Okta Advanced Server Access And OPA Gateway SSH Fails With Index Out Of Range Error

When attempting to SSH to a Linux server via Okta Advanced Server Access (ASA) or OPA Gateway, the operation fails with a panic runtime error. This occurs because the ScaleFT client is incompatible with a parameter within the client's SSH configuration file. Resolve this by reviewing the SSH configuration file and removing the incompatible entry.

panic: runtime error: index out of range [1] with length 1
goroutine 1 [running]:
*github.com/ScaleFT/device-tools/sshutils/conf.(SystemMatchBlockChecker).CheckMatchBlock(, {, _}, _, {0x0, 0x140003c0200, 0x0, 0x0, 0x0, {0x0, ...}, ...})
github.com/ScaleFT/device-tools/sshutils/conf/matchblock.go:83 +0x568
github.com/ScaleFT/device-tools/sshutils/conf.Config.GetConfigForHostWithMatchBlockChecker({0x14000113040, 0x8, 0x140004f6dd0?}, {0x140005f8c00, 0x19}, {0x10569d260, 0x140005fde30})
github.com/ScaleFT/device-tools/sshutils/conf/ssh_config.go:128 +0x1c8
github.com/ScaleFT/device-tools/sshutils/conf.Config.GetConfigForHostWithDbg({0x14000113040, 0x8, 0x8}, {0x140005f8c00, 0x19}, {0x1056989e0?, 0x140001b9490})
github.com/ScaleFT/device-tools/sshutils/conf/ssh_config.go:89 +0x108
github.com/ScaleFT/device-tools/localft/sshclient.GetConfigForHost({0x1056a4760?, 0x140001164b0?}, {0x140005f8c00, 0x19}, {0x14000113040, 0x8, 0x8})
github.com/ScaleFT/device-tools/localft/sshclient/sshclient.go:566 +0x1f0
*github.com/ScaleFT/device-tools/localft/sshto.(SFTSSHClient).getLastHopGoClient(0x140003646c0, {0x1056a4760, 0x140001164b0}, 0x140001b9420)
github.com/ScaleFT/device-tools/localft/sshto/internal.go:56 +0xa0
*github.com/ScaleFT/device-tools/localft/sshto.(SFTSSHClient).GetInternalGoClient(0x140003646c0, {0x1056a4760, 0x140001164b0}, {0x10d952818?, 0x14000277c00?}, {0x16b76b972?, 0x105efae40?}, {0x105ef8f30?, 0x10d6a0008?, 0x1047293cc?})
github.com/ScaleFT/device-tools/localft/sshto/sshto.go:1111 +0x6c
*github.com/ScaleFT/device-tools/localft/proxycommand.(fakeClient).Dial(0x140003645a0, {0x1056a4760?, 0x140001164b0})
github.com/ScaleFT/device-tools/localft/proxycommand/bridge_client.go:165 +0x1a0
*github.com/ScaleFT/device-tools/localft/proxycommand.(bridgeServer).dial(0x140005c66c0)
github.com/ScaleFT/device-tools/localft/proxycommand/bridge.go:811 +0x38
*github.com/ScaleFT/device-tools/localft/proxycommand.(bridgeServer).ListenAndServe(0x140005c66c0, {0x10569f510, 0x14000136000}, {0x10569f538, 0x14000136008})
github.com/ScaleFT/device-tools/localft/proxycommand/bridge.go:820 +0x30
github.com/ScaleFT/device-tools/sft.proxyCommandFn({0x1056a4808?, 0x14000282510}, 0x14000245760)
github.com/ScaleFT/device-tools/sft/proxycommand.go:181 +0x960
github.com/ScaleFT/device-tools/sft.cliAction.func1(0x140005c6660?)
github.com/ScaleFT/device-tools/sft/sft.go:187 +0x190
github.com/urfave/cli.HandleAction({0x1054a0fa0?, 0x14000492b20?}, 0xc?)
github.com/urfave/cli@v1.22.4/app.go:526 +0x58
github.com/urfave/cli.Command.Run({{0x1051632c9, 0xc}, {0x0, 0x0}, {0x0, 0x0, 0x0}, {0x1051afb39, 0x57}, {0x0, ...}, ...}, ...)
github.com/urfave/cli@v1.22.4/command.go:174 +0x558
*github.com/urfave/cli.(App).Run(0x1400066e380, {0x1400013a000, 0x7, 0x7})
github.com/urfave/cli@v1.22.4/app.go:279 +0x838
github.com/ScaleFT/device-tools/sft.Run(...)
github.com/ScaleFT/device-tools/sft/sft.go:36
main.main()
github.com/ScaleFT/device-tools/cmd/sft/sft.go:74 +0x2b8
kex_exchange_identification: Connection closed by remote host
Connection closed by UNKNOWN port 65535

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• OPA Gateway

What resolves the SSH configuration file issue?

Review the contents of the affected client's SSH configuration file, locate any incompatible entries, and remove them to allow subsequent SSH attempts to succeed.

1. Open the SSH configuration file on the affected client machine. On macOS, this file is located at ~/.ssh/config.
2. Review the file for problematic entries, such as parameters containing special characters like = or configurations attempting to load a custom SSH toolset like Fig.
3. Remove the offending entry from the configuration file.
4. Attempt the SSH connection again.

An incremental approach identifies the problematic parameter.

Isolate the specific problematic parameter by commenting out all entries and incrementally uncommenting them to test the connection.

1. Comment out all entries in the SSH configuration file.
2. Uncomment one parameter at a time.
3. Test the SSH connection after uncommenting each parameter to determine which one introduces the issue.