SSH: "no matching host key type found. Their offer: ssh-rsa" (and ssh-dss)

TL;DR

1

ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa admin@legacy-host

To make it stick, a block in ~/.ssh/config for that host only:

1
2
3

Host legacy-host
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

If the offer is ssh-dss, the option is +ssh-dss, but it only works on OpenSSH older than 10.0. Since 10.0 (April 2025) DSA no longer exists in the client and +ssh-dss fails with Bad key types; you need an older client (below).

What the error means

1

Unable to negotiate with 192.168.1.10 port 22: no matching host key type found. Their offer: ssh-rsa

The server can only sign its host key with ssh-rsa, which is RSA over SHA-1. OpenSSH 8.8 (September 2021) stopped accepting RSA/SHA-1 signatures by default because SHA-1 is broken: per the release notes, a chosen-prefix collision costs under USD 50K. Your key and the host key can still be RSA; what gets rejected is the signature over SHA-1. A modern server signs with rsa-sha2-256 or rsa-sha2-512 and never triggers this.

Who still offers only ssh-rsa (or ssh-dss): HP iLO 2/3/4, switches and routers on old firmware, NAS boxes that were never updated, old Dropbear on embedded gear, Windows Server 2003 with a third-party SSH server, out-of-support appliances.

Variants of the same problem

no mutual signature algorithm is the same problem seen from your key: the server only accepts ssh-rsa signatures to authenticate your RSA key. Before OpenSSH 8.5 the option was called PubkeyAcceptedKeyTypes; the old name is still accepted as an alias.

An iLO 2 or 3 usually needs all of it at once:

1
2
3
4
5

ssh -o HostKeyAlgorithms=+ssh-rsa \
    -o PubkeyAcceptedAlgorithms=+ssh-rsa \
    -o KexAlgorithms=+diffie-hellman-group14-sha1 \
    -c aes256-cbc \
    Administrator@ilo01

Persistent config

1
2
3
4
5
6
7
8

# ~/.ssh/config
Host ilo01
    HostName ilo01.lab.example
    User Administrator
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa
    KexAlgorithms +diffie-hellman-group14-sha1
    Ciphers +aes256-cbc

Three details:

• The + appends to the default list. Without + you replace the whole list and that host will only negotiate what you typed.
• Never put it under Host *: you would re-enable SHA-1 against every server you use.
• If the host was already in known_hosts with a different key type: ssh-keygen -R legacy-host and connect again.

ssh-dss on OpenSSH 10 or newer

DSA timeline in OpenSSH:

Debian 13 (trixie) ships openssh-client 10.0p1 and macOS Tahoe ships OpenSSH_10.0p2. On those clients:

1
2

$ ssh -o HostKeyAlgorithms=+ssh-dss admin@legacy-host
command-line line 0: Bad key types '+ssh-dss'.

Check what your client can do before fighting the options:

1
2
3
4

ssh -V
ssh -Q key | grep -c ssh-dss   # 0 = your client no longer speaks ssh-dss
ssh -Q kex | grep sha1         # group1/group14-sha1 are still there in 10.x
ssh -Q cipher | grep cbc       # aes*-cbc and 3des-cbc are still there in 10.x

If the grep -c prints 0, the practical way out is an older client in a container. Debian 12 (bookworm) ships OpenSSH 9.2p1, which still compiles DSA:

1
2
3
4
5

docker run --rm -it debian:bookworm bash -c '
  apt-get update -qq && apt-get install -y -qq openssh-client >/dev/null &&
  ssh -o HostKeyAlgorithms=+ssh-dss \
      -o KexAlgorithms=+diffie-hellman-group1-sha1 \
      admin@192.168.1.10'

Password auth works as is; if you need a key, mount it with -v. PuTTY (and plink) also still accept DSA, with a warning.

The real fix lives on the server: newer firmware, or an ed25519 / RSA host key with rsa-sha2-256 (OpenSSH server has supported it since 7.2).

See what the server offers

1
2

ssh -vv admin@legacy-host 2>&1 | grep -i 'their offer'
nmap -p 22 --script ssh2-enum-algos legacy-host

ssh2-enum-algos lists the server’s kex, host keys, ciphers, and MACs without authenticating.

Traps

• This is a patch, not a fix: SHA-1 signatures and 1024-bit DH (group1) are weak. Use it only on isolated management networks and plan to update the device.
• OpenSSH 10.0 also dropped the diffie-hellman-group* kex methods from the sshd defaults; the client keeps them. If a 10.x server is the one rejecting an old client, the knob is in sshd_config, not here.
• On Fedora/RHEL there is also crypto-policies. A Host block in ~/.ssh/config is read before the system policy and is safer than dropping everything to LEGACY.
• On Windows, the built-in ssh.exe is OpenSSH and takes the same options; ssh -V tells you which version you have.

See also

• iLO CLI commands and upgrade iLO firmware over SSH — the -c aes256-cbc cipher in action.
• SSH to Windows Server 2003 with Bitvise.
• OpenSSH: Legacy Options, release notes for 8.8 and 10.0.