4

I'm trying to zero in on the exact option, or combination of options, that will force each SSH session to be terminated when inactive for a specified time. I'm using Putty to SSH to a RHEL AS3 server; keepalives are set to "off" (0) for Putty, and keepalives are commented-out in the ssh_config and sshd_config files.

I've Google-bounced to different places, and I've found some tidbits on ServerFault, but I'm hoping to find a "concrete" solution. I've tried modifying the /etc/ssh/sshd_config file by adding this:

ClientAliveInterval 15 ClientAliveCountMax 1

(It's set at 15 seconds for testing)

Then restarted SSH:

/sbin/service sshd restart

But no luck; the session never timed out (checked back after 23 minutes). I also tried modifying the "keepalive" kernel parameters:

% echo "60" > /proc/sys/net/ipv4/tcp_keepalive_time (default was 7200)

% echo "1" > /proc/sys/net/ipv4/tcp_keepalive_probes (default was 9)

% echo "5" > /proc/sys/net/ipv4/tcp_keepalive_intvl (default was 75)

But the session remained active (checked back after 8 minutes). Any help on what piece of the puzzle I'm missing would be greatly appreciated. Thanks!

--- DT

Dizzle
  • 175
  • 1
  • 2
  • 8

7 Answers7

3

I'm using export TMOUT=3600 in my ~/.bashrc to close an inactive session after 1 hour.

ThorstenS
  • 3,122
  • 19
  • 21
3

Most of what you are setting look tcp settings. You need to tell your shell to log you out. The comment about setting TMOUT=3600 for an hour is one that I have scored up. You may want to put this in the global profile (/etc/profile)

tcp keepalives are all to do with how often packets are sent to keep a tcp session active. eg if there was not traffic for a minute and the tcp keep alive was set to 60 seconds then a keep alive packet would be sent to keep the session active. This is a reasonable set of descriptions of the various tcp variables

James
  • 2,232
  • 1
  • 13
  • 19
  • This is great information James, especially the TCP variables link. You were able to describe what I was slowly trying to peel apart in my head, but several of the links I came across kept mentioning the idle timeout and keepalives as if they were the same thing. Thanks for your help! – Dizzle Jul 26 '09 at 12:33
1

I've got ClientAliveInterval 600 ClientAliveCountMax 0 and it works

Jure1873
  • 3,702
  • 1
  • 22
  • 28
  • Thanks Jure, but I tried your settings and it didn't time out. -- D – Dizzle Jul 23 '09 at 21:50
  • did you restart the sshd after this and reconnected? otherwise the old config is used for this connection. – ThorstenS Jul 23 '09 at 22:21
  • My apologies Jure/Thorsten, I retried and it worked. Hmmm...I was sure that I'd logged out/in after restarting sshd, but maybe not. I think I was bouncing around too much and not fully understanding the different pieces. Thanks to both of you; between this, TMOUT, and the idled suggestion below, I think I'm well equipped now. – Dizzle Jul 26 '09 at 12:52
0

Have you tried setting the IdleTimeout value? That's an old setting, but I'm not sure what version of ssh you're running, so it may still work. You can also set the idle-timeout on the client-side. Personally, I'd bump the keepalive settings up to something that would normally be set, like 600 seconds with 3 keepalives, and see if that works.

James
  • 407
  • 2
  • 4
  • I found that just after posting this, but sshd screamed at me during the restart attempt ("bad option"), and when I changed back to the original sshd_config and attempted another sshd restart, I was booted off. I actually had to go to the console to start sshd up again. I quick-scanned a forum/blog that mentioned specific distros that work with IdleTimeOut? – Dizzle Jul 23 '09 at 22:14
  • Just saw your edited reply; I definitely want to do something server-side, so I'll make a more concerted effort to find an IdleTimeOut setting compatible with my setup. I did try longer keepalive settings, per Jure above, but no luck. Thanks James! – Dizzle Jul 23 '09 at 22:17
0

I'm a fan of idled. Yes, it's an extra userspace daemon, but it works beautifully.

http://www.itworld.com/nls_unix_login2

Source tarball: http://sourceforge.net/projects/idled/files/idled/

(Original link was: http://www.netsw.org/system/tools/process/ but it seems to be down at the moment)

MikeyB
  • 39,291
  • 10
  • 105
  • 189
oo.
  • 861
  • 6
  • 11
  • Just started reading the link you sent; this tool looks great so far, I'll start playing with it this week. Thanks! – Dizzle Jul 26 '09 at 12:42
0

have you checked if there was an IP confliction with your server? I experienced this case when setting up a virtual server of CentOS with VMWare Workstation and use bridged option. The virtual server works fine at first but around an hour later, my putty ssh session is disconnected from the server quickly after retrying to connect.

Doan Vu
  • 121
  • 3
0

If you want to timeout remote commands that are started non-interactively using ssh, you could use something like this :

( sleep $timeout && kill -9 0 ) 2>/dev/null & $cmd; RC=$? ; pkill -P $! ; exit $RC;
Frank
  • 1