When using an RHEL9 client to SSH to another target server in Advanced Server Access (ASA) or Okta Privileged Access (OPA), SSH using proxycommand fails with the following error:

[root@rhel9-server1 .ssh]# ssh <target server>
Bad server host key: Invalid key length

Using the standard "sft ssh" command instead of proxycommand bypasses this error and still allows successful SSH:

[root@rhel9-server1 .ssh]# sft ssh <target server>
Last login: Fri Jan 31 10:06:52 2025 from <clientIP>
[user@targetserver ~]$ 

• Advanced Server Access (ASA)
• Okta Privileged Access (OPA)

By default, RHEL9 enforces a "RequiredRSASize 2048" directive in its ssh/sshd_configuration. However, ASA/OPA client versions previous to 1.99.7 do not support an RSA key size greater than 1024 in proxycommand.