Unable to negotiate with HOST port 22: no matching host key type found. Their offer: ssh-rsa

no matching host key type found. Their offer: ssh-rsa means the SSH client and server could not agree on a host key algorithm during key exchange. The server offers only ssh-rsa (RSA signatures with SHA-1), which OpenSSH clients disable by default since version 8.8. The connection stops before authentication. The real fix is to update the server; for a legacy device you cannot update, allow ssh-rsa for that one host with HostKeyAlgorithms +ssh-rsa.

Reproduce it

A minimal SSH server (Python paramiko, on 127.0.0.1) that offers only the ssh-rsa signature, and a current OpenSSH client:

ssh-keygen -q -t rsa -b 2048 -N "" -f hostkey
cat > legacy_server.py <<'EOF'
import socket, paramiko
key = paramiko.RSAKey(filename="hostkey")
srv = socket.socket(); srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
srv.bind(("127.0.0.1", 4805)); srv.listen(1); srv.settimeout(30)
conn, _ = srv.accept()
t = paramiko.Transport(conn, disabled_algorithms={"keys": ["rsa-sha2-256", "rsa-sha2-512"]})
t.add_server_key(key)
try:
    t.start_server(server=paramiko.ServerInterface())
except Exception:
    pass
t.close()
EOF
uv run -q --no-project --python 3.13 --with paramiko==4.0.0 python legacy_server.py 2>/dev/null &
sleep 5
ssh -p 4805 -o BatchMode=yes -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null 127.0.0.1 true
echo "ssh exit code: $?"
wait

Unable to negotiate with 127.0.0.1 port 4805: no matching host key type found. Their offer: ssh-rsa
ssh exit code: 255

With a real server the host name or IP and port 22 appear in place of 127.0.0.1 port 4805. Their offer: lists exactly what the server supports; it is the first thing to read.

Allow ssh-rsa for one host only

The + adds ssh-rsa to the default list instead of replacing it. Check what the client would use without connecting (ssh -G prints the resolved configuration):

ssh -T -G -o HostKeyAlgorithms=+ssh-rsa legacy.example.net | grep -i '^hostkeyalgorithms' | tr ',' '\n' | grep -x 'ssh-rsa'

ssh-rsa

In ~/.ssh/config, scope it to the device:

Host legacy-switch
    HostName 192.0.2.10
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

PubkeyAcceptedAlgorithms is needed only when you also authenticate with an RSA key and the server can verify only SHA-1 signatures. Older OpenSSH releases call it PubkeyAcceptedKeyTypes.

Fix the server

On an OpenSSH server, make sure modern host keys exist and are offered (ssh-keygen -A creates missing default host keys), and check HostKey and HostKeyAlgorithms in /etc/ssh/sshd_config. An OpenSSH 7.2 or later server supports rsa-sha2-256 and rsa-sha2-512 with the same RSA key, so the existing key can stay. If the offer is ssh-dss, no current OpenSSH client can connect: OpenSSH 10.0 removed DSA support.