Search Results

Agent error code #NFT001 indicates that nft is present on the host but the agent has no way to run it with the privileges it needs. Changing the kernel ruleset requires root, and the agent is neither running as root nor able to escalate. The agent never hardc...

Agent error code #NFT002 indicates that the set name configured on the knoc is not a fully qualified nftables set reference. The agent requires the <family>:<table>:<set> form, for example inet:knocknoc:knoc_ssh_v4. An unqualified name is ambiguous, because ...

Agent error code #NFT003 indicates that the knoc uses the nftables backend but names no set at all, in either address family. Nothing it grants would ever be applied, so the agent has nowhere to add an address. This is reported by Validate integration on the k...

Agent error code #NFT050 indicates that the configured set could not be found on the agent host. The kernel, not a cached listing, is the authority here: at grant time the code is raised only when nft itself reported the set or its table as missing. It is als...

Agent error code #NFT051 indicates that the address could not be added because it overlaps an entry already in the set. An nftables set declared with flags interval stores ranges and rejects an element that overlaps one it already holds, rather than merging t...

Agent error code #NFT052 indicates that nft add element failed for a reason the agent could not attribute to a more specific cause. The set was not reported missing and the element was not reported as overlapping, so the failure came from the command itself. ...

Agent error code #NFT053 occurs when a knoc's predefined source is a network, such as 192.168.100.48/29, and the nftables set the knoc points at was declared without flags interval. A set without flags interval stores single addresses only, and nft refuses...

Agent error code #NFT100 indicates that nft delete element failed while revoking a grant. The address is likely still in the set, which means access that should have been withdrawn is still in place. An element that is already gone is not this error. The kern...

Agent error code #NFT400 indicates that the agent could not read the nftables sets. Either the listing command failed, or it ran and returned output the agent could not parse. The agent reads the ruleset in JSON form, so anything that disturbs that output land...

Agent error code #205001 means the agent encountered a filesystem error while reading the nginx allow/deny include file. Steps to Resolve Confirm the file is owned (or at least readable) by the knocknoc-agent user: sudo chown knocknoc-agent /etc/nginx/acl/mys...

Agent error code #205002 means the agent could not rewrite the nginx allow/deny include file. The agent writes to a temp file in the same directory and renames it into place; both steps must succeed. Steps to Resolve Ensure /etc/nginx/acl/ exists on the agent...

Agent error code #205050 means the agent ran sudo -n nginx -s reload after editing the include file, but the reload failed. The new ACL is on disk; nginx has not picked it up yet. Steps to Resolve Run sudo nginx -t on the agent host to check the running conf...

Agent error code #OKTA000 indicates that the agent could not reach the Okta REST API at the configured domain. The request failed before any authentication or network-zone operation could take place. This error is distinct from authentication failures (#OKTA00...

Agent error code #OKTA001 indicates that the Okta API rejected the API token in the agent's Authorization: SSWS <token> header. Okta returned HTTP 401 Unauthorized. This error is distinct from authorization failures (#OKTA002), which occur when the token is v...

Agent error code #OKTA002 indicates that the Okta API authenticated the agent's token but rejected the network-zone request with HTTP 403 Forbidden. The admin role behind the token lacks the permissions required to read or update network zones. This error is d...

Agent error code #OKTA003 indicates that the agent's TLS handshake with the configured Okta domain failed. The certificate presented by the endpoint could not be verified against the system trust store. This error is distinct from connection failures (#OKTA000...

Agent error code #OKTA004 indicates that a request to the configured Okta domain did not complete within the agent's HTTP timeout. This error is distinct from connection failures (#OKTA000), which mean the connection never established at all. Error #OKTA004 me...

Agent error code #OKTA005 indicates that Okta rejected the request with HTTP 429 Too Many Requests. The agent has hit the per-org rate limit on the network-zones API. Okta publishes its rate limits at Okta rate limits. The network-zones endpoint shares a bucke...