug1: match: OpenSSH_6.0p1 Debian-4 pat OpenSSH*  
debug1: Enabling compatibility mode for protocol 2.0  
debug1: Local version string SSH-2.0-OpenSSH_5.2  
debug1: SSH2_MSG_KEXINIT sent  
debug1: SSH2_MSG_KEXINIT received  
debug1: kex: server->client aes128-ctr hmac-md5 none  
debug1: kex: client->server aes128-ctr hmac-md5 none  
no hostkey alg

5 Answers 5

11

I made new rsa and dsa keys on the board and it went OK:

~# ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
~# ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
2
  • 1
    On a related note, When I tried to connect from dropbear ssh (common on android) to cygwin's sshd, I got "no matching algo hostkey". The server was set to accept key and password so it should've gone to password if the key fails. So I think this solution might not work for some.. According to this link it's to do with the encryption algorithm used linksysinfo.org/index.php?threads/tomato-ssh.29460 but no solution mentioned there.
    – barlop
    Sep 5, 2014 at 10:57
  • 1
    We had the same problem with a ubuntu server 14.04. After trying to start a new instance of ssh server in debug mode, we found that private keys on the server did not have 0600 permission, once we fixed that and restarted the server, everything started working ok.
    – Awi
    Jul 10, 2015 at 20:51
11

I was having the same problem connecting older clients to a Slackware 15 server. This thread is the top result for ssh "no hostkey alg" but the existing answers did not solve my problem, so here is how I did.

I found this in the server's /var/log/messages after a failed connection attempt:

sshd[pid]: Unable to negotiate with x.x.x.x port yyyyy: no matching host key type found. Their offer: [email protected],[email protected],ssh-rsa,ssh-dss [preauth]

After consulting the sshd_config man page, I added this line to the server's /etc/ssh/sshd_config:

HostKeyAlgorithms +ssh-rsa,ssh-dss

Then I reloaded sshd (on the server): killall -HUP sshd

Now my old clients are able to connect again.

3
  • 2
    This worked surprisingly for me as well: Connecting OS X 10.6.8 with openssh 5.2 to a gentoo system with openssh 9.1. However, I would add you need to restart the ssh daemon (systemctl restart sshd) before it will work. Jan 5, 2023 at 0:41
  • 1
    Note to clarify: the /etc/ssh/sshd_config change needs to happen on the server you're connecting to, not on the client. Apr 27, 2023 at 6:50
  • On some newer systems, there's no /var/log/messages, and you have to do journalctl -u sshd | tail . May 11, 2023 at 21:16
1

For me the error was related to using a (very) old client on some system (OpenSSH_5.3p1) to the ESXI 7.x SSHd.

When connecting from a newer SSH client, the issue was no longer there and I was able to connect just fine.

Trace of ssh -vv to my host (using the older client):

debug2: kex_parse_kexinit: hmac-sha2-256,hmac-sha2-512
debug2: kex_parse_kexinit: hmac-sha2-256,hmac-sha2-512
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit: none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-sha2-256
debug1: kex: server->client aes128-ctr hmac-sha2-256 none
debug2: mac_setup: found hmac-sha2-256
debug1: kex: client->server aes128-ctr hmac-sha2-256 none
no hostkey alg
0
HostKeyAlgorithms +ssh-rsa,ssh-dss

Also worked to connect from SCO Openserver

Update: Nov 5, 23

I was doing another system today, and wasted an hour because I put a space after the comma "ssh-rsa, ssh-dss"

1
  • I believe you are correct, @jgt but please supply the full ssh syntax. Remember, people will be reading this in another 10 years.
    – Frobozz
    Mar 31, 2023 at 1:20
-1

[root@server ~]# ls -la /etc/ssh/ssh_host_*

-rw-------. 1 root root      668 Jun 25 00:03 /etc/ssh/ssh_host_dsa_key
-rw-r--r--. 1 root root      609 Jun 25 00:03 /etc/ssh/ssh_host_dsa_key.pub
-rw-r-----. 1 root ssh_keys  227 Dec 14  2018 /etc/ssh/ssh_host_ecdsa_key
-rw-r--r--. 1 root root      162 Dec 14  2018 /etc/ssh/ssh_host_ecdsa_key.pub
-rw-r-----. 1 root ssh_keys  387 Dec 14  2018 /etc/ssh/ssh_host_ed25519_key
-rw-r--r--. 1 root root       82 Dec 14  2018 /etc/ssh/ssh_host_ed25519_key.pub
-rw-------. 1 root root      963 Apr 18  2011 /etc/ssh/ssh_host_key
-rw-r--r--. 1 root root      627 Apr 18  2011 /etc/ssh/ssh_host_key.pub
-rw-------. 1 root root     1679 Jun 25 00:02 /etc/ssh/ssh_host_rsa_key
-rw-r--r--. 1 root root      401 Jun 25 00:02 /etc/ssh/ssh_host_rsa_key.pub

make sure file ssh_host_* mode is 644 and 600 like this

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .