How to fix Bad SSH2 Mac spec in SSH

First, determine which SSH version you're running and what MAC algorithms are available:

ssh -V
ssh -Q mac

The ssh -Q mac command lists all valid MAC algorithms supported by your OpenSSH version. Use only these names in your configuration.

Check the MACs line in your SSH configuration file. For clients, this is typically ~/.ssh/config or /etc/ssh/ssh_config. For servers, it's /etc/ssh/sshd_config:

# Check client config
grep -n "MACs" ~/.ssh/config
grep -n "MACs" /etc/ssh/ssh_config

# Check server config (requires root)
sudo grep -n "MACs" /etc/ssh/sshd_config

Look for:
- Typos in algorithm names (e.g., hmac-sha256 should be hmac-sha2-256)
- Incorrect syntax (missing commas between algorithms, spaces in wrong places)
- Algorithm names that don't match the output from ssh -Q mac

Replace the MACs line with algorithms from the supported list. Common valid MAC algorithms include:

hmac-sha2-256
hmac-sha2-512
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Example client configuration (~/.ssh/config or /etc/ssh/ssh_config):

Host *
    MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256

Example server configuration (/etc/ssh/sshd_config):

MACs [email protected],[email protected],hmac-sha2-512,hmac-sha2-256

Note: "etm" (encrypt-then-mac) variants are more secure and recommended.

If you're using the -o MACs=... option on the command line, ensure the syntax is correct:

# WRONG (common mistake)
ssh -o MACs=hmac-sha256 user@host
ssh -o MACs=hmac-sha2-256, hmac-sha1 user@host  # space after comma

# CORRECT
ssh -o MACs=hmac-sha2-256 user@host
ssh -o MACs=hmac-sha2-256,hmac-sha1 user@host  # no spaces

Multiple MACs must be comma-separated with no spaces.

After editing your SSH configuration, validate the syntax:

For client configuration:

ssh -G hostname  # Tests client config parsing

For server configuration (requires root):

sudo sshd -T  # Tests sshd config parsing

If there are syntax errors, the output will highlight the problematic line. Fix any errors and try again.

If you edited the server-side SSH configuration (/etc/ssh/sshd_config), restart the SSH daemon:

# On Linux systems
sudo systemctl restart sshd

# On some systems (macOS, BSD)
sudo /usr/sbin/sshd -t  # Validate config first
sudo launchctl stop com.openssh.sshd
sudo launchctl start com.openssh.sshd

Always validate the configuration with sudo sshd -T before restarting to avoid locking yourself out.

If you're unsure which MACs to use, either:

1. Remove the MACs line entirely to use OpenSSH defaults (recommended):

# In your config file, delete or comment out the MACs line
   # The system will use secure defaults automatically

2. Append to defaults instead of replacing them by prefixing with +:

MACs +hmac-sha1  # Adds hmac-sha1 to the default set

3. Remove specific algorithms by prefixing with -:

MACs -hmac-sha1  # Removes hmac-sha1 from defaults

This is safer than manually specifying all MACs, as OpenSSH defaults are kept up-to-date by the developers.