5

I've been successfully using the following script to initiate port forwarding for the last year or so:

ssh-add -K ~/.ssh/id_rsa
ssh -f [email protected] -L 50003:inst3:3389 -N -p 33233
ssh -f [email protected] -L 50005:inst5:3389 -N -p 33233
ssh -f [email protected] -L 50006:inst6:3389 -N -p 33233

Immediately after running today's OS update to 10.12.4, running this same script generates the following error:

Unable to negotiate with [my routable IP] port 33233: no matching host key type found. Their offer: ssh-dss

Some articles indicated that the problem could be resolved by editing ssh_config and uncommenting a particular line. This approach hasn't worked. I'm still locked out of SSH. For reference, here's a copy of my ssh_config file:

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
#   Port 22
#   Protocol 2
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h

I tried uncommenting the line beginning with "MACs hmac-..." but this made no difference. What shall I try next?

Improve this question

1 Answer 1

Reset to default
6 
no matching host key type found. Their offer: ssh-dss

This error says that the remote server is offering only DSA host key. This is considered weak these days with fixed length of 1024 bits. You should update the server and set up different keys (RSA).

As a workaround, you can use HostKeyAlgorithms +ssh-dss in ~/.ssh/config, which will allow you to connect to this server, exactly as described in the official documentation for legacy algorithms in OpenSSH.

Improve this answer
3
  • This solution works. Thanks. It's worth pointing out though that, as you can see in my script, I'm using RSA, not DSA. That RSA key referenced in my script is the one that's bound to my user account on the SSH server to which I'm connecting. Maybe I'm misunderstanding the difference between DSS and DSA?
    – Festus Martingale
    Mar 29, 2017 at 15:33
  • DSS ~ DSA. Just the last letter differs if referencing Algorithm or System. As I mentioned in the answer, it is not about the user authentication key, but host key!
    – Jakuje
    Mar 29, 2017 at 15:34
  • Oh! I was unaware there was a difference between the two (new to this as you can tell). So the SSH server has its own key then. Looks like I have some research to do. Thanks for pointing me in the right direction. At least I can connect now.
    – Festus Martingale
    Mar 29, 2017 at 15:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .