Skip to content

Instantly share code, notes, and snippets.

@treblada

treblada/hp-ilo4-ssh-macos.md

Created August 7, 2026 18:34
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save treblada/029f32bd57b0ae25fd957c8a65e953d9 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save treblada/029f32bd57b0ae25fd957c8a65e953d9 to your computer and use it in GitHub Desktop.
Download ZIP
How to connect to iLO4 system from MacOS 26.6+
Raw
hp-ilo4-ssh-macos.md

I experienced SSH connection issues when I tried to connect to my HP iLO 4 system. It worked a few days ago, and then suddenly stopped working. I could still connect from a Raspberry Pi. Given the full log files, Claude found the solution:

Diagnosis

Both logs show the SSH negotiation picking the exact same algorithms (diffie-hellman-group14-sha1 for KEX, ssh-rsa for host key, aes256-ctr/hmac-sha2-256 for cipher/MAC) — the iLO 4's ancient SSH stack (mpSSH_0.2.1) only understands that handful of legacy algorithms, and both your Mac and the Pi correctly negotiate down to them.

The difference shows up after negotiation, at the Diffie-Hellman exchange itself:

  • Pi (works): sends KEXDH_INIT (type 30) → receives KEXDH_REPLY (type 31) → continues normally.
  • Mac (fails): sends KEXDH_INIT (type 30) → instead of a reply, the iLO immediately sends SSH_MSG_DISCONNECT (type 1), reason 11, "Client Disconnect".

So the iLO is aborting the handshake right when it has to process the client's key exchange data — before host-key verification, before auth even starts.

Comparing the two client KEXINIT proposals byte-for-byte, the only real difference is the host key algorithm list: your Mac's OpenSSH 10.3p1 (bundled with macOS 26.6) advertises two extra algorithm names that the Linux box's OpenSSH 10.0p2 doesn't know about yet:

  • webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com
  • webauthn-sk-ecdsa-sha2-nistp256@openssh.com

That makes the Mac's KEXINIT packet a bit longer than the Pi's. HP iLO 4's SSH implementation is notoriously minimal/buggy and has fixed-size internal buffers for the handshake data (it needs the full KEXINIT payload to compute the exchange hash once it gets your DH public value). The extra bytes from the new macOS OpenSSH tip it over some limit, and rather than erroring gracefully it just disconnects — mislabeling it a "Client Disconnect" even though it's iLO-initiated.

This lines up perfectly with your timeline: nothing changed on the iLO, but the macOS 26.6 update upgraded the bundled ssh client, which now sends a slightly bigger handshake than before — enough to trip up this 10+ year old embedded SSH stack.

Note your ~/.ssh/config already has:

KexAlgorithms +diffie-hellman-group14-sha1
HostKeyAlgorithms +ssh-rsa

The + appends these to OpenSSH's full modern default list rather than replacing it — so the proposal sent to the iLO is still the full (now-larger) list, plus your legacy additions tacked on. That's why it still fails despite specifying the right legacy algorithms.

Fix

Change host entry in ~/.ssh/config to replace the algorithm lists (drop the +) so only the minimal legacy set is sent, keeping the KEXINIT packet as small as possible:

Host ilo4
    KexAlgorithms diffie-hellman-group14-sha1
    HostKeyAlgorithms ssh-rsa
    PubkeyAcceptedAlgorithms ssh-rsa
    Ciphers aes256-ctr
    MACs hmac-sha2-256
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment