I am unable to ssh to a server that asks for a diffie-hellman-group1-sha1 key exchange method:

Unable to negotiate with port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

How to enable the diffie-hellman-group1-sha1 key exchange method on Debian 8.0?

I have tried (as proposed here) to

  1. add the following lines to my /etc/ssh/ssh_config

    KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
    Ciphers 3des-cbc,blowfish-cbc,aes128-cbc,aes128-ctr,aes256-ctr
  2. regenerate keys with

    ssh-keygen -A
  3. restart ssh with

    service ssh restart

    but still get the error.

  • I have the same happening to me with Debian 9. – Rui F Ribeiro Apr 9 '17 at 14:37
  • Try this diffie-hellman-group-exchange-sha256 – Miguel Mar 22 '18 at 16:46
  • 1
    In 2020 and Ubuntu 20 I have solved this problem by installing putty, simply: apt install putty then used putty to connect to old server... – Aleksandar Pavić Aug 25 at 8:36

The OpenSSH website has a page dedicated to legacy issues such as this one. It suggests the following approach, on the client:

ssh -oKexAlgorithms=+diffie-hellman-group1-sha1

or more permanently, adding

    KexAlgorithms +diffie-hellman-group1-sha1

to ~/.ssh/config.

This will enable the old algorithms on the client, allowing it to connect to the server.

| improve this answer | |
  • I also faced this problem today, but that was due to the network. I changed the network and the issue was gone – Luv33preet Jun 14 '17 at 9:59
  • 4
    Tried above, but got Unable to negotiate with port 22222: no matching cipher found. Their offer: aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc,blowfish-cbc – eigenfield Jul 31 '18 at 22:01
  • @ifelsemonkey that’s a different problem, note that the offer you get isn’t the same as the one in the question. – Stephen Kitt Aug 1 '18 at 6:20
  • 8
    Confirmed it was a different problem. I was able to resolve it by adding the following entry into my ~/.ssh/config file. Host and under it Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc. – eigenfield Aug 1 '18 at 17:18
  • -oKexAlgorithms resulted in the same error for me(alghough I'm using git not ssh). but the ~/.ssh/config way worked. – raven Mar 24 at 6:25

I tried this solution, but my problem was that I had many (legacy) clients connecting to my recently upgraded server (ubuntu 14 -> ubuntu 16).

The change from openssh6 -> openssh7 disabled by default the diffie-hellman-group1-sha1 key exchange method.

After reading this and this I came up with the changes I needed to do to the /etc/ssh/sshd_config file:

#Legacy changes
KexAlgorithms +diffie-hellman-group1-sha1
Ciphers +aes128-cbc

But a more wide legacy set of changes is (taken from here)

#Legacy changes
KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
Ciphers 3des-cbc,blowfish-cbc,aes128-cbc,aes128-ctr,aes256-ctr
| improve this answer | |
  • 5
    Hopefully you’ll be able to upgrade your clients at some point, the legacy algorithms were disabled for very good reasons and shouldn’t be re-enabled lightly (you probably realise that, I just thought it worth pointing out for other readers). – Stephen Kitt Jun 14 '17 at 11:10
  • 1
    This works on the server side (unlike the very similar, accepted answer which focused on the client-side.) – knb Sep 15 '17 at 12:50
  • i am trying to use the same to enable the old keys. but since i am a newbie i don't really know what IP to place when i write ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 – Yousi Nov 27 '18 at 8:14
  • To add for future people to find, I was connecting via SSH from a Mac running OpenSSH_7.9p1 to a Cisco 3750 switch running: Cisco IOS Software, C3750 Software (C3750-IPSERVICESK9-M), Version 12.2(55)SE12, RELEASE SOFTWARE (fc2). I added the following to the client config and was able to ssh in: KexAlgorithms +diffie-hellman-group1-sha1 Ciphers +aes128-cbc – DYoung Mar 12 '19 at 4:36
  • For many "internal" servers (where the whole network is locked down to trusted users) diffie-hellman is perfectly sufficient. Disabling it breaks a lot of legacy tools for no good reason, requiring expensive development effort to modify the legacy code that no one has looked at in ages. So having a way to enable it server-side is still valuable. – Hashman Sep 1 at 20:42

I was also facing the same issue but resolved it by executing below command. You can do it without restarting SSH server-


ssh test@
protocol identification string lack carriage return
Unable to negotiate with port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1


ssh -o KexAlgorithms=diffie-hellman-group1-sha1 test@

On other system I have observed that using above command also it was not working. Try adding Ciphers with the command. See full command as below-

root@shoesdekho#ssh -o KexAlgorithms=diffie-hellman-group1-sha1 -o Ciphers=aes256-cbc test@                    
protocol identification string lack carriage return
Warning: Permanently added '' (RSA) to the list of known hosts.

This computer system is restricted to authorized users.
 Unauthorized access attempts will be prosecuted.
 If unauthorized, disconnect now.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.