I’ve seen this question come up several times from users of macOS Sierra who use SSH after upgrading. It usually goes something like, “Has anyone seen this since upgrading to Sierra?”
Unable to negotiate with 192.0.2.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
Another issue you might come across is your public key ceasing to work. If you connect with the verbose option (
ssh -v hostname), you might catch a bit like this in the output:
Skipping ssh-dss key /Users/scottm/.ssh/id_dsa - not in PubkeyAcceptedKeyTypes
These aren’t a Sierra issue per-se, but is more specifically related to the upgrade from OpenSSH 6.9 in El Capitan to OpenSSH 7.2 in Sierra. OpenSSH deprecated a number of methods and algorithms in 7.0. They are still supported, but are disabled by default. For more information, check out OpenSSH: Legacy Options.
That’s all fine and dandy, but what you really want is a solution. You probably have some security appliance, router, or similar that doesn’t support any other methods and you just need it to work. Perhaps like me, you have an older private key that isn’t up to the new requirements, but you still need to use it. The options to fix these issues are
KexAlgorithms +diffie-hellman-group1-sha1 and
PubkeyAcceptedKeyTypes=+ssh-dss. You can add these at the command line (
ssh -o PubkeyAcceptedKeyTypes=+ssh-dss hostname), but that’s kind of a pain.
A more convenient way to use them is to add these options to your
~/.ssh/config file. If you don’t already have this config file, it’s a plain text file you can create with your text editor of choice. At the top of the file, add:
# Settings for all hosts PubkeyAcceptedKeyTypes=+ssh-dss KexAlgorithms +diffie-hellman-group1-sha1
Now your public key and the key exchange algorithm will work anywhere you connect. Perhaps you’d like a bit more granularity?
# Settings for all hosts PubkeyAcceptedKeyTypes=+ssh-dss # Host specific settings Host *.net.mydomain.net KexAlgorithms +diffie-hellman-group1-sha1 User username
This allows the public key for all hosts, but only allows the
diffie-hellman-group1-sha1 algorithm to be used with hosts matching the wildcard. Additionally, this example shows using a different username than your login on your local machine. There are a lot of options available, but these are the ones I use most. You might also find
Compression yes to be useful if you connect to hosts with low bandwidth links.
As an aside, if you are a macOS user using Terminal, I highly recommend checking out iTerm2. It’s far superior to Terminal and has many features to improve the experience of using the shell.