SSH to Okta ASA Server Displays a Warning: "Error forwarding client trust, proceeding anyway"

When the target server's SSH configuration denies TCP forwarding, Okta Advanced Server Access (ASA) fails to forward client trust. Modifying the SSH daemon configuration to allow TCP forwarding resolves this issue. The Forward Client Trust feature fails to operate when active on a project, and the following warning displays when connecting to the first target server:

WARNING: Error forwarding client trust, proceeding anyway: 'ssh: streamlocal-forward@openssh.com request denied by peer'

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Forward Client Trust

The SSH configuration of the target server denies TCP forwarding. Most systems allow TCP forwarding by default.

How is the TCP forwarding configuration modified to resolve the client trust error?

Verify the current SSH daemon configuration, modify the configuration file to allow TCP forwarding, and restart the service to apply the changes.

1. SSH into the target server.
2. Check if the "AllowTcpForwarding" setting is set to "no".

   # sudo sshd -T | grep -i allowtcpforwarding
   allowtcpforwarding no
   

3. Backup the sshd configuration file (/etc/ssh/sshd_config).
4. Modify the sshd configuration file, replacing the line "AllowTcpForwarding no" with "AllowTcpForwarding yes".

   AllowTcpForwarding yes

5. Verify the sshd configuration.

   # sudo sshd -t

   • No output means that the configuration is valid. Proceeding with an invalid configuration can cause loss of SSH access.
6. Restart sshd.

   # sudo systemctl restart sshd

7. Verify that TCP Forwarding is now allowed.

   # sshd -T | grep -i allowtcpforwarding
   allowtcpforwarding yes