When using a Red Hat Enterprise Linux 9 (RHEL9) client to SSH to a target server in Okta Advanced Server Access (ASA) or Okta Privileged Access (OPA), the SSH connection using proxycommand fails due to an unsupported RSA key size. Upgrading the ASA or OPA client to version 1.99.7 or later resolves this issue. The failure generates the following error message:

Bad server host key: Invalid key length

Using the standard sft ssh <target server> command instead of proxycommand bypasses this error and allows a successful SSH connection, returning the following output:

Last login: Fri Jan 31 10:06:52 2025 from <clientIP>
[user@targetserver ~]$

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Okta Privileged Access (OPA)
• Red Hat Enterprise Linux 9 (RHEL9)

By default, RHEL9 enforces a RequiredRSASize 2048 directive in the ssh/sshd_configuration file. However, ASA and OPA client versions prior to 1.99.7 do not support an RSA key size greater than 1024 in proxycommand.

How is the proxycommand failure resolved?

Resolve the proxycommand failure by upgrading the ASA or OPA client to a supported version and reviewing the release notes.

1. Upgrade the ASA or OPA client to version 1.99.7 or later.
2. Review the Okta Privileged Access Release Notes for additional details regarding specific versions.