Community discussions

MikroTik App
 
sploit
just joined
Topic Author
Posts: 5
Joined: Sat Oct 19, 2013 8:53 pm

OpenSSH7 Unable to negotiate with 192.168.1.1: no matching host key type found. Their offer: ssh-dss

Mon Aug 17, 2015 7:58 pm

Hi All,

Since installing OpenSSH 7 I've been unable to connect to my router though ssh pubkey authentication. Previous versions of OpenSSH still work. This is an issue for automated scripts using ssh.

I always get the following message returned:
OpenSSH7 Unable to negotiate with 192.168.1.1: no matching host key type found. Their offer: ssh-dss

Running RouterOS version: 6.28

Google tells me the following:
OpenSSH 7.0 and greater similarly disables the ssh-dss (DSA) public key algorithm. It too is weak and we recommend against its use. It can be re-enabled using the HostkeyAlgorithms configuration option:
ssh -oHostKeyAlgorithms=+ssh-dss user@127.0.0.1
http://www.openssh.com/legacy.html

But that is not working...

Could you guys possibly implement ssh-rsa?

Thank you for looking into this!
 
kas
just joined
Posts: 2
Joined: Fri Mar 06, 2015 3:34 pm

Re: OpenSSH7 Unable to negotiate with 192.168.1.1: no matching host key type found. Their offer: ssh-dss

Tue Aug 18, 2015 8:55 pm

I also am in favor of supporting ssh-rsa in the next release. For now, you can override OpenSSH's defaults by adding the following two options.
-oHostKeyAlgorithms=+ssh-dss -oPubKeyAcceptedKeyTypes=+dsa 
 
MartijnVdS
Frequent Visitor
Frequent Visitor
Posts: 93
Joined: Wed Aug 13, 2014 9:36 am

Re: OpenSSH7 Unable to negotiate with 192.168.1.1: no matching host key type found. Their offer: ssh-dss

Wed Aug 19, 2015 10:48 am

I also am in favor of supporting ssh-rsa in the next release. For now, you can override OpenSSH's defaults by adding the following two options.
-oHostKeyAlgorithms=+ssh-dss -oPubKeyAcceptedKeyTypes=+dsa 
According to the changelog, 6.31 supports RSA keys if you enable "strong crypto" for SSH (/ip ssh set strong-crypto=yes)
 
sploit
just joined
Topic Author
Posts: 5
Joined: Sat Oct 19, 2013 8:53 pm

Re: OpenSSH7 Unable to negotiate with 192.168.1.1: no matching host key type found. Their offer: ssh-dss

Sun Aug 23, 2015 4:20 pm

I also am in favor of supporting ssh-rsa in the next release. For now, you can override OpenSSH's defaults by adding the following two options.
-oHostKeyAlgorithms=+ssh-dss -oPubKeyAcceptedKeyTypes=+dsa 
According to the changelog, 6.31 supports RSA keys if you enable "strong crypto" for SSH (/ip ssh set strong-crypto=yes)
Just upgraded to 6.31 and tested with an RSA key, seems to be working :)

Who is online

Users browsing this forum: LunaticRv, sindy and 75 guests