I get the following error when using git:
$ git pull
Unable to negotiate with 172.16.42.42 port 22: no matching host key type found. Their offer: ssh-rsa
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
How can I resolve this error?
With SSH, there are several different types of keys and RSA keys (the ssh-rsa) kind can support multiple kinds of signatures. The signature type ssh-rsa refers to RSA with SHA-1, whereas the signature type rsa-sha2-256 is RSA with SHA-256 and rsa-sha2-512 is RSA with SHA-512.
In the case of Azure DevOps, it only supports the kind of RSA with SHA-1, and SHA-1 is considered very weak. This essentially means that there are no secure ways to connect to it over SSH, and until they fix that, you're better off using HTTPS or a different hosting service. GitHub, GitLab, and Bitbucket all support secure methods of authentication.
If you really need to use SSH with Azure DevOps at the moment, you can add an entry to your ~/.ssh/config file to work around this:
Host ssh.dev.azure.com
User git
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
However, be aware that this is a workaround and it's known to be insecure, so you should contact Azure DevOps about this problem and switch to HTTPS until they do, or move elsewhere.
OpenSSH will report the error
no matching host key type found. Their offer: ssh-rsa
if the server it's connecting to is offering to authenticate over ssh-rsa ( RSA/SHA1).
Azure Devops (TFS) is offering to authenticate over ssh-rsa. As noted in the answer by bk2204, this algorithm is not considered cryptographically secure.
Since it's considered weak, OpenSSH deprecated using SHA-1 in 8.2 in 2020-02-14.
It is now possible[1] to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm that depends on SHA-1 by default in a near-future release.
Azure Devops Services subsequently announced a patch to allow SHA-2
On may 5 2021, the Azure DevOps documentation was updated to mention using RSA 3072.
¯\_(ツ)_/¯
Doesn't say anywhere. Probably only ssh-rsa.
Add this
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
To your ~/.ssh/config
Host your-azure-devops-domain
IdentityFile ~/.ssh/id_rsa
IdentitiesOnly yes
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
According to this post, you can add ssh.dev.azure.com host config to your ~/.ssh/config file:
Final
~/.ssh/configthat worked for me:Host ssh.dev.azure.com HostName ssh.dev.azure.com User git IdentityFile ~/.ssh/id_rsa IdentitiesOnly yes PubkeyAcceptedAlgorithms +ssh-rsa HostkeyAlgorithms +ssh-rsa
scp or ssh could used this
ssh -p 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa user@myhost
# or scp
scp -P 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa user@myhost
For those using Azure DevOps, you should use the following ~/.ssh/config, as Azure has a thing with varying what url it returns in its Clone Repository:
Host ssh.dev.azure.com
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
Host vs-ssh.visualstudio.com
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
In your ~/.ssh/config file, add these lines.
Host *.drush.in
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
I also got this problem, this worked for me:
cd ~/.ssh/
vim config
Host [Hostname]
User [User]
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
I got this problem for a few hostnames so now i have several of those configurations in my ssh config file.
There are 2 steps:
Add config file (without extension) to your ~/.ssh/ directory.
Add below content to the config file:
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
With NixOS 21.11 openSSH got updated to 8.8p1 ( see Changelog ). OpenSSH deprecated ssh-rsa along with a couple of other insecure ciphers.
If i understood correctly, you are only using nix as package manager and not NixOS. If that is the case you can follow the guides in the remaining answers (edit ~/.ssh/config).
However, when you are using NixOS to configure your server you can re-enable ssh-rsa for the ssh client, by adding to your configuration.nix:
programs.ssh.extraConfig = ''
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
''
To re-enable the insecure ssh-rsa cipher for your openssh server (e.g. when legacy clients connect to the server), you can simply add the following lines to your configuration.nix:
services.openssh.extraConfig = ''
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
'';
Correction for the posted answer. I had the same issue and I fixed it with the following snippet from above with a tiny fix:
Host YOUR-DOMAIN
Hostname YOUR-DOMAIN
IdentityFile ~/.ssh/id_rsa
IdentitiesOnly yes
HostKeyAlgorithms=+ssh-rsa
PubkeyAcceptedAlgorithms=+ssh-rsa
Dont forget to replace YOUR-DOMAIN with the domain you are using on AzureDevOps.
The format of the workaround wasn't working for me for windows 10 and git version 2.32.0. This snippet worked for me
Host = Hostname.com
IdentityFile = ~/.ssh/id_rsa
IdentitiesOnly = yes
HostkeyAlgorithms = +ssh-rsa
PubkeyAcceptedAlgorithms = +ssh-rsa
I googled a lot a bout this mistake: I have Ubuntu 22.04 and here all my configuration.
I hope it will help someone.
linux@linux:~$ cat /home/username/.ssh/configHost *
KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512
Ciphers aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr
User username # it depends on your login; this one only for understanding
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
And:
/etc/ssh/sshd_config# Ciphers and keying
Ciphers aes128-cbc,3des-cbc
KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512
HostkeyAlgorithms ssh-dss,ssh-rsa
KexAlgorithms diffie-hellman-group1-sha1
I also faced this issue on my windows machine while setting up the SSH key for bitbucket
Initially, the config file was not created when I generated the public and private key files using the ssh-keygen command, so I used GitBash to create the config file and wrote the below content on it.
To create the file
touch config
To open and update the created file
nano config
Content added to the config file
Host [Hostname]
HostName [Hostname]
IdentityFile ~/.ssh/id_rsa
IdentitiesOnly yes
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa
Note: If you are using your organization's bitbucket account, the hostname will be different or else by default it will be bitbucket.org
By this way, it worked:
Host replaceMeByYourGitDomain HostName replaceMeByYourGitDomain User git IdentityFile ~/.ssh/id_rsaenter code here IdentitiesOnly yes PubkeyAcceptedAlgorithms +ssh-rsa HostkeyAlgorithms +ssh-rsa
I had this issue and it turned out to be because my computer was referencing the wrong ssh.exe file.
Run the command:
which ssh.exe
If this does not return OpenSSH/ssh.exe then this is likely your issue.
Take the return value and rename the ssh.exe file as ssh.exe.org
Run
which ssh.exe
again and it should now show the OpenSSH/ssh.exe file.
For macOS, you actually need to edit /etc/ssh/ssh_config instead of .ssh/config. The local config wasn't applied for me.
A concise solution to this: ssh -oHostKeyAlgorithms=+ssh-rsa user@remote.server.com
