I am accustomed to using Putty on a Windows box or an OSX command line terminal to SSH into a NAS, without any configuration of the client.

Ubuntu 16.04 attempts to SSH into the NAS (via LAN):

ssh root@

Unable to negotiate with port 22: no matching host key type found. Their offer: ssh-dss
  1. Is this result / response intentional?
  2. Is there a simple correction that enables SSH access to the NAS?

The version of OpenSSH included in 16.04 disables ssh-dss. There's a neat page with legacy information that includes this issue: http://www.openssh.com/legacy.html

In a nutshell, you should add the option -oHostKeyAlgorithms=+ssh-dss to the SSH command:

ssh -oHostKeyAlgorithms=+ssh-dss root@

You can also add a host pattern in your ~/.ssh/config so you don't have to specify the key algorithm every time:

Host nas

This has the added benefit that you don't need to type out the IP address. Instead, ssh will recognize the host nas and know where to connect to. Of course you can use any other name in its stead.

  • 1
    I believe that these are solutions on the Ubuntu side. Is there a simple option on the NAS side? It would be nice to understand all options and seize the opportunity to harden any security weakness. Maybe this is another question for another thread? Very nice explanation \ response – gatorback Oct 13 '16 at 12:31
  • Is it possible to set this globally? LIke wildcard IP? doesn't work – podarok Jan 19 '17 at 14:33
  • 4
    @podarok, try Host * – brownian May 31 '17 at 9:25
  • If you're also seeing DH GEX group out of range: serverfault.com/a/809082/55544 – Jonathon Reinhart Sep 21 '20 at 16:04

Editing the ~/.ssh/config file is the best option. If you have a number of hosts to connect to on the same subnet you can use the following method to avoid entering each host in the file:

 Host 192.168.8.*

This works great for me as I have a number of Brocade switches to manage and they started complaining about the Host key after I moved to Ubuntu 16.04.


If you want to use newer OpenSSH to connect to deprecated servers:

ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss my.host.com

Add -v if you want to see what's happening, and -o HostKeyAlgorithms=ssh-dss if it still doesn't work:

ssh -v -o HostKeyAlgorithms=ssh-dss -o KexAlgorithms=diffie-hellman-group14-sha1 my.host.com

You can also, of course, edit /etc/ssh/ssh_config or ~/.ssh/ssh_config, and add:

Host my.host.com *.myinsecure.net 192.168.1.* 192.168.2.*
    HostKeyAlgorithms ssh-dss
    KexAlgorithms diffie-hellman-group1-sha1    

https://forum.ctwug.za.net/t/fyi-openssh-to-access-rbs-openssh-7/6069 mentions the following fix on Mikrotik Routerboards:

/ip ssh set strong-crypto=yes

(Nothing this here because this answer also comes up on web searches when looking for a similar error message.)

  • it should be -o KexAlgorithms=diffie-hellman-group1-sha1 (not 14) – dalf Sep 8 '17 at 8:12
  • That depends... $ ssh -Q kex server diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 curve25519-sha256@libssh.org – Dagelf Sep 10 '17 at 7:43
  • Thanks for the Mikrotik info. Sadly it only works on RouterOS 6.31 onwards. (Mine is on a remote site and I don't fancy trying a remote upgrade in case something goes wrong...) – mwfearnley Apr 14 '20 at 13:36
  • It should definitely work on older Mikrotik too, you just have to find a supported key algo, just try a few of the ones listed with ssh -Q kex - and definitely add ssh-dss. You definitely should upgrade your router, because it's trivial to log into 6.31 without any password at all, so the risk of someone else locking you out is quite high - I hope it doesn't have internet access! If it does, log into it and /sys package update download; /reboot. If you can't ssh, try telnet or mactelnet. – Dagelf Apr 14 '20 at 14:33
  • 1
    nice! I have received the error "Protocol error: no matching DH grp found". Adding -o KexAlgorithms=diffie-hellman-group14-sha1 helped! (even if it is just a workaround) – Istvan Devai Sep 1 '20 at 18:16

For me this added into .ssh\config worked:

Host *
HostkeyAlgorithms +ssh-dss
PubkeyAcceptedKeyTypes +ssh-dss
  • Simple and working. Sometimes you just want a quick solution. – Sopalajo de Arrierez Jul 30 '20 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.