Today a customer contacted me because he has upgraded his MacBook to MacOS X Sierra and since then, when trying to access a switch via SSH he got the message

Unable to negotiate with 10.XX.XX.XX port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

The switch is a Cisco 2960S running IOS 12.2(55)SE7 (C2960S-UNIVERSALK9-M)

I looked at the command reference guide for this version, but was unable to find any command to configure SSH ciphers. (we can only configure SSH version 1 / 2 or both)

Is it possible with this version?

P.S. Yes I'm aware that he should use RSA key authentication, and upgrade the IOS version, I recommended it but this will need some testing and change management.

  • 3
    Not sure you can fix this (other than upgrading the software), there's a workaround on the client side though: ssh -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 $HOST
    – Teun Vink
    Commented Sep 28, 2016 at 8:45

1 Answer 1


As stated by @Teun Vink in comment, no way to do so but the given workaround using

ssh -oHostKeyAlgorithms=+ssh-dss -oKexAlgorithms=+diffie-hellman-group1-sha1 $HOST

do the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.