新版ssh客户端无法连接旧版服务器sshd的方法

石牌桥网管2024-09-22 10:06

新安装完的windows 版本，连Linux服务器直接报错

bash 复制代码

C:\Users\wang>ssh root@192.168.110.50
Unable to negotiate with 192.168.110.50 port 22: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,kexguess2@matt.ucc.asn.au

这是密钥交换算法不匹配，服务器是较老的、已经被淘汰的算法（diffie-hellman-group14-sha1、diffie-hellman-group1-sha1），而ssh客户端版本较新，禁用了这些不安全的算法。

解决办法：启用不推荐的密钥交换算法:-o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

bash 复制代码

C:\Users\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 root@192.168.110.50
Unable to negotiate with 192.168.110.50 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss

又报错了，新版ssh客户端无法匹配服务器的旧版密钥类型(ssh-rsa,ssh-dss)

解决办法：启用不推荐的密钥类型 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss

bash 复制代码

C:\Users\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss root@192.168.110.50
Unable to negotiate with 192.168.110.50 port 22: no matching MAC found. Their offer: hmac-sha1,hmac-md5

还是报错，新版ssh客户端无法匹配服务器的消息认证码（MAC）算法。

解决办法：启用不推荐的MAC算法 -o MACs=+hmac-sha1,hmac-md5

bash 复制代码

C:\Users\wang>ssh -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa,ssh-dss -o MACs=+hmac-sha1,hmac-md5 root@192.168.110.50
sign_and_send_pubkey: no mutual signature supported
root@192.168.110.50's password:

终于可以连了