Technical Tip: How to fix the error 'Unable to negotiate with _IP_ADDRESS_ port 22: no matching host key type found. Their offer: cipher'

In FortiSIEM, it is possible to face this error when trying to connect to devices, when applying remediation scripts via SSH.

This error happens while the encrypted channel is being set up. If FortiSIEM and the remote system do not share at least one cipher, there is no cipher to agree on and no encrypted channel is possible.

Below is an example where the 'ssh-ed25519' cipher is not available to connect to 10.0.1.254:

[root@siem ~]# ssh adm_user@10.0.1.254
Unable to negotiate with 10.0.1.254 port 22: no matching host key type found. Their offer: ssh-ed25519

To avoid making a global change to solve a local problem, it is possible to put the cipher in a Host in /etc/ssh/ssh_config:

Host <Host_IP>
HostKeyAlgorithms +<cipher>

• First, backup the current configuration in ssh_config:
  
  

cp -rp /etc/ssh/ssh_config /etc/ssh/ssh_config.bkp

• Update ssh_config file:
  
  

vi /etc/ssh/ssh_config

• Add the following:
  
  

Host 10.0.1.254
HostKeyAlgorithms +ssh-ed25519

• Save the file.

• Restart the sshd service:
  
  

systemctl restart sshd.service