MacOS – SSH no longer works after update to 10.12.4

macosssh

I've been successfully using the following script to initiate port forwarding for the last year or so:

ssh-add -K ~/.ssh/id_rsa
ssh -f admin@ssh.mydomain.com -L 50003:inst3:3389 -N -p 33233
ssh -f admin@ssh.mydomain.com -L 50005:inst5:3389 -N -p 33233
ssh -f admin@ssh.mydomain.com -L 50006:inst6:3389 -N -p 33233

Immediately after running today's OS update to 10.12.4, running this same script generates the following error:

Unable to negotiate with [my routable IP] port 33233: no matching host key type found. Their offer: ssh-dss

Some articles indicated that the problem could be resolved by editing ssh_config and uncommenting a particular line. This approach hasn't worked. I'm still locked out of SSH. For reference, here's a copy of my ssh_config file:

# Host *
#   ForwardAgent no
#   ForwardX11 no
#   RhostsRSAAuthentication no
#   RSAAuthentication yes
#   PasswordAuthentication yes
#   HostbasedAuthentication no
#   GSSAPIAuthentication no
#   GSSAPIDelegateCredentials no
#   BatchMode no
#   CheckHostIP yes
#   AddressFamily any
#   ConnectTimeout 0
#   StrictHostKeyChecking ask
#   IdentityFile ~/.ssh/identity
#   IdentityFile ~/.ssh/id_rsa
#   IdentityFile ~/.ssh/id_dsa
#   IdentityFile ~/.ssh/id_ecdsa
#   IdentityFile ~/.ssh/id_ed25519
#   Port 22
#   Protocol 2
#   Cipher 3des
#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
#   EscapeChar ~
#   Tunnel no
#   TunnelDevice any:any
#   PermitLocalCommand no
#   VisualHostKey no
#   ProxyCommand ssh -q -W %h:%p gateway.example.com
#   RekeyLimit 1G 1h

I tried uncommenting the line beginning with "MACs hmac-…" but this made no difference. What shall I try next?

Best Answer

no matching host key type found. Their offer: ssh-dss

This error says that the remote server is offering only DSA host key. This is considered weak these days with fixed length of 1024 bits. You should update the server and set up different keys (RSA).

As a workaround, you can use HostKeyAlgorithms +ssh-dss in ~/.ssh/config, which will allow you to connect to this server, exactly as described in the official documentation for legacy algorithms in OpenSSH.

Related Question