How to enable diffie-hellman-group1-sha1 key exchange on Debian 8.0?

Question

I am unable to ssh to a server that asks for a diffie-hellman-group1-sha1 key exchange method:

ssh 123.123.123.123
Unable to negotiate with 123.123.123.123 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

How to enable the diffie-hellman-group1-sha1 key exchange method on Debian 8.0?

I have tried (as proposed here) to

1. add the following lines to my /etc/ssh/ssh_config

   KexAlgorithms diffie-hellman-group1-sha1,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
   Ciphers 3des-cbc,blowfish-cbc,aes128-cbc,aes128-ctr,aes256-ctr
   

2. regenerate keys with

   ssh-keygen -A
   

3. restart ssh with

   service ssh restart
   

   but still get the error.

Answer 1

The OpenSSH website has a page dedicated to legacy issues such as this one. It suggests the following approach, on the client:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 123.123.123.123

or more permanently, adding

Host 123.123.123.123
    KexAlgorithms +diffie-hellman-group1-sha1

to ~/.ssh/config.

This will enable the old algorithms on the client, allowing it to connect to the server.

Answer 2

I tried this solution, but my problem was that I had many (legacy) clients connecting to my recently upgraded server (ubuntu 14 -> ubuntu 16).

The change from openssh6 -> openssh7 disabled by default the diffie-hellman-group1-sha1 key exchange method.

After reading this and this I came up with the changes I needed to do to the /etc/ssh/sshd_config file:

#Legacy changes
KexAlgorithms +diffie-hellman-group1-sha1
Ciphers +aes128-cbc

But a more wide legacy set of changes is (taken from here)

#Legacy changes
KexAlgorithms diffie-hellman-group1-sha1,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers 3des-cbc,blowfish-cbc,aes128-cbc,aes128-ctr,aes256-ctr

Answer 3

I was also facing the same issue but resolved it by executing below command. You can do it without restarting SSH server-

Problem:

ssh [email protected]
protocol identification string lack carriage return
Unable to negotiate with 123.123.123.123 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1
root@shoesdekho#

Solution:

ssh -o KexAlgorithms=diffie-hellman-group1-sha1 [email protected]

On other system I have observed that using above command also it was not working. Try adding Ciphers with the command. See full command as below-

root@shoesdekho#ssh -o KexAlgorithms=diffie-hellman-group1-sha1 -o Ciphers=aes256-cbc [email protected]                    
protocol identification string lack carriage return
Warning: Permanently added '123.123.123.123' (RSA) to the list of known hosts.
Password:


This computer system is restricted to authorized users.
 Unauthorized access attempts will be prosecuted.
 If unauthorized, disconnect now.

bookmiday#

Answer 4

problem01:

“Unable to negotiate with xxxx port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1”

solution01:

vim ~/.ssh/config and adding:

Host *
    KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

problem02:

“no matching host key type found. their offer: ssh-rsa”

solution02:

vim ~/.ssh/config and adding:

Host * 
    PubkeyAcceptedAlgorithms +ssh-rsa 
    HostKeyAlgorithms +ssh-rsa 

Answer 5

If you want to be done with the headaches forever, never to ever have to worry or contend with this again, append this to the end of your /etc/ssh/ssh_config file:

Ciphers 3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected],[email protected]
MACs hmac-sha1,hmac-sha1-96,hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-md5-96,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,[email protected],[email protected],[email protected],ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected]
KexAlgorithms diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,curve25519-sha256,[email protected],[email protected]

This comes with the usual warnings from others here... Whaaa the sky is falling you so insecure. Whaaa.... To such people, I say keep your negativity and unhelpful comments to yourself. We're all professionals here. We know what the risks are of using deprecated ciphers and key exchanges. Sometimes there are use cases, like accessing end-of-life or old systems.

BTW, the above can be limited to specific hosts if desired. Not a bad idea, but that is up to you. What you do with the power and capability gained from the above is now your responsibility to exercise judiciously.