# AWX - EE-latest issue with supported key types while using ssh key **URL:** \ **Category:** AWX Project\ **Tags:** awx, ee\ **Created:** [February 13, 2023, 12:31pm UTC](https://forum.ansible.com/t/awx-ee-latest-issue-with-supported-key-types-while-using-ssh-key/37654 "2023-02-13T12:31:35Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sinnl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sinnl/32/1532_2.png) [@sinnl](https://forum.ansible.com/u/sinnl)\ **Post date:** [February 13, 2023, 12:31pm UTC](https://forum.ansible.com/t/awx-ee-latest-issue-with-supported-key-types-while-using-ssh-key/37654/1 "2023-02-13T12:31:35Z")
Hi, I recently started seeing almost twice as many systems failing and below error in the logs “Make sure this host can be reached over ssh: Unable to negotiate with XX.XX.XX.XXX port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss” This is older system but we do have a quite a few of those and need to keep them around and be able to automate them. I have run the same job against same server using EE 21.11.0 and it worked with no issues so this is limited to EE-latest. Is this a security “enhancement” and can this be worked around for older systems passing ssh args to define support for older key types? Thank you, L. ---
**Author:** ![sinnl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sinnl/32/1532_2.png) [@sinnl](https://forum.ansible.com/u/sinnl)\ **Post date:** [February 13, 2023, 12:37pm UTC](https://forum.ansible.com/t/awx-ee-latest-issue-with-supported-key-types-while-using-ssh-key/37654/2 "2023-02-13T12:37:21Z")
NOTE: The same behaviour can be observed when using only username and password. I have removed the ssh key from credentials used to execute the job and I still get the same error noted in previous message. Once agin limited only to EE-latest L. ---
**Author:** ![AWX\_Project](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@AWX\_Project](https://forum.ansible.com/u/AWX_Project)\ **Post date:** [February 15, 2023, 7:51pm UTC](https://forum.ansible.com/t/awx-ee-latest-issue-with-supported-key-types-while-using-ssh-key/37654/3 "2023-02-15T19:51:27Z")
ee latest is based on the centos stream9, whereas ee 21.11.0 stream8, so that might be causing issues with unsupported ssh key types. You may want to investigate the recommended ssh key types for stream 9 systems. some more here [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/9/html/security\_hardening/using-the-system-wide-cryptographic-policies\_security-hardening](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening) You may need to create a custom EE that will allow you to establish ssh connections to that machine Let us know if you have more questions, AWX Team ---
**Author:** ![sinnl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sinnl/32/1532_2.png) [@sinnl](https://forum.ansible.com/u/sinnl)\ **Post date:** [February 26, 2023, 9:30am UTC](https://forum.ansible.com/t/awx-ee-latest-issue-with-supported-key-types-while-using-ssh-key/37654/4 "2023-02-26T09:30:45Z")
Hi, As I do understand the security implications it would be extremely helpful to be able to overwrite this behaviour on host/group level with SSH args (or similar approach) while still using EE-latest. The ability to automate against entire environment is paramount even or especially when that environment still contains legacy systems. Thank you, L. ---
**Author:** ![mjksohonet](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mjksohonet/32/1217_2.png) [@mjksohonet](https://forum.ansible.com/u/mjksohonet)\ **Post date:** [March 2, 2023, 11:29am UTC](https://forum.ansible.com/t/awx-ee-latest-issue-with-supported-key-types-while-using-ssh-key/37654/5 "2023-03-02T11:29:58Z")
This sounds very like a problem we ran into recently. Newer versions of OpenSSH don’t support the ssh-rsa algorithm by default. However, there is a workaround if you cannot upgrade your remote hosts. All you need to do is add the following lines to the start of your _.ssh/config_ file. _HostKeyAlgorithms +ssh-rsa_ _Host \*_ _PubkeyAcceptedKeyTypes +ssh-rsa_ You can replace the the _Host \*_ _PubkeyAcceptedKeyTypes +ssh-rsa_ entry with individual entries for each affected host if you want. HTH.