How to fix Unable to negotiate with hostname port 22: no matching MAC found. in SSH

First, identify what MAC algorithms the server is offering. Look at the error message—it includes 'Their offer:' which lists available algorithms:

Unable to negotiate with server.example.com port 22: no matching MAC found. Their offer: hmac-sha1,hmac-sha1-96,hmac-md5

This tells you the server only supports weak or deprecated algorithms. You can also query your client's supported algorithms:

ssh -Q mac

This shows all MACs your SSH client supports (in preference order).

To quickly connect without modifying configuration, specify a compatible MAC algorithm on the command line:

ssh -m hmac-sha1 [email protected]

Replace hmac-sha1 with one of the algorithms from the server's offer. This is useful for occasional connections to legacy systems but not recommended for permanent setups.

You can also enable multiple algorithms:

ssh -m hmac-sha1,hmac-sha1-96 [email protected]

For permanent solutions, edit your SSH client config file. Create or edit ~/.ssh/config (Linux/Mac) or %userprofile%\.ssh\config (Windows):

Host legacy-server
    HostName server.example.com
    User myusername
    MACs +hmac-sha1

The + prefix appends the algorithm to the default set (safer than replacing all algorithms). Connect using:

ssh legacy-server

For multiple weak algorithms:

Host legacy-server
    HostName server.example.com
    User myusername
    MACs +hmac-sha1,hmac-sha1-96,hmac-md5
    KexAlgorithms +diffie-hellman-group1-sha1
    HostKeyAlgorithms +ssh-rsa

Note: You may also need to add KexAlgorithms and HostKeyAlgorithms if the server is very old.

If you need to connect to multiple legacy servers, update the global SSH config. Edit /etc/ssh/ssh_config (Linux/Mac, requires sudo) or create a user-specific config:

For a specific group of weak servers, add at the end of ~/.ssh/config:

Host legacy-*
    MACs +hmac-sha1,hmac-sha1-96
    KexAlgorithms +diffie-hellman-group1-sha1
    HostKeyAlgorithms +ssh-rsa

Then any host matching legacy-* will use these settings. For example:

ssh legacy-server1
ssh legacy-server2

This avoids applying weak algorithms globally and keeps them restricted to hosts that need them.

The best long-term solution is to upgrade the SSH server to a modern version that supports contemporary algorithms. On the remote server:

For Linux/Unix servers:

# Update system packages
sudo apt-get update && sudo apt-get upgrade  # Debian/Ubuntu
sudo yum update -y  # RHEL/CentOS

# Check OpenSSH version
ssh -V

# Update SSH server if available through package manager
sudo systemctl restart ssh  # or sshd

For older systems that don't support modern MACs:

Consider upgrading to a current OS version. Most production servers should run:
- OpenSSH 7.4+ for basic support of modern algorithms
- OpenSSH 8.0+ for best security practices

This eliminates the need for client-side workarounds and improves overall security.

If you're using SCP or SFTP instead of interactive SSH, apply the same fixes:

# One-time SCP with specific MAC
scp -m hmac-sha1 file.txt [email protected]:/destination/

# Using SSH config with Host entry
scp file.txt legacy-server:/destination/

# For SFTP
sftp -m hmac-sha1 [email protected]

SCP and SFTP use the same SSH protocol underneath, so algorithm negotiation rules are identical.