Okta Advanced Server Access And Okta Privileged Access SSH Fails After Reinstalling Server Agent On SuSE
Last Updated:
Overview
Okta generates an error when attempting to authenticate to a SuSE server via Secure Shell (SSH) in Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA) after reinstalling the server agent. This occurs because the uninstallation process leaves the sftd group intact, causing the subsequent user creation to fail. Resolve this issue by uninstalling the server tools, manually deleting the sftd group, and reinstalling the server agent. When attempting to SSH to the server, the sftd logs display the following errors:
"MESSAGE" : "time="2023-08-16T14:41:36-05:00" level=error msg="Error in brokerparent.Run!" error="user: unknown user sftd""
"MESSAGE" : "time="2023-08-16T14:41:51-05:00" level=error msg="Error setting up child options" error="user: unknown user sftd""
The Operating System (OS) logs display the following failed useradd attempts:
2023-08-16T22:24:27.345229+00:00 testserver useradd[41029]: failed adding user 'sftd', exit code: 9
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Advanced Server Access (ASA)
- Okta Privileged Access (OPA)
- SuSE 12
- SuSE 15
Cause
The error occurs because the uninstallation script for the ScaleFT server tools performs a userdel command to delete the sftd user. In SuSE, the userdel operation only deletes the user and leaves the sftd group intact. The subsequent useradd command for sftd fails during reinstallation because the sftd group still exists.
Solution
How is the Secure Shell failure resolved after reinstalling the server agent on SuSE?
Uninstall the server tools, manually remove the sftd group, and reinstall the server agent to resolve the Secure Shell (SSH) failure.
- Stop the sftd service and uninstall the ScaleFT Server Tools by running the following command:
sudo zypper rm -u scaleft-server-tools- Manually remove the sftd group by running the following command:
groupdel sftd- Reinstall the ScaleFT Server Tools by following the Install the Advanced Server Access server agent on SuSE Linux documentation.
