How to fix Bad SSH2 Mac spec in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 201 views

This error occurs when the SSH client or server specifies an invalid or unsupported Message Authentication Code (MAC) algorithm in its configuration. It typically indicates a typo, deprecated algorithm, or incompatible SSH version.

Quick fix

Fixes Bad SSH2 Mac spec

ssh -V
ssh -Q mac
  1. Check OpenSSH version and available MACs
  2. Review your SSH configuration for typos
  3. Use only valid MAC algorithm names
  4. Fix command-line MAC specification
ssh — error
ssh -V
ssh -Q mac
Bad SSH2 Mac spec

What this error means

SSH uses Message Authentication Codes (MACs) to ensure data integrity during communication. The "Bad SSH2 Mac spec" error means the SSH client or server encountered an invalid MAC algorithm specification in the configuration file. This can happen when: the MAC algorithm name contains a typo, an algorithm has been removed in newer OpenSSH versions, the configuration syntax is incorrect, or you're mixing incompatible SSH versions. The SSH handshake fails before any connection is established because the configuration is malformed.

Typical symptoms

  • SSH connection fails immediately with 'Bad SSH2 Mac spec' in the error message
  • Error appears in SSH configuration parsing, before any network connection attempt
  • Manual SSH command-line connections fail when using -o MACs=... option
  • Error occurs right after updating OpenSSH or modifying SSH configuration files
  • Connections work from other systems but fail on this one
  • Error message may reference specific config line number if from sshd

Common causes

  1. Typo in MAC algorithm name (e.g., 'hmac-sha256' instead of 'hmac-sha2-256')
  2. Using deprecated or removed MAC algorithm names (some algorithms removed in OpenSSH 7.1+)
  3. Incorrect syntax in MACs configuration line (missing commas, extra spaces, etc.)
  4. MAC algorithm name doesn't exist in the OpenSSH version being used
  5. Mixing old and new algorithm naming conventions in the same MACs list
  6. Using algorithm names from different OpenSSH versions in the configuration
  7. Configuration file has wrong line format (space instead of = sign, etc.)

How to fix "Bad SSH2 Mac spec"

1Check OpenSSH version and available MACs

First, determine which SSH version you're running and what MAC algorithms are available:

bash
ssh -V
ssh -Q mac

The ssh -Q mac command lists all valid MAC algorithms supported by your OpenSSH version. Use only these names in your configuration.

2Review your SSH configuration for typos

Check the MACs line in your SSH configuration file. For clients, this is typically ~/.ssh/config or /etc/ssh/ssh_config. For servers, it's /etc/ssh/sshd_config:

bash
# Check client config
grep -n "MACs" ~/.ssh/config
grep -n "MACs" /etc/ssh/ssh_config

# Check server config (requires root)
sudo grep -n "MACs" /etc/ssh/sshd_config

Look for:
- Typos in algorithm names (e.g., hmac-sha256 should be hmac-sha2-256)
- Incorrect syntax (missing commas between algorithms, spaces in wrong places)
- Algorithm names that don't match the output from ssh -Q mac

3Use only valid MAC algorithm names

Replace the MACs line with algorithms from the supported list. Common valid MAC algorithms include:

bash
hmac-sha2-256
hmac-sha2-512
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com
umac-128@openssh.com
umac-128-etm@openssh.com
umac-64@openssh.com
umac-64-etm@openssh.com

Example client configuration (~/.ssh/config or /etc/ssh/ssh_config):

bash
Host *
    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

Example server configuration (/etc/ssh/sshd_config):

bash
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256

Note: "etm" (encrypt-then-mac) variants are more secure and recommended.

4Fix command-line MAC specification

If you're using the -o MACs=... option on the command line, ensure the syntax is correct:

bash
# WRONG (common mistake)
ssh -o MACs=hmac-sha256 user@host
ssh -o MACs=hmac-sha2-256, hmac-sha1 user@host  # space after comma

# CORRECT
ssh -o MACs=hmac-sha2-256 user@host
ssh -o MACs=hmac-sha2-256,hmac-sha1 user@host  # no spaces

Multiple MACs must be comma-separated with no spaces.

5Validate SSH configuration syntax

After editing your SSH configuration, validate the syntax:

For client configuration:

bash
ssh -G hostname  # Tests client config parsing

For server configuration (requires root):

bash
sudo sshd -T  # Tests sshd config parsing

If there are syntax errors, the output will highlight the problematic line. Fix any errors and try again.

6Restart SSH service if you modified sshd_config

If you edited the server-side SSH configuration (/etc/ssh/sshd_config), restart the SSH daemon:

bash
# On Linux systems
sudo systemctl restart sshd

# On some systems (macOS, BSD)
sudo /usr/sbin/sshd -t  # Validate config first
sudo launchctl stop com.openssh.sshd
sudo launchctl start com.openssh.sshd

Always validate the configuration with sudo sshd -T before restarting to avoid locking yourself out.

7If unsure, use default or append to defaults

If you're unsure which MACs to use, either:

1. Remove the MACs line entirely to use OpenSSH defaults (recommended):

bash
# In your config file, delete or comment out the MACs line
   # The system will use secure defaults automatically

2. Append to defaults instead of replacing them by prefixing with +:

bash
MACs +hmac-sha1  # Adds hmac-sha1 to the default set

3. Remove specific algorithms by prefixing with -:

bash
MACs -hmac-sha1  # Removes hmac-sha1 from defaults

This is safer than manually specifying all MACs, as OpenSSH defaults are kept up-to-date by the developers.

Advanced notes

Advanced troubleshooting:

OpenSSH Version Differences: Algorithm support varies significantly across OpenSSH versions. OpenSSH 7.1 and later removed several older algorithms (md5, sha1 without "etm" suffix). If upgrading OpenSSH on a legacy system, older MACs configuration lines may become invalid.

EtM vs Non-EtM Algorithms: Algorithms with "-etm" suffix (encrypt-then-mac) calculate the MAC after encryption, making them more secure against certain attacks. Modern OpenSSH prioritizes these. If you need backward compatibility with older systems, you may need to add non-etm variants.

Debugging SSH Parsing: Enable verbose logging to see exactly where configuration parsing fails:

bash
ssh -vvv user@host  # Shows configuration parsing in verbose output
sudo sshd -d        # Server debug mode shows config errors on startup

Legacy Systems: If connecting to very old SSH servers/clients, you may need less secure algorithms. The trade-off between security and compatibility should be documented and justified. Consider upgrading the legacy system instead if possible.

ProxyCommand and Nested Configs: If using ProxyCommand in SSH config, note that nested SSH invocations may use different MACs settings. Ensure consistency across your proxy chain.

Frequently asked questions

What does "Bad SSH2 Mac spec" mean?
SSH uses Message Authentication Codes (MACs) to ensure data integrity during communication. The "Bad SSH2 Mac spec" error means the SSH client or server encountered an invalid MAC algorithm specification in the configuration file. This can happen when: the MAC algorithm name contains a typo, an algorithm has been removed in newer OpenSSH versions, the configuration syntax is incorrect, or you're mixing incompatible SSH versions.
How do I fix "Bad SSH2 Mac spec"?
This error occurs when the SSH client or server specifies an invalid or unsupported Message Authentication Code (MAC) algorithm in its configuration. It typically indicates a typo, deprecated algorithm, or incompatible SSH version.
What causes "Bad SSH2 Mac spec"?
Typo in MAC algorithm name (e.g., 'hmac-sha256' instead of 'hmac-sha2-256') Using deprecated or removed MAC algorithm names (some algorithms removed in OpenSSH 7.1+) Incorrect syntax in MACs configuration line (missing commas, extra spaces, etc.)
Is the "Bad SSH2 Mac spec" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading