The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If SSH refuses an ssh-dss key, the key may be valid but blocked by modern OpenSSH policy. OpenSSH 7.0 and later disable the legacy DSA algorithm by default. The correct fix depends on which key is being rejected: use HostKeyAlgorithms when the server offers an old DSA host key, and use PubkeyAcceptedAlgorithms—called PubkeyAcceptedKeyTypes on older releases—when a user’s DSA key is being rejected for login.
Add +ssh-dss only for the one legacy connection you need, then replace the DSA key or upgrade the remote system. DSA uses a 160-bit private key with SHA-1 and is estimated by OpenSSH at only about 80-bit symmetric-equivalent security, so a compatibility exception should not become your permanent configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What an ssh-dss refusal actually means
ssh-dss is the SSH public-key algorithm name for DSA. It can describe either a server’s host key or a user’s authentication key, and those are separate stages of an SSH connection.
Modern OpenSSH disables DSA by default because its 160-bit private key and SHA-1 signatures provide a low security margin. OpenSSH describes the resulting strength as approximately 80-bit symmetric-equivalent security. A DSA public key can still be present in ~/.ssh/authorized_keys and remain unusable: the file proves that the key is installed, but the SSH daemon’s algorithm policy can still reject it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Stage | What is being proved | Typical failure text | Relevant setting |
|---|---|---|---|
| Host-key negotiation | The server proves its identity to the client | Unable to negotiate ... no matching host key type found. Their offer: ssh-dss |
HostKeyAlgorithms on the client |
| User-key authentication | Your account proves its identity to the server | no mutual signature algorithm, or a public key that is offered and then refused |
PubkeyAcceptedAlgorithms; older releases call it PubkeyAcceptedKeyTypes |
Do not substitute one directive for the other. Allowing a DSA host key does not make a DSA user key acceptable, and allowing a DSA user signature does not make a server’s DSA host key negotiable.
First identify which side is failing
Read the first algorithm-related error in the SSH output. Run the connection with verbosity when the normal message is ambiguous:
ssh -vv user@legacyhostLook for whether the failure occurs while choosing the server host key or later, when the client offers your account key. The distinction determines both the setting and where it must be changed.
Signs of a host-key negotiation failure
- The message says “no matching host key type found.”
- The server’s offer is explicitly listed as
ssh-dss. - The failure happens before password or public-key authentication begins.
Signs of a user-key authentication failure
- The server is reachable and its host key is accepted, but your login key is rejected.
- Verbose output shows your DSA key being offered, followed by “no mutual signature algorithm” or an authentication failure.
- The DSA public key is present in
authorized_keys, yet the daemon’s accepted-signature policy excludes it.
Allowing an old DSA host key for one connection
When the remote machine presents only a DSA host key, add ssh-dss to the client’s host-key algorithm list for that connection:
ssh -o HostKeyAlgorithms=+ssh-dss user@legacyhostThe leading plus sign is important. It appends DSA to the normal defaults instead of replacing the complete list. Modern algorithms therefore remain preferred whenever the server offers them.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Put the exception in a host-specific SSH config block
For repeated access, edit the client’s ~/.ssh/config and scope the exception to the exact legacy host:
Host legacyhost
HostKeyAlgorithms +ssh-dssUse the same host alias in your command, or replace legacyhost with the hostname pattern you actually use. Do not put this line under Host *; a wildcard would make every connection willing to negotiate DSA.
Check the host key before accepting it
Enabling a legacy algorithm does not verify that you are talking to the intended machine. Compare the host-key fingerprint with a trusted console, administrator record, or other out-of-band source before accepting a new key. A compatibility option should never be used as a reason to skip host-key verification.
Allowing a DSA user key for authentication
If the server’s identity negotiation succeeds but your DSA login key is rejected, the relevant algorithm list is PubkeyAcceptedAlgorithms. OpenSSH releases before the option was renamed use PubkeyAcceptedKeyTypes.
Determine the option spelling supported by your client
Query the effective configuration rather than guessing from an online example:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -G user@legacyhost | grep -Ei 'hostkeyalgorithms|pubkeyaccepted(algorithms|keytypes)'If the installed client recognizes the modern spelling, use PubkeyAcceptedAlgorithms. If it reports an unknown option, use the older PubkeyAcceptedKeyTypes spelling.
Use a one-time client exception when appropriate
For a client-side policy that needs to include DSA for a single invocation, append it rather than replacing the defaults:
ssh -o PubkeyAcceptedAlgorithms=+ssh-dss user@legacyhostOn older clients, the equivalent spelling is:
ssh -o PubkeyAcceptedKeyTypes=+ssh-dss user@legacyhostThe exact location of the policy matters. The client option controls the public-key algorithms the client is prepared to use or accept during authentication. The SSH daemon must also permit DSA signatures for the account key; a client-only change cannot override a server that rejects ssh-dss.
Configure the SSH daemon only when you control the server
On the server, the corresponding setting belongs in sshd_config. Use the spelling supported by that server’s OpenSSH version:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPubkeyAcceptedAlgorithms +ssh-dssor, on an older release:
PubkeyAcceptedKeyTypes +ssh-dssPlace the exception in a narrowly scoped host or user policy where your operating system supports that form, validate the configuration with the platform’s SSH daemon test command, and reload the daemon according to the system’s service manager. A reload is preferable to an unnecessary restart because it avoids dropping established sessions. Existing sessions can give you a recovery path if a configuration edit is rejected.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you do not administer the server, ask its administrator to enable the legacy algorithm temporarily or, preferably, to replace the key and upgrade the software. Editing your local authorized_keys file cannot change the daemon’s accepted-algorithm policy.
Why the plus sign is safer than replacing the list
OpenSSH algorithm options accept list modifiers. A value beginning with + adds the named algorithm to the compiled default set. Without the plus sign, a value can replace the defaults, potentially removing modern algorithms and changing negotiation behavior for more than the one legacy endpoint.
| Configuration | Effect | Recommended use |
|---|---|---|
HostKeyAlgorithms +ssh-dss |
Adds DSA host-key support while retaining normal host-key algorithms | One named legacy host |
PubkeyAcceptedAlgorithms +ssh-dss |
Adds DSA user-signature support while retaining normal algorithms | Temporary authentication exception |
Host * with either setting |
Applies the weak exception broadly | Avoid |
A list without + |
Can replace the defaults rather than extend them | Use only when you intentionally manage the entire list |
A command-line -o option is the narrowest test. A named Host block is convenient for a documented, temporary exception. A global wildcard is the least constrained choice.
Recommended Free Tools
Inspect what your OpenSSH client will really use
List supported key types
Run:
ssh -Q keyThis lists key types supported by the installed SSH client. It confirms whether the binary knows about DSA at all, but support in the binary does not mean the algorithm is enabled by default.
Print the effective configuration for a host
Run:
ssh -G user@legacyhost | grep -Ei 'hostkeyalgorithms|pubkeyaccepted(algorithms|keytypes)'ssh -G expands the configuration after host matching and command-line overrides. It is useful for finding an unexpected wildcard block, a misspelled option, or an option inherited from another included configuration file.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Use verbose output after changing one setting
Repeat the connection with -vv or -vvv. Confirm that the intended DSA algorithm appears at the negotiation stage you are fixing. If the host-key negotiation now succeeds but authentication still fails, stop changing HostKeyAlgorithms and investigate the user-key policy instead.
Old and new option names
The option was renamed to reflect current terminology. The old name remains relevant on older OpenSSH installations, which are common in embedded appliances and long-lived network equipment.
| Purpose | Current spelling | Older spelling | Where it is relevant |
|---|---|---|---|
| Accepted user-key signature algorithms | PubkeyAcceptedAlgorithms |
PubkeyAcceptedKeyTypes |
Client configuration and SSH daemon policy, according to the installed version |
| Algorithms used to identify the server | HostKeyAlgorithms |
The same directive is commonly used on older clients | Client-side host-key negotiation |
Do not put both spellings blindly into one configuration file. An older client may fail on the modern name, while a current client may warn that the legacy name is deprecated. Test the exact binary that will make the connection with ssh -G or a one-time command-line option.
Common cases and the correct response
An old switch offers only ssh-dss as its host key
- Confirm the error identifies the server’s offer as
ssh-dss. - Verify the switch’s host-key fingerprint through a trusted management channel.
- Test
ssh -o HostKeyAlgorithms=+ssh-dss user@legacyhost. - If successful, create a named
Host legacyhostblock rather than a global exception. - Plan a firmware or SSH-service upgrade that can generate a modern host key.
The server host key is accepted, but an account’s DSA key fails
- Confirm that the public key is installed for the intended account.
- Check the verbose output for a signature-algorithm refusal rather than a host-key negotiation error.
- Use the option spelling supported by the client and, if you administer the server, enable the matching daemon policy temporarily.
- Test authentication again without changing unrelated algorithm lists.
- Generate and deploy a modern user key, then remove the DSA exception.
The client says the option is unknown
- Check the spelling:
PubkeyAcceptedKeyTypesis the older name;PubkeyAcceptedAlgorithmsis the current name. - Check capitalization and punctuation. OpenSSH option names are not arbitrary shell variables.
- Run
ssh -G user@legacyhostwith the option in the same configuration context to identify whether the binary recognizes it. - Remember that the client and server can run different OpenSSH versions and therefore accept different spellings.
The DSA exception still does not work
- Make sure you solved the right stage. A host-key failure requires
HostKeyAlgorithms; a user-key failure requires the public-key acceptance policy. - Check that the plus sign is present. Omitting it can replace rather than extend the defaults.
- Inspect the effective configuration for a later, more specific block that overrides your setting.
- Verify that the server daemon was reloaded after changing its configuration and that it accepted the new file.
- Confirm that the private key you are offering corresponds to the DSA public key installed for that account.
- Check whether the remote product has its own SSH policy, separate from the operating system’s configuration.
Migration: replace DSA instead of normalizing it
The compatibility setting is a bridge, not a security upgrade. OpenSSH’s recommended resolution is to upgrade or reconfigure the remote software and replace weak key types with safer modern types.
Generate a modern user key
On a client that supports it, generate an Ed25519 key, or use ECDSA or a current RSA key with SHA-2 signatures when the endpoint’s capabilities require that choice. Keep the new private key protected and identify it explicitly while testing so you do not accidentally change another host’s credentials.
Install the new public key while access still exists
Use an existing authenticated session, a console, or the device’s documented key-management interface to add the new public key to the correct account. Do not remove the working DSA key until you have opened a separate session using the replacement and confirmed that it survives a reconnect.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteUpgrade the remote SSH implementation
Replace old firmware or reconfigure the SSH service so it can offer modern host keys and accept modern user signatures. Embedded switches and appliances may require a vendor firmware release rather than an operating-system package update. Record the device, the temporary exception, the replacement key fingerprint, and the date the exception can be removed.
Quick Recap
Remove the exception
- Open a new session using the modern host key and user key.
- Delete the
HostKeyAlgorithms +ssh-dssline for the migrated host. - Remove
PubkeyAcceptedAlgorithms +ssh-dssorPubkeyAcceptedKeyTypes +ssh-dssfrom the client and server policies. - Retest with ordinary SSH settings and review the effective configuration with
ssh -G. - Revoke or delete the old DSA public key from
authorized_keysand any appliance-specific key store.
Security decisions and operational guardrails
- Treat every DSA exception as technical debt with an owner and removal date.
- Scope the exception to one hostname, address, account, or maintenance window whenever the platform allows.
- Prefer a one-time
-ocommand while recovering access; save a host-specific configuration only when repeated access is unavoidable. - Never use
Host *to make DSA available everywhere. - Keep host-key verification enabled and validate fingerprints independently.
- Do not assume that a key’s presence in
authorized_keysmeans the server will accept its algorithm. - After migration, verify both directions: the server offers a modern host key and the account authenticates with a modern user key.
Quick decision checklist
- Does the error say the server offered only
ssh-dss? Add a host-specificHostKeyAlgorithms +ssh-dssexception temporarily. - Does the server identity negotiate successfully but reject your DSA login key? Use the appropriate
PubkeyAcceptedAlgorithmsor legacyPubkeyAcceptedKeyTypespolicy, including the server-side daemon policy when you control it. - Does your client reject the option name? Check the installed version with
ssh -Gand use the spelling it recognizes. - Are you tempted to leave the exception permanently? Stop and migrate to Ed25519, ECDSA, or a current RSA SHA-2 key, then remove DSA.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
