After around eleven years almost continual use my old Logitech Squeezebox Radio (now discontinued) started crashing and restarting on a regular basis, like every twenty minutes. In an attempt to tell if this is a software or hardware fail I started searching the internets and found that you can SSH into these over the network, but as OpenSSH updated and changed the security requirements the information given was out of date.

Some knowledge of SSH and the CLI Terminal is assumed (Bash, Zsh, etc), I am using a Raspberry Pi running Debian GNU/Linux 12 (bookworm) to SSH into the Radio.
Enable SSH on the Squeezebox Radio
The Option can be found in the menus:
- Settings
- Advanced
- Remote Login
- Enable SSH
- Remote Login
- Advanced

The default settings are:
- Username: root
- Password: 1234
- IP Address: <shown on your Remote Login screen>
Settings for SSH on your Computer
In my case the Radios IP address is 192.168.1.103, yours will be different. It will have shown you your address when you enabled SSH on the Radio.
The original instructions I found have become a little out of date and OpenSSH no longer directly supports some of the older ciphers and host-keys. One cannot simply SSH login to the Radio without some faffing about, for example using the settings from the original article:
|
1 2 |
ssh 192.168.1.103 -oKexAlgorithms=+diffie-hellman-group1-sha1 -c aes128-cbc -o PasswordAuthentication=yes -o PreferredAuthentications=keyboard-interactive,password -o PubkeyAuthentication=no -l root Unable to negotiate with 192.168.1.103 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss |
To force the old protocols, the KexAlgorithms and Ciphers can be used, for this I added to my ~/.ssh/config file.
|
1 |
% nano ~/.ssh/config |
with this entry:
|
1 2 3 4 5 6 |
Host 192.168.1.103 User root KexAlgorithms diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 HostKeyAlgorithms ssh-rsa,ssh-dss PubkeyAcceptedAlgorithms ssh-rsa,ssh-dss Ciphers aes128-cbc,3des-cbc,aes256-cbc |
Don’t forget to change my IP address to yours, save the file and then attempt to connect with:
|
1 |
% ssh root@192.168.1.103 |
It should now ask you for a password, the default is the totally secure: 1234
Congratulations, your Squeezebox Radio is now open.

Alternativley, in the terminal you can set the options and connect with:
|
1 2 3 4 5 6 |
% ssh -o KexAlgorithms=diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 \ -o HostKeyAlgorithms=ssh-rsa,ssh-dss \ -o PubkeyAcceptedAlgorithms=ssh-rsa,ssh-dss \ -o Ciphers=aes128-cbc,3des-cbc,aes256-cbc \ root@192.168.1.103 |
But for me an entry in ~/.ssh/config saves having to remember all of that.
In the end, a factory reset (in the menu settings) appears to have fixed the problem.
Copying Files
I found that using scp to copy a file to a remote computer while logged into the Radio didn’t work. Giving an assortment of errors, for example:
|
1 2 3 4 5 6 7 8 |
# scp -oKexAlgorithms=diffie-hellman-group1-sha1 crashlog.KDYe8t karlm@192.168.1.58:~/ WARNING: Ignoring unknown argument '-x' WARNING: Ignoring unknown argument '-oForwardAgent no' WARNING: Ignoring unknown argument '-oPermitLocalCommand no' WARNING: Ignoring unknown argument '-oClearAllForwardings yes' WARNING: Ignoring unknown argument '-oKexAlgorithms=diffie-hellman-group1-sha1' /usr/bin/dbclient: connection to karlm@192.168.1.58:22 exited: no matching algo kex lost connection |
The fix for this is to copy the file using the computer you are connecting to the Radio with:
|
1 2 3 4 |
% scp -O root@192.168.1.103:~/crashlog.KDYe8t . root@192.168.1.103's password: crashlog.KDYe8t |
This makes use of the ~/.ssh/config file. The -O option forces use of the legacy SCP protocol for file transfers instead of SFTP as this is not implemented on the Radio.
Troubleshooting
I would hope the above saves you a couple of hours trying things from the internet, not everything is needed in that config file but as its working I stopped.
The version of Linux on this Squeezebox Radio dates from February 2014:
|
1 2 |
# uname -a Linux SqueezeboxRadio 2.6.26.8-rt16 #1 PREEMPT RT Fri Feb 14 09:02:51 PST 2014 armv5tejl GNU/Linux |
I have read there are newer versions of the firmware and a community version, but not felt the need to update.
Here is the main problem I found while working on this setup, I kept getting this unable to negotiate error:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 |
% ssh -v root@192.168.1.103 OpenSSH_9.2p1 Debian-2+deb12u5, OpenSSL 3.0.15 3 Sep 2024 debug1: Reading configuration data /home/karlm/.ssh/config debug1: /home/karlm/.ssh/config line 3: Applying options for 192.168.1.103 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files debug1: /etc/ssh/ssh_config line 21: Applying options for * debug1: Connecting to 192.168.1.103 [192.168.1.103] port 22. debug1: Connection established. -- some lines cut out -- debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u5 debug1: Remote protocol version 2.0, remote software version dropbear_0.49 debug1: compat_banner: no match: dropbear_0.49 debug1: Authenticating to 192.168.1.103:22 as 'root' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: diffie-hellman-group1-sha1 debug1: kex: host key algorithm: ssh-rsa Unable to negotiate with 192.168.1.103 port 22: no matching cipher found. Their offer: aes128-cbc,3des-cbc,aes256-cbc,twofish256-cbc,twofish-cbc,twofish128-cbc,blowfish-cbc |
This was caused by some of the Ciphers being included in my ~/.ssh/config not being in my OpenSSH install, probably because they are insecure. Changing the Ciphers line from:
|
1 |
Ciphers aes128-cbc 3des-cbc aes256-cbc twofish256-cbc twofish-cbc twofish128-cbc blowfish-cbc |
to this:
|
1 |
Ciphers aes128-cbc,3des-cbc,aes256-cbc |
fixed that problem. You can find the Ciphers installed in OpenSSH on your computer with % ssh -Q ciphers, the Squeezebox uses a very old version of Dropbear SSH.
Debian Trixie – Old Cyphers Not Welcome [Old Firmware]
Update: Following the February 2026 firmware update on the radio to 9.0.1-r17084 the SSH service got updated to dropbear_2025.88 and the following is no longer needed for access.
I updated my Raspberry Pi 5 to Debian Trixie and in OpenSSH v10 the elderly diffie-hellman-group1-sha1 is no longer included, resulting in an Unable to negotiate error. A work around for this is to use debootstrap to install a Debian base system in a subdirectory of another already installed system, chroot for changing the apparent root directory for the current running process and its children, and schroot which lets users run commands or interactive shells in different chroots. Install with:
|
1 2 3 |
sudo apt update sudo apt install debootstrap schroot sudo debootstrap --arch=arm64 --variant=minbase buster /oldssh http://archive.debian.org/debian |
This creates a Debian Buster environment in /oldssh. On an intel x64 computer leave out the –arch=arm64. Now we need to access the Buster environment and get things setup:
|
1 2 3 4 |
sudo chroot /oldssh /bin/bash apt get update apt install bash openssh-client nano mkdir /root/.ssh |
you should now be able to login to the Squeezebox:
|
1 2 3 4 5 |
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 \ -oHostKeyAlgorithms=+ssh-rsa,ssh-dss \ -oPubkeyAcceptedKeyTypes=+ssh-rsa \ -oCiphers=+aes128-cbc,3des-cbc,aes256-cbc \ root@192.168.1.103 |
And because life is too short to remember all that, create a nano /root/.ssh/config file with the following:
|
1 2 3 4 5 6 |
Host 192.168.1.103 User root KexAlgorithms diffie-hellman-group1-sha1 HostKeyAlgorithms ssh-rsa,ssh-dss PubkeyAcceptedKeyTypes ssh-rsa,ssh-dss Ciphers aes128-cbc,3des-cbc,aes256-cbc |
This is slightly different from that used before, with the use of PubkeyAcceptedKeyTypes instead of PubkeyAcceptedAlgorithms this is because of a change in Version 7 we are using in the chroot and the Version 9 before the update to Trixie. With this we can now login to the Squeezebox with a mildly clunky workflow of:
|
1 2 |
sudo chroot /oldssh /bin/bash ssh root@192.168.1.103 |
Using schroot and a small shell script can make things easier, add the following to the end of /etc/schroot/schroot.conf and set your username:
|
1 2 3 4 5 6 |
[buster-oldssh] description=Debian Buster chroot for legacy SSH directory=/oldssh users=yourusername root-users=yourusername type=directory |
and in your home directory add the file squeezessh.sh with the following:
|
1 2 3 4 5 6 7 8 9 10 |
#!/bin/bash IP_ADDRESS='192.168.1.103' schroot -c buster-oldssh -- ssh \ -oKexAlgorithms=+diffie-hellman-group1-sha1 \ -oHostKeyAlgorithms=+ssh-rsa,ssh-dss \ -oPubkeyAcceptedKeyTypes=+ssh-rsa \ -oCiphers=+aes128-cbc,3des-cbc,aes256-cbc \ root@$IP_ADDRESS |
now set it to executable chmod +x squeezessh.sh and run it ./squeezessh.sh
Links and Sources
- Older Instructions https://joes-tech-blog.blogspot.com/2021/03/ssh-login-to-squeezebox-radio-touch.html
- OpenSSH Legacy Options: https://www.openssh.com/legacy.html
- Lyrion Media Server forum: https://forums.lyrion.org/
- Dropbear SSH daemon, used in the Squeezebox https://github.com/mkj/dropbear