An Okta Advanced Server Access (ASA) client warning occurs when a project uses the deprecated ssh-rsa algorithm. Changing the project's Secure Shell (SSH) Certificate Signature Algorithm to a secure option or setting an environment variable resolves the issue. When an ASA client attempts to connect to a server, Okta generates a warning prompt.

This connection uses the deprecated ssh-rsa algorithm set in project(s): <projectName>. Data sent over this connection might be insecure
Do you want to continue [y/N]?

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Advanced Server Access (ASA)
• Client Version 1.72.1 and newer

This warning occurs in ASA client version 1.72.1 and newer when a client attempts to connect to a server in a project that has the SSH Certificate Signature Algorithm set to ssh-rsa. The ssh-rsa algorithm utilizes Secure Hash Algorithm 1 (SHA-1) hashing, which is deprecated and insecure.

Review the SSH Certificate Signature Algorithm setting location under the project details in the following image.

How is the warning prompt prevented?

Change the project's SSH Certificate Signature Algorithm setting from ssh-rsa to a secure algorithm, such as the default ssh-ed25519, by completing these steps.

1. Log in to the ASA team dashboard.
2. Select Projects on the left pane.
3. Select the gear icon next to the project and click Edit.
4. Under the SSH Certificate Signature Algorithm section, select a different algorithm.

The target server sshd configuration dictates the allowed signing algorithms.

Modern operating systems widely support the ssh-ed25519 and other algorithms. However, a target server may have a sshd configuration that limits the available signing algorithm to ssh-rsa, which renders it inaccessible from an ASA client after changing the project's algorithm.

Check which signing algorithms the sshd configuration allows by running the following command on the target server.

sudo sshd -T | grep -i casignaturealgorithms

If ssh-rsa is the only algorithm returned, check the sshd configuration file (/etc/ssh/sshd_config) for the line CASignatureAlgorithms ssh-rsa. This restricts the signing algorithm to only ssh-rsa. Comment out this line or replace it with CASignatureAlgorithms +ssh-rsa if required to keep support for ssh-rsa, and restart sshd for the change to take effect.

An environment variable bypasses the warning prompt.

As of ASA client version 1.73.2, setting the environment variable SFT_ALLOW_INSECURE_SHA1_SSH="1" bypasses the warning prompt. With this set, Okta displays the following message instead.

This connection uses the deprecated ssh-rsa algorithm set in project(s): ssh-rsa. Data sent over this connection might be insecure. Warning ignored as SFT_ALLOW_INSECURE_SHA1_SSH is set. Continuing...

Set this variable for the current session by running the applicable command for the operating system.

• Windows Command Prompt (CMD): set SFT_ALLOW_INSECURE_SHA1_SSH="1"
• Windows PowerShell: $env:SFT_ALLOW_INSECURE_SHA1_SSH="1"
• Linux/macOS: SFT_ALLOW_INSECURE_SHA1_SSH="1"

Set the variable persistently and start a new session by running the applicable command for the operating system.

• Windows (CMD and PowerShell): setx SFT_ALLOW_INSECURE_SHA1_SSH "1"
• Linux/macOS: Add export SFT_ALLOW_INSECURE_SHA1_SSH="1" to the shell user profile.

Related References

• Create a project