I'm trying to test the order in which keys are tried. One of the system's users is using DSA, so I'm trying to test it as an option. I'm getting a Bad key types.

$ ssh -vv -p 1522 jwalton@
OpenSSH_7.1p1, OpenSSL 1.0.2d 9 Jul 2015
debug1: Reading configuration data /Users/jwalton/.ssh/config
/Users/jwalton/.ssh/config line 2: Bad key types 'ssh-ed25519,ecdsa-sha2-nistp256,ssh-dsa,ssh-rsa'.

I narrowed it down to ssh-dsa. According to ssh_config(5) (its actually part of sshd_config(5), but its listed as a new ssh_config feature in the OpenSSH 7.0 release notes):

 The -Q option of ssh(1) may be used to list supported key types.

However, I can't seem to get it to work:

riemann::~$ ssh -Q 
/usr/local/bin/ssh: option requires an argument -- Q
riemann::~$ ssh -Q dsa
Unsupported query "dsa"
riemann::~$ ssh -Q ssh-dsa
Unsupported query "ssh-dsa"
riemann::~$ ssh -Q ed25529
Unsupported query "ed25529"
riemann::~$ ssh -Q ssh-ed25529
Unsupported query "ssh-ed25529"
riemann::~$ ssh -Q PubkeyAcceptedKeyTypes
Unsupported query "PubkeyAcceptedKeyTypes"

How does one use the ssh -Q option?

What is the key type for ssh-dsa?

2 Answers 2


Reading manual pages should help you:

 -Q cipher | cipher-auth | mac | kex | key | protocol-version

Queries ssh for the algorithms supported for the specified version 2. The available features are: cipher (supported symmetric ciphers), cipher-auth (supported symmetric ciphers that support authenticated encryption), mac (supported message integrity codes), kex (key exchange algorithms), key (key types) and protocol-version (supported SSH protocol versions).

Calling ssh -Q key gives you what you want:

ssh -Q key

This is new feature in openssh-7.0 so remember that it doesn't have to work in older versions.

ssh-dsa key type is ssh-dss and it is disabled by default in this version.

  • Thanks. What man page were you in?
    – jww
    Aug 26, 2015 at 13:13
  • 2
    "ssh-dsa key type is ssh-dss and it is disabled by default in this version." - OK, thanks. Is there a reason it is disabled by default? DSA2 has 112-bits of security (equivalent to 2048-bit RSA), so its not weak/wounded like a 512-bit or 768-bit moduli. Also, DSS includes RSA and ECDSA, so its clearly disabling DSA, and not DSS.
    – jww
    Aug 26, 2015 at 13:16
  • 1
    Not in the man pages here with Fedora 23 beta; but ssh -Q key does work. Unfortunately the keys on my machine are not supported now. Sep 28, 2015 at 1:56
  • 3
    @PavelŠimerda How is this related to DNS? You mean DSA? This is exactly what is the PubkeyAcceptedKeyTypes option for. If you add it to your ssh_config with +ssh-dss value, you should be able to accept DSA keys on server. On server you can use HostKeyAlgorithms as described in release notes: openssh.com/txt/release-7.0
    – Jakuje
    Oct 5, 2015 at 21:20
  • 1
    @DavidFaure It does not explain why, it was disabled it just says it was disabled and how to handle it
    – Jakuje
    Jun 13, 2016 at 16:42

For reference, an answer posted in unix.stackexchange.com helped us fix the issue:

The new openssh version (7.0+) deprecated DSA keys and is not using DSA keys by default (not on server or client). The keys are not preferred to be used anymore, so if you can, I would recommend to use RSA keys where possible.

If you really need to use DSA keys, you need to explicitly allow them in your client config using

PubkeyAcceptedKeyTypes +ssh-dss Should be enough to put that line in ~/.ssh/config, as the verbose message is trying to tell you.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.