Configure SSH to clear connections after a specified period of client idleness
This document (7009025) is provided subject to the disclaimer at the end of this document.
Environment
SUSE Linux Enterprise Server 10
Situation
It is desired that the sshd server should clear ssh connections after a specified period of client idleness.
Resolution
Older sshd versions can disconnect clients who are idle, due to a side-effect of how the "Client Alive" mechanism was designed. It should be noted that the Client Alive mechanism is actually intended to detect and react to dead clients or broken network pipes, not mere idleness. However, for a lot of the history of openssh, disconnecting idle clients was possible. That design changed in openssh 8.2, so this side-effect ability no longer exists in 8.2 or higher.
This means, for example, that in SLES 15 SP3 and higher, the following method is no longer possible.
Edit the /etc/ssh/sshd_config file.
Un-remark or add the ClientAliveInterval parameter and set it to the number of seconds (of idleness) that sshd should wait before terminating the connection.
Un-remark or add the ClientAliveCountMax and set it to 0.
Restart sshd.
Additional Information
An example configuration would be:
ClientAliveInterval 600
ClientAliveCountMax 0
In openssh 8.1 or below, the sshd server would clear any ssh sessions that have been inactive for 10 minutes (600 seconds).
However, in openssh 8.2 or above, he meaning of "ClientAliveCountMax 0" has changed to mean "Disable the Client Alive feature of connection termination."
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:7009025
- Creation Date: 20-Jul-2011
- Modified Date:28-Oct-2024
-
- SUSE Linux Enterprise Server
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com