Search Results

Agent error code #AWS003 indicates that AWS rate-limited the request. AWS returns Throttling or RequestLimitExceeded in this situation. This is a transient condition. The grant is retried, and in most cases it succeeds on a later attempt without any action. ...

Agent error code #AWS050 indicates that AWS could not find the security group configured on the knoc. AWS returns InvalidGroup.NotFound or InvalidGroupId.Malformed in this situation. Common causes include: The security group was deleted after the knoc was co...

Agent error code #AWS051 indicates that AWS refused a value in the request. AWS returns InvalidParameterValue, InvalidParameter or MalformedInput in this situation. The credentials and the security group were both accepted. Something in the rule the agent t...

Agent error code #AWS100 indicates that Knocknoc could not read the current rules on the security group. This read runs before any change is made to the group, so the grant stops here. More specific causes report their own codes: rejected credentials report #A...

Agent error code #AWS101 indicates that the call adding a rule to the security group failed for a reason the agent could not attribute to a more specific cause. This is the operation that grants a user access. More specific causes report their own codes: rejec...

Agent error code #AWS102 indicates that the call removing a rule from the security group failed. Access that should have been withdrawn may still be in place. More specific causes report their own codes: rejected credentials report #AWS001, a missing permissio...

Agent error code #204000 is legacy. Current agents manage network security groups through the Azure SDK and do not need the Azure CLI, so a current agent does not produce this code. If you see #204000, the agent is an older version that shelled out to the az ...

Agent error code #204001 indicates that the service principal on the knoc failed to authenticate with Entra ID. The agent signs in with the service principal before it manages NSG rules, and Entra ID refused the credentials. Common causes include: The client I...

Agent error code #204050 indicates that Knocknoc could not read the rules on the network security group, or read them and could not parse the response. This read runs before any change is made to the NSG, so the grant stops here. Common causes include: The NSG...

Agent error code #204051 indicates that the agent could not create an NSG rule. This is the operation that grants a user access. Common causes include: The service principal can read the NSG but not modify it The NSG has reached its rule limit Another process ...

Agent error code #204052 indicates that the agent could not delete an NSG rule while revoking a grant. Access that should have been withdrawn may still be in place. Common causes include: The service principal can create rules but not delete them A resource lo...

Agent error code #204053 indicates that the agent could not find a free priority number to create the rule with. Every NSG rule needs a unique priority, and the agent searches the range 500 to 4096 for one that is unused. This code means either every priority ...

Agent error code #NFT000 indicates that the agent could not run the nft binary on the host it is running on. The nftables backend drives the kernel ruleset by shelling out to nft, so without that binary no grant can be applied. The agent reports this when it...

Agent error code #NFT001 indicates that nft is present on the host but the agent has no way to run it with the privileges it needs. Changing the kernel ruleset requires root, and the agent is neither running as root nor able to escalate. The agent never hardc...

Agent error code #NFT002 indicates that the set name configured on the knoc is not a fully qualified nftables set reference. The agent requires the <family>:<table>:<set> form, for example inet:knocknoc:knoc_ssh_v4. An unqualified name is ambiguous, because ...

Agent error code #NFT003 indicates that the knoc uses the nftables backend but names no set at all, in either address family. Nothing it grants would ever be applied, so the agent has nowhere to add an address. This is reported by Validate integration on the k...

Agent error code #NFT050 indicates that the configured set could not be found on the agent host. The kernel, not a cached listing, is the authority here: at grant time the code is raised only when nft itself reported the set or its table as missing. It is als...

Agent error code #NFT051 indicates that the address could not be added because it overlaps an entry already in the set. An nftables set declared with flags interval stores ranges and rejects an element that overlaps one it already holds, rather than merging t...