The user is unable to establish a Secure Shell (SSH) connection through Advanced Server Access (ASA) or Okta Privileged Access (OPA). The failure occurs on the client and presents with a specific permission denied error. The exact error message displayed is:

/usr/bin/bash: Permission denied

This issue primarily affects Windows clients that are using a custom terminal or an emulated Linux-style terminal.

• ASA or OPA
• Windows Client
• Custom terminals or emulated Linux-style terminals (for example, Windows Subsystem for Linux (WSL), GitBash)

The error occurs when the SSH operation is attempted from a custom terminal, typically on a Windows client running an emulated Linux-style terminal (such as WSL or GitBash).

The SSH flow causes the emulation layer to try to invoke the path /usr/bin/bash, which does not actually exist on the Windows client, resulting in the error. Custom tools may include utilities that mimic Linux paths and executables, and when the sft client launches its SSH proxy process, these mimicked paths may get invoked. Additionally, endpoint security products may be blocking these non-native executables.

This process results in the SSH flow failing locally on the client before it can connect to the target server, so no related activity appears in the server-side logs.

1. Identify whether the affected client is running an emulated or custom terminal that is not officially supported, such as Windows Subsystem for Linux (WSL) or Git for Windows.

2. If an unsupported client is in use, remove the unsupported tools and instead use a native Windows PowerShell or Command Prompt session.

3. Alternatively, use one of the officially supported non-native Windows SSH clients: 

   1. Cygwin

   2. MobaXterm

   3. PuTTY

Related References

• Configure clients for use with Advanced Server Access