‘no matching mac found error‘ when I try to ssh

I have struggled to this problem for decent time before understanding the basics and root cause. Sharing the experience so it can help someone.

I was trying to ssh to a target server and getting error like below

$ ssh -A <someTargetServerNameOrIP>
Unable to negotiate with XX.XX.XX.XX port 1234: no matching MAC found.   
Their offer:   
hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,
umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

The root cause of this error is on your source machine the supported MAC doesnt contain the MAC from target server.

You are getting this error because the client and the server could not agree upon a hashing algorithm for message authentication code.

More information here: Debug SSH Connection issue in key exchange - Experiencing Technology

To see this run in command line on your machine

$ ssh -Q mac   # output would be something like
hmac-sha1
hmac-sha1-96
hmac-sha2-256
hmac-sha2-512
hmac-md5
hmac-md5-96
umac-64@openssh.com
umac-128@openssh.com

So now in order to connect to target server with their choice of mac which your server doesn't support you have to explicitly provide one of the mac supported by target server. For e.g. we take hmac-sha2-512 from the error message and try to connect, and it will be connected

$ ssh -m hmac-sha2-512 -A <someTargetServerNameOrIP>

Another variant of the problem is the mismatch in cipher which looks like below

$ ssh -A <someTargetServerNameOrIP>       
Unable to negotiate with XX.XX.XX.XX port 1234: no matching cipher found.   
Their offer: aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

The root cause is mismatch of cipher

Check your supported cipher by

$ ssh -Q cipher   # output would be something like
3des-cbc
aes256-cbc
rijndael-cbc@lysator.liu.se
aes128-ctr
aes192-ctr
aes256-ctr
aes128-gcm@openssh.com
aes256-gcm@openssh.com

 So now in order to connect to target server with their choice of cipher which your server doesnt support you have to explicitly provide one of the cipher supported by target server. For e.g. we take aes128-cbc from the error message and try to connect, and it will be connected

$ ssh -c aes128-cbc -A <someTargetServerNameOrIP>

More details on this can be found Specifying SSH connection parameters manually - Diego Assencio