新版ssh客户端无法连接旧版sshd服务器的解决方法

新安装完的windows 版本，ssh连Linux服务器直接报错 no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,kexguess2@matt.ucc.asn.au

C:\\Users\\wang>ssh root@192.168.110.50
Unable to negotiate with 192.168.110.50 port 22: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,kexguess2@matt.ucc.asn.au

这是密钥交换算法不匹配，服务器是较老的、已经被淘汰的算法（diffie-hellman-group14-sha1、diffie-hellman-group1-sha1），而ssh客户端版本较新，禁用了这些不安全的算法。

解决办法：启用不推荐的密钥交换算法:-o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 其中"+"表示追加算法

C:\\Users\\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 root@192.168.110.50
Unable to negotiate with 192.168.110.50 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

又报错了，新版ssh客户端无法匹配服务器的旧版密钥类型(ssh-rsa,ssh-dss)

解决办法：启用不推荐的密钥类型 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss

C:\\Users\\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss root@192.168.110.50
Unable to negotiate with 192.168.110.50 port 22: no matching MAC found. Their offer: hmac-sha1,hmac-md5

还是报错，新版ssh客户端无法匹配服务器的消息认证码（MAC）算法。

解决办法：启用不推荐的MAC算法 -o MACs=+hmac-sha1,hmac-md5

C:\\Users\\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss -o MACs=+hmac-sha1,hmac-md5 root@192.168.110.50
sign_and_send_pubkey: no mutual signature supported
root@192.168.110.50's password:

终于可以连接了。

另一台服务器使用公钥连接，连接时又报了一个新错误 sign_and_send_pubkey: no mutual signature supported 客户端不再兼容服务器的旧版密钥算法

C:\\Users\\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss -o MACs=+hmac-sha1,hmac-md5 root@192.168.110.31
sign_and_send_pubkey: no mutual signature supported
root@192.168.110.31's password:

解决办法： -o PubkeyAcceptedAlgorithms=+ssh-rsa

C:\\Users\\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss -o MACs=+hmac-sha1,hmac-md5 -o PubkeyAcceptedAlgorithms=+ssh-rsa root@192.168.110.31
Last login: Wed Oct 30 12:40:49 2024 from 192.168.110.201
[root@test31 ~]#

到此都能正常连接了。

为了方便以后操作不用每次都输入这么多参数，写一个ssh.bat放在%PATH%目录下，并且设置比ssh.exe所在目录优先级高即可。

ssh.bat

@echo off
ssh.exe -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss -o MACs=+hmac-sha1,hmac-md5 -o PubkeyAcceptedAlgorithms=+ssh-rsa %*

以后用ssh root@192.168.110.31 或者 ssh.bat root@192.168.110.31 即可