SSH No Matching MAC Found: Fix the Port 22 Error

The SSH error “Unable to negotiate with host port 22: no matching MAC found” means your client and the remote SSH server have no message authentication code (MAC) algorithm in common. First update or reconfigure the older side to use a modern MAC supported by both; only as a temporary compatibility measure, enable a specific legacy MAC for that host.

What the MAC error means

SSH uses several negotiated algorithms to protect a connection. A MAC verifies that packets have not been altered and authenticates their integrity; it is separate from the encryption cipher and from the server’s host key. During connection setup, the client and server compare their supported algorithm lists. If those lists do not overlap for MACs, negotiation stops before you can log in.

Port 22 is simply the conventional SSH port. The wording does not usually mean that the port is closed or that your password is wrong. A closed port, routing issue, or firewall often produces a timeout or connection-refused message instead. A server may use a different port, but the MAC mismatch concerns SSH algorithm negotiation once the client reaches an SSH service.

Check the client and server proposals

Start by recording the exact error and identifying which machine you control. On the client, run a verbose connection attempt, substituting your real host and account:

ssh -vvv user@host

Look near the end of the output for the MAC algorithms offered by each side and the negotiation failure. The exact wording varies between OpenSSH versions. If you have server access, check its SSH configuration and logs as well. Do not post verbose output publicly without reviewing it: it can reveal usernames, hostnames, addresses, and configuration details.

Check the SSH client version with ssh -V.
Confirm that the destination is the intended host and port. For a nonstandard port, use ssh -p 2222 user@host.
Ask the server administrator which MAC algorithms the server currently offers if you do not administer it.
Check whether a client configuration file or server policy is restricting algorithms.

Fix it by updating or correcting configuration

The preferred repair is to make both sides support a mutually acceptable, current MAC. Update the SSH client and server packages through the operating system’s normal update process, then retry. On a server you administer, review its SSH daemon configuration and use the algorithms supported by its installed OpenSSH version and security policy. Configuration syntax and available algorithms differ across releases, so verify changes against the local manual pages and test before closing an existing administrative session.

OpenSSH client settings can be placed in ~/.ssh/config for a single host. A host-specific entry is safer than changing defaults for every connection:

Host old-server
    HostName example.com
    User alice

Replace the example values with your real host and username. This entry alone does not add algorithms; it gives you a scoped place to set a compatibility option if necessary. To inspect client-supported MACs, consult man ssh_config or the documentation for your installed client. To inspect server-side settings, consult man sshd_config. Avoid copying an algorithm name from an unrelated tutorial: it must actually be supported by both ends.

Temporary compatibility with a legacy server

If an old device cannot be updated, a narrowly scoped legacy setting may restore access while you plan a proper upgrade. OpenSSH supports specifying a MAC preference for an individual connection with the -m option. For example, if diagnostics confirm that both sides support the named algorithm, you can test:

ssh -m hmac-sha1 user@host

This is an example, not a recommendation to enable that algorithm universally. The server must offer it, and security policy may prohibit it. You can also set a verified compatible value under the matching Host entry in ~/.ssh/config using the MACs directive. Scope such settings to the one legacy system, document why they are present, and remove them when the server is upgraded.

Do not respond by enabling every old MAC globally. That can weaken the protection of unrelated SSH connections and make a temporary workaround easy to forget. If you do not control the server, ask its administrator to modernize its SSH configuration rather than changing your whole client’s security policy.

Common causes and troubleshooting

Outdated server software: Older systems may offer only algorithms that a newer client no longer accepts by default. Updating the server is generally the durable fix.
Restricted server policy: An administrator may have configured a narrow MAC list. Check the daemon configuration and service logs rather than assuming the client is at fault.
Wrong destination: A DNS name, port forwarding rule, or SSH jump host may lead to a different SSH server than expected. Confirm the target and port.
Configuration override: User, system-wide, or included SSH configuration files can alter algorithm preferences. Use ssh -G host to print the effective client configuration and inspect relevant MACs settings.
Mixing up algorithm types: MACs are not host-key algorithms or encryption ciphers. Changing HostKeyAlgorithms or Ciphers will not generally fix a MAC negotiation failure.

If the error remains after updates, compare the client’s effective configuration with the server’s actual offers. A command-line option can be overridden or constrained by other configuration and policy. On a server, validate configuration before reloading the SSH daemon; keep a working session open so an error does not lock you out. Follow the service-management instructions for your operating system.

Security and choosing the right fix

Prefer this order: update both endpoints, correct an accidental configuration restriction, and use a host-specific compatibility exception only if an old endpoint cannot yet be changed. MAC algorithms differ in age and security properties, so select from current guidance for your operating system and organization rather than treating all names as interchangeable. The fact that an algorithm makes negotiation succeed does not by itself establish that it is appropriate for long-term use.

SSH may also negotiate packet integrity through authenticated encryption ciphers, depending on the algorithms in use. That does not make every MAC-related configuration error safe to ignore: client and server still need compatible negotiation settings. A useful fix changes only the setting implicated by the diagnostic and preserves the rest of the connection’s security controls.

Frequently Asked Questions

Does “no matching MAC found” mean port 22 is blocked?
No. It usually means the SSH service was reached but the client and server could not agree on a MAC. A blocked port more commonly causes a timeout or connection-refused error.

What command shows the MAC negotiation details?
Run ssh -vvv user@host and inspect the final negotiation messages. Treat the output as potentially sensitive before sharing it.

Can I fix this by changing the cipher?
Usually not. A MAC and a cipher are different SSH algorithm categories. Follow the specific diagnostic and change the MAC configuration only when the negotiation points to MACs.

Is it safe to enable a legacy MAC?
It can reduce security compared with a current configuration. If unavoidable, limit it to the one host, confirm the algorithm is required and supported, and remove the exception after upgrading the server.

Why did this start after an update?
A client update may have removed or restricted older algorithms that were previously accepted. Updating the server or correcting its policy is preferable to restoring a legacy algorithm globally.

What if I do not administer the remote server?
Send the administrator the error and relevant, redacted verbose negotiation details. Ask them to update the SSH service or configure a mutually supported MAC that meets their security requirements.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →