Modern OpenSSH refuses ssh-dss (DSA) by default. The correct workaround depends on which side failed: use HostKeyAlgorithms +ssh-dss when an old server offers only a DSA host key, and use PubkeyAcceptedAlgorithms +ssh-dss (called PubkeyAcceptedKeyTypes on older releases) when a DSA user key is being rejected. These exceptions restore compatibility temporarily; the durable fix is to upgrade the endpoint and replace DSA with a modern key.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an ssh-dss refusal means
ssh-dss is the OpenSSH name for the Digital Signature Algorithm (DSA) public-key type. OpenSSH 7.0 and later disable it by default because DSA uses a 160-bit private key, SHA-1 signatures and an estimated security level of about 80-bit symmetric equivalent. A key can remain present in ~/.ssh/authorized_keys and still fail: the daemon’s algorithm policy is evaluated before that key is accepted.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
There are two separate SSH negotiations that are often confused:
- Host-key negotiation: the server proves its identity to your client. A legacy server may offer only an
ssh-dsshost key. - User-key authentication: you prove your identity to the server with your private key. The server, and sometimes the client policy, may reject an
ssh-dssuser key.
The option names are similar, but changing the wrong one does nothing. Identify the error stage first.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Identify which SSH stage is failing
| What failed | Typical symptom | Setting involved | Temporary exception |
|---|---|---|---|
| Server host-key negotiation | Unable to negotiate ... no matching host key type found. Their offer: ssh-dss |
Client’s list of acceptable server host-key algorithms | HostKeyAlgorithms +ssh-dss |
| User public-key authentication | Authentication continues, then the DSA key is skipped or reported as not accepted by PubkeyAcceptedAlgorithms |
Algorithms allowed for user-key signatures; policy exists in both client and server configuration | PubkeyAcceptedAlgorithms +ssh-dss |
| Option-name compatibility | The configuration says an option is unknown | OpenSSH version’s spelling | Use PubkeyAcceptedKeyTypes on releases that predate the rename |
HostKeyAlgorithms answers “which host keys may this server use to identify itself?” PubkeyAcceptedAlgorithms answers “which public-key signature algorithms may be used for a user login?” They are not interchangeable.
Inspect the installed client before changing configuration
Use the OpenSSH client itself to see what it supports and what it will actually apply to a host:
Recommended Free Tools
ssh -Q key
ssh -G user@legacyhost | grep -Ei 'hostkeyalgorithms|pubkeyaccepted(algorithms|keytypes)'ssh -Q key lists key types supported by the installed client. ssh -G expands all applicable configuration files and Host blocks, so it is more reliable than reading only one file. If the second command prints pubkeyacceptedkeytypes rather than pubkeyacceptedalgorithms, use the spelling your client recognizes.
For a complete negotiation trace, add verbose logging to one connection attempt:
ssh -vvv user@legacyhostLook for the first decisive error. A “no matching host key type” message occurs before user authentication; a message that a key type is not in the accepted algorithms list occurs during public-key authentication.
Fix a legacy DSA host-key negotiation failure
Use a one-time command-line exception
If the server offers only a DSA host key, add the exception to that connection:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
ssh -o HostKeyAlgorithms=+ssh-dss user@legacyhostThis changes the client policy for one invocation. It does not alter system files and is the safest way to confirm that host-key policy is the actual blocker.
Scope the exception to one host
After confirming the diagnosis, place the setting in the per-user SSH configuration file, usually ~/.ssh/config:
Host legacyhost
HostKeyAlgorithms +ssh-dssUse the exact alias or hostname that appears in your command. Do not put this line under a wildcard such as Host *; a wildcard would make every connection willing to negotiate DSA when a server offers it.
Understand what this does not fix
This exception only permits the old server host key during server-identity negotiation. It does not make a DSA user key acceptable. If the connection gets past host-key negotiation and then rejects your login key, address user-key policy separately.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Fix a DSA user-key authentication failure
Current option spelling
On current OpenSSH releases, the client-side exception is:
ssh -o PubkeyAcceptedAlgorithms=+ssh-dss user@legacyhostTo scope it in ~/.ssh/config:
Host legacyhost
PubkeyAcceptedAlgorithms +ssh-dssThe setting allows the client to use the legacy public-key algorithm for that host. The remote sshd must also have a policy that accepts DSA signatures; a client-side change cannot override a server that explicitly rejects them.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Older option spelling
Older OpenSSH versions call the same setting PubkeyAcceptedKeyTypes:
ssh -o PubkeyAcceptedKeyTypes=+ssh-dss user@legacyhostOr in the host block:
Host legacyhost
PubkeyAcceptedKeyTypes +ssh-dssUse the spelling recognized by the installed version. An “unknown option” error means the name does not exist in that version or was placed in the wrong configuration context.
Server-side policy
If you administer the remote server, its sshd_config may need the corresponding exception:
PubkeyAcceptedAlgorithms +ssh-dssOn older daemons, use:
PubkeyAcceptedKeyTypes +ssh-dssValidate the file before reloading the daemon:
sshd -tOnly after validation should you reload the SSH service using the service manager provided by that operating system. Keep an existing administrative session open while changing sshd policy so a syntax error does not lock you out.
Why the plus sign is important
OpenSSH treats a leading + as “append this algorithm to the defaults.” Therefore:
HostKeyAlgorithms +ssh-dss
PubkeyAcceptedAlgorithms +ssh-dssretains the normal modern algorithms and adds DSA only as a fallback for the scoped host. Omitting the plus sign supplies a complete replacement list. That can remove stronger defaults, change algorithm preference and unintentionally weaken unrelated connections.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
The same rule applies to one-time options:
ssh -o HostKeyAlgorithms=+ssh-dss user@legacyhost
ssh -o PubkeyAcceptedAlgorithms=+ssh-dss user@legacyhostUse one exception at a time while diagnosing. Adding both is appropriate only when the endpoint has both a DSA host key and a DSA user key.
Client configuration versus server configuration
| Where you edit | Purpose | Typical location | Effect |
|---|---|---|---|
| SSH client command | Fast, temporary test | ssh -o ... |
One connection attempt |
| User client configuration | Per-user compatibility for one endpoint | ~/.ssh/config |
Connections matching one Host block |
| System client configuration | Machine-wide client policy | System-wide SSH client configuration | All users unless overridden; broadest exposure |
| SSH server configuration | Algorithms the daemon accepts from logging-in users | sshd_config |
All matching inbound users or a narrower server-side match block |
Prefer a command-line test, then a narrowly matched client block. Change the server only when you control it and have confirmed that its policy is the rejecting side. Configuration files are parsed in order, and later matching settings can affect the effective result; ssh -G shows what the client will use.
A safe recovery procedure
- Record the exact endpoint and account. Use a host alias such as
legacyhostso a compatibility rule cannot accidentally apply to another machine. - Capture the failure. Run
ssh -vvv user@legacyhostand note whether the first algorithm error concerns a host key or user authentication. - Check effective settings. Run
ssh -G user@legacyhostand confirm whether an existing wildcard or included file already sets an algorithm list. - Test only the relevant exception. Use
-o HostKeyAlgorithms=+ssh-dssfor a host-key error, or-o PubkeyAcceptedAlgorithms=+ssh-dss(or the older spelling) for a user-key error. - Confirm the result in a second session. Do not close your original administrative connection until the new policy has been proven and you have a way back in.
- Scope any persistent rule. Put the working option under
Host legacyhost, not under a global wildcard. - Open a migration task. Record the endpoint, owner, software version and reason the exception exists. A compatibility rule without an owner tends to become permanent.
Replace DSA instead of keeping the exception
OpenSSH’s recommended resolution is to upgrade or reconfigure the software at the other end and replace weak key types with safer modern types. Treat +ssh-dss as a bridge to regain access, not as a security improvement.
Generate a modern user key
Ed25519 is a current OpenSSH key type suitable for many maintained systems:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_legacy-migrationIf the endpoint cannot use Ed25519, select another modern type that both sides support, such as ECDSA or a current RSA key using SHA-2 signatures. The exact choice depends on the legacy product’s supported algorithms.
Install the new public key
Place the generated .pub file’s contents in the account’s authorized_keys on the remote system through its documented administration method. If the old SSH service cannot install it automatically, use its console, vendor management interface or an already authenticated session.
Test before removing DSA
Start a separate connection that explicitly selects the new identity:
ssh -i ~/.ssh/id_ed25519_legacy-migration user@legacyhostVerify that the login succeeds without a DSA exception. Test from every automation host that needs access, because a key deployed for one operator does not automatically update scripts or scheduled jobs.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRemove the compatibility rule
After all users and automation have migrated, delete the HostKeyAlgorithms +ssh-dss and/or PubkeyAcceptedAlgorithms +ssh-dss lines, remove the DSA public key from authorized_keys when it is no longer needed, and reload the server if its configuration was changed. Re-run ssh -G and a normal connection to verify that no broad exception remains.
Troubleshooting common branches
“Their offer: ssh-dss” still appears
This is a host-key negotiation problem. Confirm that the command or matching Host block contains HostKeyAlgorithms +ssh-dss. Adding only PubkeyAcceptedAlgorithms cannot change the server’s host-key offer.
The host-key error is gone, but login still fails
You have passed server identity negotiation and reached user authentication. Check the client trace for the accepted-algorithm message, then apply the user-key exception with the option spelling supported by that client. If the server still rejects the signature, its sshd_config policy must be changed by its administrator or the DSA key must be replaced.
The option is reported as unknown
Check the installed OpenSSH version and its local manual pages. Use PubkeyAcceptedKeyTypes on releases that use the older name and PubkeyAcceptedAlgorithms on current releases. Do not copy a setting intended for sshd_config into a client-only file without checking that the directive is valid in that context.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →A wildcard rule keeps weakening other connections
Run ssh -G for another host and inspect the expanded algorithm lists. Move the exception under the exact legacy alias, remove broader included-file rules and retest. The plus form is safer than replacing the whole list, but scope is still essential.
Changing the server configuration risks lockout
Leave an authenticated session open, validate with sshd -t, and arrange console or out-of-band access before reloading. If the daemon fails validation, restore the previous file rather than repeatedly guessing at option names.
Security checklist for temporary DSA access
- Use a one-time
-otest before editing a file. - Scope exceptions to one hostname or alias.
- Append with
+; do not replace the complete default algorithm list. - Enable only the stage that failed: host-key negotiation or user authentication.
- Record who owns the legacy endpoint and why DSA is still required.
- Prefer a controlled management network and least-privilege account while the exception exists.
- Generate and deploy a modern key, upgrade the endpoint, then remove both the exception and obsolete DSA key.
The important distinction is simple: HostKeyAlgorithms permits an old server identity key, while PubkeyAcceptedAlgorithms (formerly PubkeyAcceptedKeyTypes) permits an old user-authentication key. Both are compatibility switches around a weak, approximately 80-bit-equivalent algorithm, not permanent remedies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
