Okta SSH Connection Fails With A Timeout On Port 4421

An SSH connection to a Linux server times out on port 4421 because a firewall blocks the port, the Okta Advanced Server Access (ASA) project enables On-Demand User Time To Live (TTL), or Okta Privileged Access (OPA) configures an on-demand user via the account lifecycle setting. Resolve this by opening port 4421 on the server firewall or modifying the on-demand user settings. When attempting to establish an SSH connection to a Linux server using the sft ssh command, the connection times out and generates the following error message:

error: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp <IP>:4421: i/o timeout"kex_exchange_identification: Connection closed by remote host

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)

In Okta Advanced Server Access (ASA), the On-Demand User Time To Live (TTL) feature requires an open port 4421 on the server. In Okta Privileged Access (OPA), an on-demand user is configured by the account lifecycle setting, and the client initially connects to the server on port 4421 before establishing a new connection on port 22. If a firewall or proxy blocks port 4421, the connection fails.

How is the port 4421 accessibility verified?

Verify port 4421 accessibility on the target Linux machine and the client machine by running network commands.

1. On the target Linux machine, verify that port 4421 accepts connections and that the sftd process listens on the port by running the ss -ltpn command.
   
   
2. On the client machine, verify that the target machine port accepts connections through any firewalls or proxies by running the nmap -p <port> <IP address> command.
   
   

How is the SSH timeout resolved for Okta Advanced Server Access?

Resolve the SSH timeout in Okta ASA by opening port 4421 or disabling On-Demand User TTL based on the environment requirements.

• If the environment requires On-Demand User TTL, create a firewall rule on the server to accept Transmission Control Protocol (TCP) connections on port 4421. Review the Okta ASA port requirements for more information.
• If the environment does not require On-Demand User TTL, disable the feature by editing the project details and setting the On-Demand User TTL value to disabled.

How is the SSH timeout resolved for Okta Privileged Access?

Resolve the SSH timeout in Okta OPA by opening port 4421 or adjusting the account lifecycle settings based on the account type.

• If an on-demand user is configured via the account lifecycle setting, create a firewall rule on the server to accept TCP connections on port 4421. Review Configure Okta Privileged Access accounts for more information.
• Local vaulted accounts only use port 22. Review the Okta OPA port requirements for more information.