ssh登录失败：no matching host key type found. Their offer: ssh-dss

问题描述

MAC OS从10.10 Yosemite 升级到 10.12 Sierra后，SSH登录某shell Server失败，提示错误：no matching host key type found. Their offer: ssh-dss。

根本原因

之所以报错是因为OpenSSH 7.0以后的版本不再支持ssh-dss (DSA)算法，官方的说法是这个算法太弱了。

MAC OS升到10.12附带的openssh版本是7.4, 如下：

➜  ~ sshd -V
sshd: illegal option -- V
OpenSSH_7.4p1, LibreSSL 2.5.0
usage: sshd [-46DdeiqTt] [-C connection_spec] [-c host_cert_file]
            [-E log_file] [-f config_file] [-g login_grace_time]
            [-h host_key_file] [-o option] [-p port] [-u len]

解决办法

1. 命令行里添加选项
   ssh -oHostKeyAlgorithms=+ssh-dss user@legacyhost
2. 添加HostKeyAlgorithms +ssh-dss到配置~/.ssh/config

Host somehost.example.org
    HostKeyAlgorithms +ssh-dss

参考

• SSH DSA keys no longer work for password-less authentication