# Fixing DigitalOcean Web Console Connection Errors

After performing [SSH hardening](https://www.ssh-audit.com/hardening_guides.html) on my CentOS server (hosted on DigitalOcean) the DO web console becomes inaccessible. After some trial and error, I found the required SSHD configurations to make it work (at the expense of some security risks).

# Handshake failed: no matching host key format

Log from /var/log/secure:

```plaintext
sshd[6810]: Unable to negotiate with <IP_ADDR> port <PORT_NUM>: no matching host key type found. Their offer: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa [preauth]
```

DO web console does not support ED25519. Solution is to enable either ECDSA or RSA `HostKey`.

# Handshake failed: no matching client-&gt;server HMAC

The following error messages are captured in /var/log/secure.

This is due to `HostKey` config:

```plaintext
Unable to negotiate with <IP_ADDR> port <PORT_NUM>: no matching key exchange method found. Their offer: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 [preauth]
```

This is due to `MACs` config:

```plaintext
Unable to negotiate with 180.101.88.252 port 10622: no matching MAC found. Their offer: hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96,hmac-ripemd160,hmac-ripemd160@openssh.com [preauth]
```

Solution is to update SSHD configurations (e.g. /etc/ssh/sshd\_config):

* Append `diffie-hellman-group-exchange-sha256` to `KexAlgorithms`
    
* Append `hmac-sha2-512` to `MACs`