macOS – SSH Error ‘No Matching Exchange Method Found’

Mac SSH Error KB ID 0001245 

Problem

Certified working all the way up to macOS Ventura version 13.6
Certified working all the way up to macOS Sonoma version 14.1

I thought my RoyalTSX had broken today, I upgraded it a couple of weeks ago, and I upgraded to macOS Catalina 10.15 the other day. After this, all my SSH sessions refused to connect with this error;

Mac SSH Error no matching key exchange

 

Unable to negotiate with x.x.x.x port 22: no matching key exchange found. Their offer diffie-hellman-group1-sha1

Note: You may also see the following error;

Mac SSH error No Matching Cipher found

Unable to negotiate with x.x.x.x port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

Update: 10/04/20: With newer equipment you may see the following error;

Unable to negotiate with x.x.x.x port 22: no matching MAC found Their offer: hmac-sha2-256

Update 08/12/21: With newer Cisco equipment you may see the following error;

Unable to negotiate with x.x.x.x.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

Mac SSH Error – Fix

WARNING: My usual fix for this is to edit the macs ssh_config file directly and allow the older (less secure) connection methods. It has been (correctly) pointed out, that this is the ‘least preferred‘ method, as it will allow these less sure methods for ALL SSH connections. The preferred fix, is to create a new file in your own home folder, with the connection settings for EACH SSH CONNECTION. However, I manage hundreds of firewalls. routers and switches so that method is a little unwieldy for me. But I will include it at the end of the article, for the more security conscious of you.

Not Apple’s fault to be fair, it’s OpenSSH version 7. SHA1 is weak, so support for it has been removed. Which is fine, but all my clients Cisco Firewalls, Routers, Switches are probably all using  RSA/SHA1. So until they re all updated I’m going to need to re-enable SHA1.

Open a terminal windows and execute the following;

sudo nano /etc/ssh/ssh_config
ENTER YOUR PASSWORD

Locate the line ‘ #   MACs hmac-md5,hmac-sha1,hmac-sha2-256,umac-64@openssh.com,hmac-ripemd160′ and remove the Hash/Pound sight from the beginning, and add the extra hashing algorithm that I’ve shown above in red. 

Locate the line ‘ #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc’ and remove the Hash/Pound sight from the beginning.

Then paste the following on the end;

HostkeyAlgorithms ssh-dss,ssh-rsa

KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

Like so;

SSH on mac diffie hellman group 14

Mac SSH Error – Quitting Nano

To quit nano, use the Ctrl-X key combination. because you are working on has been modified since the last time you saved it, you will be prompted to save the file first. Type y to save the file.

Theres no reason to reboot, it should work straight away.

But Wait – Theres More!

It’s going to happen every time you upgrade your mac, I’ve started taking a backup of the ssh_config file, then I can just restore it back again, like so;

Backup macOS SSH Settings & Ciphers

sudo cp /etc/ssh/ssh_config /etc/ssh/ssh_config.bak

Backup-Mac-SSH -Settings

Restore macOS SSH Settings & Ciphers

sudo rm /etc/ssh/ssh_config
sudo mv /etc/ssh/ssh_config.bak /etc/ssh/ssh_config
sudo cp /etc/ssh/ssh_config /etc/ssh/ssh_config.bak

Restore-Mac-SSH -Settings

Mac SSH Error (The More Secure & Preferred) Fix

Using this method you will create a connection (entry) for each asset you want to connect to. This will be saved in your Home directory so if multiple people use the Mac you will need to do this for each user.

Firstly create a config file in you home directory.

sudo nano ~/ssh/config

ssh error mac fix

What this does is create a blank file that you can then create an entry for each of the assets you want to connect to. Firstly specify the hostname, then the settings for that particular asset, like so:

Host YOUR-SWITCH
User YOUR-USER
port 22
KexAlgorithms +diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
Ciphers +aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa

Note: Simply add new host entries at a new line in the SAME config file.

SSH - Fixed

Related Articles, References, Credits, or External Links

NA

Author: PeteLong

Share This Post On

135 Comments

  1. I tried your work around, but it only gives me a different error. Is it possible that something more needs to be changed? Thanks

    Post a Reply
    • What Error did you get?

      P

      Post a Reply
    • Fixed the issue immediately. Thanks

      Post a Reply
    • 2018 and this advice is still good. Fixed my problem too. Thanks!

      Post a Reply
    • nice it works and solve the issues…

      thanks,

      Post a Reply
    • 2020 still working !! I fixed my problem too.

      Post a Reply
      • End of 2020, and this still works to get me on legacy systems.

        Post a Reply
    • Is it possible you forgot a comma , after typing in hmac-sha2-256? Because that’s what I did at first try 😛

      Post a Reply
    • Hi, I got a new Macbook pro with M1 chip and I am trying to SSH into my cisco switches. I tried your fix, but I still get the same error.

      Below is the error I am getting,

      Akhils-MacBook-Pro:~ akhilb$ ssh bwadmin@10.8.64.1
      Unable to negotiate with 10.8.64.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

      Post a Reply
      • Fixed see comments above ^^^

        Post a Reply
    • 2022 and this still works immediately! Thank you!

      Curious, instead of a `.bak` file, could you make a symlink to somewhere else? And would that symlinked file then be “updated” with each mac update? I don’t know, just asking

      Post a Reply
  2. Thanks a lot for this. Helped me straight away!!!

    Post a Reply
    • No Probs – Glad to help 🙂 P

      Post a Reply
  3. Still perfect.
    Thanks For all.

    Post a Reply
  4. Thanks for this.Work just as described!

    Post a Reply
    • Worked like a charm – Thanks!

      Post a Reply
  5. It didn’t like me allowing that line. It kept throwing up a new error, though to be fair, my line was longer and looked different.

    However, putting the pound sign back and just adding that bit to the bottom worked straight away.

    Thanks for the help.

    Post a Reply
  6. Using all 3 changes will invalidate all host-keys in ‘known_hosts’.
    Only the last line was actually needed for me: KexAlgorithms diffie-hellman-group1-sha1

    With the caveat that this will force all ssh negotiations down to this less secure protocol.

    A better option is to leave /etc/ssh/ssh_config alone alltogether, and create ~/.ssh/config in your home-dir (alongside the known_hosts file)
    In ~/.ssh/config create an entry as follows for the equipment that use this key-exchange. Use as identification the name or ip you actually use on your commandline. (i.e. use ‘192.168.0.1’ or ‘firewall’ if you use ‘ssh 192.168.0.1’ or ‘ssh firewall’)

    #force key exchange:
    host 192.168.0.1 firewall.local firewall
    KexAlgorithms diffie-hellman-group1-sha1

    Post a Reply
    • This is great. I updated my Mac to 10.13.6 on 12/26/2018 and both my SSH and Sublime Text SFTP stopped working. (But my Cyberduck SFTP and Microsoft Remote Desktop continued to work.)

      Using the steps in the initial post didn’t work for me. It resulted in an alert that I would be open to a “Man in the Middle” attack and it didn’t allow me to continue.

      However, this comment helped me fix this issue. Now my SSH and Sublime Text SFTP work by creating a ~/.ssh/config file in my local user folder and adding the lines at the end of the file. (Note: 999.999.9.9 is the IP address of the remote server you want to log into.)

      # force key exchange:
      host 999.999.9.9 firewall.local firewall
      KexAlgorithms diffie-hellman-group1-sha1

      Post a Reply
    • my .ssh/config file looks like this :

      #force key exchange:
      Host 192.16.4.203
      KexAlgorithms +diffie-hellman-group1-sha1

      [It failed with the error Unable to negotiate with 192.168.0.2 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1]

      Post a Reply
  7. Thanks a lot, this worked a treat for me. : )

    Post a Reply
  8. Thanks a lot.. IT worked for me..

    Post a Reply
  9. Muchas Gracias, Work

    Post a Reply
  10. Fabulous. Best Cisco resource on the Internet.

    Post a Reply
  11. Worked PERFECTLY!!!! Thank you.

    Post a Reply
  12. Thanks for the pointers. I only needed the last line in order to SSH onto my legacy Cisco switches. Also, it’s more secure to use a “+” which appends SHA1 to the usable set of algorithms, rather than using SHA1 as the default algorithm.

    KexAlgorithms +diffie-hellman-group1-sha1

    Post a Reply
    • Hi, Great response! I’ve update the article accordingly ThanQ

      P

      Post a Reply
  13. Fantastic! Helped when I needed it!

    Post a Reply
  14. It only happens if the Cisco device is using IOS version 12 or older. Version 15 works fine. If you have smartnet contract with Cisco, just upgrade to the recommended software. Instead of messing around with ssh file, I just ssh to an unix server and then ssh to Cisco device.

    Post a Reply
    • Thats fine, but what about Cisco ASA? The problem is inherently a client one, some people don’t have modern code on their devices.

      Pete

      Post a Reply
  15. We’re going to secure ourselves right out of being able to work!

    Thanks for this – you were the first result when I Googled the problem!

    Post a Reply
  16. Thanks a lot ! It’s work for me.

    Post a Reply
    • Just adding the KexAlgorithms +diffie-hellman-group1-sha1 lines to the end of my ssh_config file worked on Mac OSX 10.12.5 (16F73)

      Thanks !

      Dan

      Post a Reply
  17. Hi,

    I had to do this to make it work:

    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
    MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
    KexAlgorithms +diffie-hellman-group1-sha1
    HostkeyAlgorithms ssh-dss,ssh-rsa

    Post a Reply
  18. Thanks so much… this works PERFECTLY.

    Post a Reply
    • No problem glad to help
      P

      Post a Reply
  19. Big ups to my dawg. This worked like a charm. And I’m computer illiterate.

    Post a Reply
    • No worries – Glad to help!

      Pete

      Post a Reply
  20. Just upgraded to High Sierra and started getting this when connecting to an ASA. Thanks for the workaround!

    Post a Reply
  21. This worked perfectly. Have you had any issues getting usb-c port support serial connection? unable to get my macbook pro running Sierra to support belkin usb to serial cable for connection my Cisco console cable. I tried adding drivers and using suggestions on web. None work. Love your input. Maybe you can do a post on it. – thanks Isha

    Post a Reply
    • I’ve not, I’ve got a standard USB converter (bought cheap off eBay) and I’ve never had any problems?

      P

      Post a Reply
  22. So ran into this again after upgrading to High Sierra 10.13.2…

    This time I had to add to /etc/ssh/ssh_config

    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
    KexAlgorithms diffie-hellman-group1-sha1

    Post a Reply
    • Hi

      I work with 10.3.3 and had problems accessing Cisco equipment in the network. With these two lines it works. Thank you very much everyone for the contribution.

      Post a Reply
  23. Thanks, fixed the issue!

    Post a Reply
  24. Was pulling my hair out with this at work. Issue compounded by everything by being Dockerized with very minimal Linux installations. This was the missing piece of the puzzle. Thank you so much for documenting this and putting it out there!

    Post a Reply
  25. Worked like a charm.

    Thanks a lot!

    Post a Reply
  26. That worked great for my Adtran AOS equipment!

    I was getting an error Bad SSH2 Mac spec ‘hmac-md5,hmac-sha1,hmac-ripemd160’, so I removed hmac-ripemd60, which fixed the issue.

    sudo nano ~/.ssh/config

    #force key exchange:
    host 192.168.1.54
    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
    MACs hmac-md5,hmac-sha1,umac-64@openssh.com
    KexAlgorithms +diffie-hellman-group1-sha1
    HostkeyAlgorithms ssh-dss,ssh-rsa

    Post a Reply
  27. I am now getting an error “port 22: Invalid key length”

    Post a Reply
    • Check what you are connecting ‘to’ does not have a short key length on the certificate, either 1024 or 768 is too short.

      Post a Reply
  28. Got it to work on 10.13.6 by only using these two lines:
    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
    HostkeyAlgorithms ssh-dss,ssh-rsa

    Having all four lines resulted in a “connection closed by host” error (too many ciphers offered).
    thanks!

    Post a Reply
  29. Thanks, you are a life saver!!

    Post a Reply
  30. On MarBook Pro 2018.

    Tried the solution, but make the changes in /etc/ssh/ssh_config affect other exciting known_hosts.

    Specifying accepting additional key exchange method in ~/.ssh/config for the target seems the better way.

    Host ASAv
    Hostname myASAv.my.com
    User admin
    KexAlgorithms +diffie-hellman-group1-sha1
    IdentityFile ~/.ssh/asav-private-key

    Then you can ssh
    ssh ASAv

    Post a Reply
    • Hi, if you have one to two ASAs to connect to that fine, I’ve got literally hundreds of the things, across multiple clients 🙂

      Pete

      Post a Reply
  31. Thank You my friend.

    It´s working perfect.

    Thanks a lot.

    Post a Reply
  32. how do you use the shortcut keys at the bottom… I tried using ^6 + enter and does not work…

    Post a Reply
    • CTRL+{The letter indicated}

      P

      Post a Reply
  33. 2019 Still works, fixed my issues.

    Post a Reply
  34. Sep 2019, and the solution works!

    Post a Reply
  35. Just took the leap to Mojave and SSH was broken. Now it is fixed. Way to go!!

    Post a Reply
  36. On Mojave and still works. Thanks!!

    Post a Reply
  37. That fixed it for me! Thanks!

    Post a Reply
  38. Hi OSX 15.2 has deleted Protocol 1 even from the comments ..
    please post how to get it back.. or are the LIB’s gone for ever?

    {ssh_config content supplied but removed}

    Post a Reply
    • I’ve just updated to macOS Catalina 10.15.2 and this still works fine

      Post a Reply
  39. Worked like a charm. Many thank youz 🙂

    Post a Reply
  40. Thank you!!! Worked Perfectly!

    Post a Reply
  41. Dear PeteLong,

    It worked for me also on Mojave!

    Thanks,
    Ev. Drikos

    Post a Reply
  42. Excelente , funciona el fix….Gracias

    Post a Reply
  43. Been looking for a solution to SSH to my Cisco Catalyst 3650 for about an hour.
    Your solution worked instantly! Can’t thank you enough. Great tutorial!

    Post a Reply
  44. Thank’s a lot best regards
    merci a toi pour ce fabuleux travail heureusement qu’il y a des personnes comme toi
    Merci beaucoup

    Post a Reply
  45. Awesome workaround
    Many thanks!

    Post a Reply
  46. Simple solution to a common problem on Macbooks trying to connect to older devices. Thanks!!

    Post a Reply
  47. Cheers Mate! Many Thanks! Was about ready to chuck my mac book.
    MacOSX High Sierra October 2020 – works to ssh to my older Cisco switches.
    I could change cipher suite on all the hundreds of switches, but easier to do in in one place from my desk.

    Post a Reply
    • Your welcome – bookmark the link because every update you will need to do it again!

      Post a Reply
      • Done and Done.

        Thanks again Mate! Brilliant.

        Post a Reply
  48. Pete — cannot get this working under Catalina 10.15.7. I’ve worked this fix many times and re-checked my new config. Error I get is this:
    kex_exchange_identification: read: Connection reset by peer

    Post a Reply
    • Im on 10.15.6 – Ill await the next update to see if it breaks.

      Post a Reply
  49. Pete,
    Please let me know how to save and exit.

    Post a Reply
    • Article updated with this info.

      Post a Reply
  50. works in 2021 on M1 Mac, thank you!!

    Post a Reply
  51. To make the file immutable (uneditable by anything even OS.
    Type chattr +i /etc/ssh/sshd_config

    If you need to change it just type chattr -i /etc/ssh/sshd_config

    This will stay even on OS upgrades.

    Post a Reply
    • Hi Alex,

      That’s a great tip, I’ll do that today and test it over the next upgrade!

      Pete

      Post a Reply
    • Hmmm: chattr is not recognised ‘command not found’ should we not be using chflags?

      I’ve used “sudo chflags schg /etc/ssh/sshd_config” let’s see how that works!

      Pete

      Post a Reply
  52. Worked for me .. Thank you

    Post a Reply
  53. macOS Monterey upgrade and newer Cat9k switches. Had to use “KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1” for the last line to get everything working.

    Post a Reply
  54. Worked for me to fix SSH problems after upgrade to Monterey.
    Although I also had to comment out old host SHA fingerprints in ssh/known_hosts.

    Post a Reply
    • I’m on Sonoma and this solution is not working:

      ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c aes256-ctr user@192.168.4.203

      ssh: connect to host 192.168.4.181 port 22: Operation timed out

      Post a Reply
  55. Outstanding… worked like a charm. I just added a key for diffie-hellman-group14-sha1, because that was also popping up for me as well. Thank you very much!

    Post a Reply
  56. Thank you very much.
    Works perfect!!!

    Post a Reply
  57. This worked great for getting SSH working thank you!
    What I am still having trouble with is SCP on the same router from the same computer that can SSH. Any thoughts?

    Post a Reply
    • Your SCP client might not ee using the same Crypto as the MacOS host – Try a different SCP software.

      Post a Reply
  58. Ran into this issue when my company replaced my Macbook for a new one running Monteray. Happy to say this fix is still working in March 2022. Thanks a lot for this!

    Post a Reply
  59. Fixed the issue immediately. Thank you! March 2022

    Post a Reply
  60. Looked in many places, this is by far the best solution! Many thanks…

    Post a Reply
  61. Worked perfectly allowing me to access an old ReadyNAS NAS storage device which I could no l longer get to after upgrading to MacOS Monterey. Thank you so much!

    Post a Reply
  62. This worked like a charm until last weekend update broke it again on Monterey 12.3.1

    Post a Reply
    • It will happen every time you update my friend!

      P

      Post a Reply
  63. Note this still works with Monterey 12.3.1; I had the .bak file from a previous update so just copied it and it worked immediately; no reboot necessary.

    Post a Reply
  64. may 2022, macOS 12.4, this saved my ass more than one time. Thanks a milion 🙂

    Post a Reply
  65. July 2022 and this still works (on macOS Monterey v12.4)!

    Post a Reply
  66. Hi Edward,

    Agreed, next time I have to do this I’ll update the article. Thanks for the feedback!

    P

    Post a Reply
  67. Still works on macOS Montery 12.5.1, thanks

    Post a Reply
  68. Hi, thanks for the good article and all the comments and insights.

    I’m on Ventura 13.1 and needed to use the following in my ~/.ssh/config file

    host 192.168.1.150
    HostkeyAlgorithms ssh-dss,ssh-rsa
    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
    KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

    Post a Reply
    • Thanks Bart! I just updated to Ventura and encountered this problem trying to ssh to my old Cisco router and switch.

      Your version of the fix worked perfectly for me

      Post a Reply
  69. Still working in 2023

    Post a Reply
  70. Works on macos monterey 2023, thanks

    Post a Reply
  71. Hi,

    I need your advice. After adding all the suggested configs there is sill an error coming up and I can’t ssh into my 3850.
    Unable to negotiate with x.x.x.x port 22: no matching host key type found. Their offer:

    Here is how my ssh_config looks like:
    # StrictHostKeyChecking ask
    # IdentityFile ~/.ssh/id_rsa
    # IdentityFile ~/.ssh/id_dsa
    # IdentityFile ~/.ssh/id_ecdsa
    # IdentityFile ~/.ssh/id_ed25519
    # Port 22
    Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
    MACs hmac-md5,hmac-sha1,hmac-sha2-256,umac-64@openssh.com
    # EscapeChar ~
    # Tunnel no
    # TunnelDevice any:any
    # PermitLocalCommand no
    # VisualHostKey no
    # ProxyCommand ssh -q -W %h:%p gateway.example.com
    # RekeyLimit 1G 1h
    # UserKnownHostsFile ~/.ssh/known_hosts.d/%k
    Host *
    SendEnv LANG LC_*
    HostkeyAlgorithms ssh-dss,ssh-rsa
    KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

    and the error on the switch is:%SSH-3-NO_MATCH: No matching hostkey algorithm found: client ssh-dss,ssh-rsa server

    It is a MAC apple chip Sonoma 14.1.2 (23B92)

    Any advice is very welcome

    Post a Reply
  72. Fixed in the local ssh config file (~/.ssh/config) with the following settings:

    Host *YOUR_SWITCH*
    HostName *YOUR_SWITCH*
    User *YOUR_USER*
    port 22
    KexAlgorithms +diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
    Ciphers +aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
    PubkeyAcceptedAlgorithms +ssh-rsa
    HostkeyAlgorithms +ssh-rsa

    Post a Reply
    • No need to remove the Hash/Pound sight for following:
      #KexAlgorithms +diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
      #Ciphers +aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

      Just add following two lines:
      PubkeyAcceptedAlgorithms +ssh-rsa
      HostkeyAlgorithms +ssh-rsa

      Confirmed with Ubuntu ssh client.

      Post a Reply

Leave a Reply to James Cancel reply

Your email address will not be published. Required fields are marked *