# SSH out of device

**URL:** <https://forums.balena.io/t/ssh-out-of-device/374674>\
**Category:** Project help\
**Created:** [August 18, 2025, 7:57am UTC](https://forums.balena.io/t/ssh-out-of-device/374674 "2025-08-18T07:57:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jesper](https://avatars.discourse-cdn.com/v4/letter/j/49beb7/32.png) [@Jesper](https://forums.balena.io/u/Jesper)\
**Post date:** [August 18, 2025, 7:57am UTC](https://forums.balena.io/t/ssh-out-of-device/374674/1 "2025-08-18T07:57:44Z")

</div>

Hi,

I’m trying to create an device (RPI3), that we would send out along with som network products.

We will then run a script, that checks that all devices are online. If one of them are failing, we would like to be able to SSH out of the device, from the Balena dashboard.

For now, I have only tested with a clean image and then I run the SSH command, but I keep getting: “…no matching key exchange method found. Their offer…” error, when trying to connect to the switch.

Do I need to install something to make SSH work outgoing from the device?

---

<div class="post-metadata">

**Author:** ![JonWood](https://avatars.discourse-cdn.com/v4/letter/j/9fc29f/32.png) [@JonWood](https://forums.balena.io/u/JonWood)\
**Post date:** [August 22, 2025, 11:27am UTC](https://forums.balena.io/t/ssh-out-of-device/374674/2 "2025-08-22T11:27:54Z")

</div>

You’ve not included the key piece of information of what algorithms the other end was offering for key exchange, but my guess is the devices you’re trying to SSH to probably don’t support any of the key types supported by the version of SSH shipping with balenaOS.

There’s a couple of options:

1. Ship your Balena devices with an SSH container in which you’ve installed a version of SSH which is compatible with the switches you’re trying to connect to.
2. Don’t SSH from the Balena device at all, and instead just use that device to provide you with a tunnel you can SSH through:

```auto
$ balena tunnel $DEVICE_UUID 22222:22222 # tunnel the device's SSH port to localhost
# In another shell
$ ssh -L ${SWITCH_IP}:22:localhost:222 -p 22222 ${BALENA_USERNAME}@localhost 
# In yet another shell
$ ssh -p 222 ${SWITCH_USERNAME}@localhost

```

The second `ssh` there will SSH to the Balena device, and then use that connection to tunnel any traffic received on `localhost:222` to `${SWITCH_IP}:22`, which means if you then SSH to `localhost:222` you’re actually going to pop out on the switch you were trying to connect to.