anto.online

SSH Legacy Host Config Generator

Paste the error SSH gives you when connecting to an old switch, router, NAS or firewall, and get the exact lines to add for that one host, without weakening SSH for everything else.

🔒 Runs entirely in your browser. Nothing you type is sent anywhere.

Or tick what you need

Add this to ~/.ssh/config

Or connect once without changing your config
How to use it
  1. Try to connect as normal, for example ssh admin@192.168.1.20, and copy the error. It usually looks like no matching host key type found. Their offer: ssh-rsa,ssh-dss.
  2. Paste it above with a short name for the device and its address.
  3. Copy the block into ~/.ssh/config (create the file if it doesn’t exist), then connect with ssh old-switch, using your short name.
Prefer not to touch your config? Use the one-off command instead. It applies the same options to that single connection.
Why per host, not for everything
Modern OpenSSH turns off old algorithms such as ssh-rsa (SHA-1 signatures) and diffie-hellman-group1-sha1 because they’re weak. The safe fix is to re-enable them only for the device that needs them, which is what a Host block does. Adding them under Host * would weaken every connection you make.
The + in front of each value adds the old algorithm to OpenSSH’s defaults rather than replacing them, so the device can still use something stronger if it supports it.
Good to know
  • ssh-rsa here means the old SHA-1 signature, not RSA keys. Your RSA key still works with modern servers through rsa-sha2-256 and rsa-sha2-512. You only need ssh-rsa for devices too old to support those.
  • PubkeyAcceptedAlgorithms lets your own key log in to the old device. On OpenSSH older than 8.5 the same option is called PubkeyAcceptedKeyTypes.
  • DSA (ssh-dss) can’t be re-enabled on current OpenSSH. OpenSSH 10.0 removed it completely. If a device only offers ssh-dss, update its firmware or use an older client kept just for it.
  • The real fix is updating the device. These settings are a workaround for kit you can’t update yet, ideally on a trusted local network.
FAQ
Is this safe to use with real hostnames and usernames?
Yes. The page doesn’t send anything anywhere; the config is built by a small script running in your browser. You can even use it offline once the page has loaded.
Where is ~/.ssh/config on Windows?
For the built-in OpenSSH client it’s C:\Users\<you>\.ssh\config. The same lines work there.
I get a different error.
The tool also handles “no matching key exchange method found”, “no matching cipher found” and “no matching MAC found”. If yours is something else, the SSH host key guide covers more cases.