Okta Access Gateway (OAG) version 2024.5.0 removes Secure Shell (SSH) access for the oag-mgmt account because the upgrade process updates the AllowUsers directive in the Secure Shell daemon configuration. Resolve this by logging into the appliance through console access and updating the configuration file to include the missing account. Following the upgrade, Secure Shell access fails, but console access remains available to implement the fix before the support Virtual Private Network (VPN) is removed.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)
• Secure Shell (SSH)
• Version 2024.5.0

The Okta Access Gateway version 2024.5.0 upgrade process updates the AllowUsers directive in the Secure Shell daemon (sshd) configuration and removes the oag-mgmt account. This omission prevents Secure Shell access for the account.

How is Secure Shell access restored for the management account?

Log in to the appliance using the management account through console access, launch the privileged shell, update the Secure Shell daemon configuration file, and restart the service.

1. Log in to the appliance using the oag-mgmt account through console access.
2. Navigate to 5 - System.
3. Select 0 - Launch Shell to launch the privileged shell.
4. Open the Secure Shell daemon configuration file for editing.

   sudo vi /etc/ssh/sshd_config

5. Add the following line or update the existing AllowUsers directive to include all the required accounts.

   AllowUsers icsadmin oag-mgmt appgw-mgmt oagha

6. Restart the Secure Shell daemon service.

   sudo systemctl restart sshd

Related References

• Default Access Gateway credentials
• Sign in for the first time: Access Gateway Management console
• Access Gateway password strength requirements