229

I get the following error when using git:

$ git pull
Unable to negotiate with 172.16.42.42 port 22: no matching host key type found. Their offer: ssh-rsa
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

How can I resolve this error?

1

18 Answers 18

416

With SSH, there are several different types of keys and RSA keys (the ssh-rsa) kind can support multiple kinds of signatures. The signature type ssh-rsa refers to RSA with SHA-1, whereas the signature type rsa-sha2-256 is RSA with SHA-256 and rsa-sha2-512 is RSA with SHA-512.

In the case of Azure DevOps, it only supports the kind of RSA with SHA-1, and SHA-1 is considered very weak. This essentially means that there are no secure ways to connect to it over SSH, and until they fix that, you're better off using HTTPS or a different hosting service. GitHub, GitLab, and Bitbucket all support secure methods of authentication.

If you really need to use SSH with Azure DevOps at the moment, you can add an entry to your ~/.ssh/config file to work around this:

Host ssh.dev.azure.com
    User git
    PubkeyAcceptedAlgorithms +ssh-rsa
    HostkeyAlgorithms +ssh-rsa

However, be aware that this is a workaround and it's known to be insecure, so you should contact Azure DevOps about this problem and switch to HTTPS until they do, or move elsewhere.

8
  • And it maybe worth checking every season or two and removing if the host is ever updated to support better cyphers.
    – Tomachi
    Commented Jan 10, 2022 at 10:50
  • 4
    I got this issue after Cygwin's git updated 2.32 => 2.34, this answer fixed it, thank you!
    – okharch
    Commented Jan 11, 2022 at 6:04
  • This helped a colleague with a very recent Git installation, connecting to Azure DevOps Server 2020u1. Others on the team do not need it yet, so this is likely something new in Git. DevOps docs already have a FAQ about this issue.
    – Palec
    Commented Jan 17, 2022 at 21:02
  • 2
    Unfortunately putting this option to ~/.ssh/config might break other software relying on older OpenSSH. I ended up using a deprecated name PubkeyAcceptedKeyTypes instead of PubkeyAcceptedAlgorithms (as mentioned here).
    – Nickolay
    Commented Feb 12, 2022 at 13:53
  • 1
    This fixed the same issue I had with a self-hosted bitbucket server that had not been updated in a while. They list the same solution on their forum. Commented Jun 20, 2022 at 1:43
104

OpenSSH will report the error no matching host key type found. Their offer: ssh-rsa if the server it's connecting to is offering to authenticate over ssh-rsa ( RSA/SHA1).

Azure Devops (TFS) is offering to authenticate over ssh-rsa. As noted in the answer by bk2204, this algorithm is not considered cryptographically secure.

Since it's considered weak, OpenSSH deprecated using SHA-1 in 8.2 in 2020-02-14.

It is now possible[1] to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm that depends on SHA-1 by default in a near-future release.

Azure Devops Services subsequently announced a patch to allow SHA-2

On may 5 2021, the Azure DevOps documentation was updated to mention using RSA 3072.

Q: Is this true?

¯\_(ツ)_/¯

Q: Which algorithms are supported?

Doesn't say anywhere. Probably only ssh-rsa.

Q: How do I use a cryptographically unsafe algorithm

Add this

  HostkeyAlgorithms +ssh-rsa
  PubkeyAcceptedAlgorithms +ssh-rsa

To your ~/.ssh/config

Host your-azure-devops-domain
  IdentityFile ~/.ssh/id_rsa
  IdentitiesOnly yes
  HostkeyAlgorithms +ssh-rsa
  PubkeyAcceptedAlgorithms +ssh-rsa

Q: Is Microsoft aware that this is a problem?

Yes they are.

Q: Do they care?

No it's a feature

2
  • 4
    Thanks! This did the trick for me after updating to Ubuntu 22.04.
    – abaga129
    Commented Jul 5, 2022 at 17:33
  • 6
    As of 2022-08-01, ssh-rsa is still what is used by Azure DevOps Services, so their claim of patching it in 2020 is false.
    – Sharparam
    Commented Aug 1, 2022 at 13:24
64

According to this post, you can add ssh.dev.azure.com host config to your ~/.ssh/config file:

Final ~/.ssh/config that worked for me:

Host ssh.dev.azure.com
    HostName ssh.dev.azure.com
    User git
    IdentityFile ~/.ssh/id_rsa
    IdentitiesOnly yes
    PubkeyAcceptedAlgorithms +ssh-rsa
    HostkeyAlgorithms +ssh-rsa
3
  • 4
    IdentitiesOnly yes PubkeyAcceptedAlgorithms +ssh-rsa HostkeyAlgorithms +ssh-rsa Faced same issue after CodeCommit setup, pasting above 3 lines successfully authenticated git over SSH, Thanks! Commented Dec 2, 2021 at 9:14
  • but I'm still stuck. It was all working and suddenly stopped connecting codecommit.. Commented May 13, 2022 at 17:05
  • 3
    This also works for HostNames like vs-ssh.visualstudio.com
    – elulcao
    Commented May 31, 2022 at 16:19
55

scp or ssh could used this

ssh -p 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa  user@myhost
# or scp
scp -P 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa  user@myhost
4
  • ssh-keygen -f "/home/qmm0/.ssh/known_hosts" -R "[10.0.0.28]:2222";ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa 10.0.0.28 -p 2222
    – CS QGB
    Commented Jul 10, 2022 at 14:50
  • SFTP: sftp -P 22 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa user@myhost Commented Feb 12, 2023 at 16:46
  • thank you for this! this also works on mac ventura 13.4
    – woninana
    Commented Jun 29, 2023 at 18:07
  • This answer is nice if you want to solve the problem once, or temporarily, while you're investigating or implementing a permanent server-side fix. In the past I've modified .ssh/config with workarounds, and then had to debug secondary issues later on.
    – rob
    Commented Dec 4, 2023 at 19:01
21

For those using Azure DevOps, you should use the following ~/.ssh/config, as Azure has a thing with varying what url it returns in its Clone Repository:

Host ssh.dev.azure.com
  PubkeyAcceptedAlgorithms +ssh-rsa
  HostkeyAlgorithms +ssh-rsa

Host vs-ssh.visualstudio.com
  PubkeyAcceptedAlgorithms +ssh-rsa
  HostkeyAlgorithms +ssh-rsa
15

In your ~/.ssh/config file, add these lines.

Host *.drush.in
    HostkeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa
13

There are 2 steps:

  1. Add config file (without extension) to your ~/.ssh/ directory.

  2. Add below content to the config file:

    HostkeyAlgorithms +ssh-rsa    
    PubkeyAcceptedAlgorithms +ssh-rsa
    
1
  • This fixed it for me, just adding those 2 lines in ~/.ssh/config fixed my use case after updating to Sonoma (on Mac). Commented Oct 2, 2023 at 17:19
10

I also got this problem, this worked for me:

cd ~/.ssh/
vim config

Host [Hostname]
User [User]
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa

I got this problem for a few hostnames so now i have several of those configurations in my ssh config file.

1
  • and identity file? Commented May 13, 2022 at 17:54
5

With NixOS 21.11 openSSH got updated to 8.8p1 ( see Changelog ). OpenSSH deprecated ssh-rsa along with a couple of other insecure ciphers.

If i understood correctly, you are only using nix as package manager and not NixOS. If that is the case you can follow the guides in the remaining answers (edit ~/.ssh/config).

However, when you are using NixOS to configure your server you can re-enable ssh-rsa for the ssh client, by adding to your configuration.nix:

programs.ssh.extraConfig = ''
  PubkeyAcceptedAlgorithms +ssh-rsa
  HostkeyAlgorithms +ssh-rsa
''

To re-enable the insecure ssh-rsa cipher for your openssh server (e.g. when legacy clients connect to the server), you can simply add the following lines to your configuration.nix:

services.openssh.extraConfig = ''
  PubkeyAcceptedAlgorithms +ssh-rsa
  HostkeyAlgorithms +ssh-rsa
'';
2
  • 1
    Thanks, that was exactly what I needed. Unfortunately, the services.openssh stanza has two typos (transposed letters). I think it needs to be "PubkeyAcceptedAlgorithms", just like in the programs.ssh stanza.
    – antifuchs
    Commented Jan 6, 2022 at 23:45
  • @antifuchs thanks, i've updated my response.
    – makefu
    Commented Feb 2, 2022 at 18:14
4

Correction for the posted answer. I had the same issue and I fixed it with the following snippet from above with a tiny fix:

Host YOUR-DOMAIN
Hostname YOUR-DOMAIN
IdentityFile ~/.ssh/id_rsa
IdentitiesOnly yes
HostKeyAlgorithms=+ssh-rsa
PubkeyAcceptedAlgorithms=+ssh-rsa

Dont forget to replace YOUR-DOMAIN with the domain you are using on AzureDevOps.

2

The format of the workaround wasn't working for me for windows 10 and git version 2.32.0. This snippet worked for me

Host = Hostname.com
IdentityFile = ~/.ssh/id_rsa
IdentitiesOnly = yes
HostkeyAlgorithms = +ssh-rsa
PubkeyAcceptedAlgorithms = +ssh-rsa

2

I googled a lot a bout this mistake: I have Ubuntu 22.04 and here all my configuration.
I hope it will help someone.

linux@linux:~$ cat /home/username/.ssh/config

Host *

KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512
Ciphers aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr

User username # it depends on your login; this one only for understanding

PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa

And:

/etc/ssh/sshd_config

# Ciphers and keying

Ciphers             aes128-cbc,3des-cbc
KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512

HostkeyAlgorithms ssh-dss,ssh-rsa
KexAlgorithms diffie-hellman-group1-sha1
1

I also faced this issue on my windows machine while setting up the SSH key for bitbucket

Initially, the config file was not created when I generated the public and private key files using the ssh-keygen command, so I used GitBash to create the config file and wrote the below content on it.

To create the file

touch config

To open and update the created file

nano config

Content added to the config file

Host [Hostname]
   HostName [Hostname]
   IdentityFile ~/.ssh/id_rsa
   IdentitiesOnly yes
   PubkeyAcceptedAlgorithms +ssh-rsa
   HostkeyAlgorithms +ssh-rsa

Note: If you are using your organization's bitbucket account, the hostname will be different or else by default it will be bitbucket.org

1

By this way, it worked:

  • Open terminal: cd ~/.ssh/
  • Create config file: vim config
  • Next steps you can use VIM to input the config file or use my way:
  • Open Finder/ Go to Folder/ type: ~/.ssh
  • Open the config file by TextEdit or SublimeText
  • Paste the following code

Host replaceMeByYourGitDomain HostName replaceMeByYourGitDomain User git IdentityFile ~/.ssh/id_rsaenter code here IdentitiesOnly yes PubkeyAcceptedAlgorithms +ssh-rsa HostkeyAlgorithms +ssh-rsa

1

A concise solution to this: ssh -oHostKeyAlgorithms=+ssh-rsa [email protected]

0
0

I had this issue and it turned out to be because my computer was referencing the wrong ssh.exe file.

Run the command:

which ssh.exe

If this does not return OpenSSH/ssh.exe then this is likely your issue.

Take the return value and rename the ssh.exe file as ssh.exe.org

Run

which ssh.exe

again and it should now show the OpenSSH/ssh.exe file.

-1

For macOS, you actually need to edit /etc/ssh/ssh_config instead of .ssh/config. The local config wasn't applied for me.

1
  • Not true on my mac. Not sure how yours is setup. I am on the latest (Sonoma) and changing ~/.ssh/config worked for me. Commented Oct 2, 2023 at 17:18
-1

You just need to add it:

HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa

At your ~/.ssh/config

Enjoy. ;)

1
  • This was already mentioned in the various other answers. Commented Sep 4 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.