ssh -o HostKeyAlgorithms=+ssh-rsa: connect to servers that only offer RSA SHA-1 host keys

ssh -o HostKeyAlgorithms=+ssh-rsa user@oldhost adds the ssh-rsa host key signature algorithm back to the list the client accepts. OpenSSH 8.8 removed it from the defaults because it signs with SHA-1, so connecting to an old server, router or appliance that can only prove its identity with an ssh-rsa signature fails with no matching host key type found. Their offer: ssh-rsa. The leading + appends the algorithm instead of replacing the whole list.

The effective list, without and with the option

ssh -G prints the configuration ssh would use for a host without connecting, so it shows exactly what the option changes:

hostkeys() { ssh -G "$@" 2>/dev/null | awk '$1 == "hostkeyalgorithms" { print $2 }' | tr ',' '\n'; }
echo "--- default, last three entries:"
hostkeys legacy.example.org | tail -3
echo "--- default contains ssh-rsa?"
hostkeys legacy.example.org | grep -cx ssh-rsa
echo "--- with +ssh-rsa, last three entries:"
hostkeys -o HostKeyAlgorithms=+ssh-rsa legacy.example.org | tail -3
echo "--- with =ssh-rsa (replace), whole list:"
hostkeys -o HostKeyAlgorithms=ssh-rsa legacy.example.org

--- default, last three entries:
webauthn-sk-ecdsa-sha2-nistp256@openssh.com
rsa-sha2-512
rsa-sha2-256
--- default contains ssh-rsa?
0
--- with +ssh-rsa, last three entries:
rsa-sha2-512
rsa-sha2-256
ssh-rsa
--- with =ssh-rsa (replace), whole list:
ssh-rsa

The default ends with rsa-sha2-512 and rsa-sha2-256, the SHA-2 signatures for RSA keys, and does not contain ssh-rsa. +ssh-rsa keeps everything and adds ssh-rsa at the end, so a modern server still negotiates something better. Without the +, the list is replaced and the client accepts only ssh-rsa, which breaks connections to every server that dropped it.

List syntax

The same prefixes work for KexAlgorithms, Ciphers, MACs, PubkeyAcceptedAlgorithms and HostKeyAlgorithms:

Scope it to the old host

Host legacy-switch
    HostName 192.0.2.10
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

The second line is needed only when you also authenticate with an RSA user key; see PubkeyAcceptedAlgorithms.

Pitfalls

• Old option name. Before OpenSSH 8.5 the user-key option was PubkeyAcceptedKeyTypes; it is still accepted as an alias. HostKeyAlgorithms has kept its name.
• known_hosts. Accepting ssh-rsa only changes which signatures are allowed; the host key must still match the entry in known_hosts, and a first connection still asks you to confirm the fingerprint.
• Check what your build supports. ssh -Q HostKeyAlgorithms lists every algorithm compiled in; see list supported algorithms. A name that is not supported makes ssh exit with a Bad key types error.
• Server side. The equivalent sshd_config keyword is HostKeyAlgorithms too, but on the server it selects which host key signatures are offered.

RSA with SHA-1 is weak because SHA-1 collisions are practical. Treat +ssh-rsa as a temporary workaround and plan to move the server to Ed25519; the trade-offs are in Ed25519 vs RSA SSH keys.

FAQ