Okta Access Gateway (OAG) appliances lack a default account for direct Secure Shell (SSH) or Secure Copy Protocol (SCP) access. Resolve this by creating a new account and configuring SSH keys to transfer specific log files from the appliance. Starting in May 2024, Okta Access Gateway appliances provide shell access through the management console.

NOTE: Download logs from the Admin UI to avoid requiring additional accounts. Creating additional accounts on the appliance opens an additional attack surface.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Secure Copy Protocol (SCP)
• Version 2024.5.0 and above

By default, the Okta Access Gateway appliance lacks an account configured for direct Secure Shell (SSH) or Secure Copy Protocol (SCP) access.

How do administrators create and configure a new account for SCP access?

Connect to the appliance, create a new account, modify the SSH daemon configuration, and generate SSH keys to establish a connection.

1. Connect to the appliance through the launch-shell option.
2. Create the account by executing the provided command.

sudo adduser <username>

3. Modify the sshd_config file to allow access for the newly created <username> account. Do not modify any other settings in this file.

sudo vi /etc/ssh/sshd_config

4. Add <username> to the AllowUsers directive.

AllowUsers oag-mgmt oagha <username>

5. Save the file and exit.
6. Ensure there are no errors in sshd_config using the provided command before proceeding. Restarting with a configuration issue locks all accounts out of the appliance.

sudo sshd -t

7. Restart the SSH daemon.

sudo systemctl restart sshd

8. Switch to the newly created account.

sudo su - <username>

9. Validate the shell is in the home directory. The bash prompt displays <username>@<server-hostname>;/home/<username>.
10. Generate the SSH keys for authentication.

ssh-keygen -b 2048 -t rsa

11. Use the default path /home/<username>/.ssh/id_rsa and create a password.
12. Validate the files exist.

ls -la /home/<username>/.ssh/

13. Create the authorized keys file and set the permissions.

touch /home/<username>/.ssh/authorized_keys
chmod 600 /home/<username>/.ssh/authorized_keys

A Linux or Mac client establishes the connection.

Copy the public key to the authorized keys file on the Okta Access Gateway appliance to connect from a Linux or Mac client.

1. Copy the content of id_rsa.pub from the client $HOME/.ssh/ directory to the authorized_keys file at /home/<username>/.ssh/authorized_keys.

A Windows client establishes the connection using WinSCP.

Generate a new key pair using WinSCP and copy the public key to the Okta Access Gateway appliance to connect from a Windows client.

1. Launch the WinSCP application.
2. Select Advanced, choose Authentication, click Tools, select Generate New Key Pair with PuTTYgen, and click Generate.
3. Save the private key to a secure location.
4. Copy the public key and paste it from WinSCP into the authorized_keys file on the Okta Access Gateway appliance.
5. Ensure the private key is selected in WinSCP and the account is <username>.

Related References

• Launch Shell