Tuesday, November 23, 2021

SSH Secure Shell Login Falure with Diffie-Hellman - Fix

If you get the following error while trying to connect with SSH...

"Unable to negotiate with xx.xxx.xx.xx port 22: no matching key exchange method

found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha"


That error is due to the fact that diffie-helllman is an older less secure connection method.

Apple has removed it from the MacOS starting with MacOS Mojave.


If the server you are trying to connect to cannot upgrade their key exchange method for some reason, You can add diffie-hellman to the MacOS.


Here's how to do that:


Launch the terminal app and enter the following command.

sudo nano /etc/ssh/ssh_config


Locate the line ‘ #   MACs hmac-md5,hmac-sha1,hmac-sha2-256,umac-64@openssh.com,hmac-ripemd160′ and remove the Hash/Pound sign from the beginning, and add the extra hashing algorithm that I’ve shown above in red. 


Locate the line ‘ #   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc’ and remove the Hash/Pound sign from the beginning.

Then paste the following on the end;

HostkeyAlgorithms ssh-dss,ssh-rsa

KexAlgorithms +diffie-hellman-group1-sha1


The Modified text should look like this:


Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc                                                                            

HostkeyAlgorithms ssh-dss,ssh-rsa

KexAlgorithms +diffie-hellman-group1-sha1

MACs hmac-md5,hmac-sha1,hmac-sha2-256,umac-64@openssh.com



Now you should be able to connect with SSH