5

When I work on my server remotely, sometimes my SSH connections get dropped due to network issues. When I re-connect to my server, the dropped sessions remain open. I can see them when I run w.

I'm aware that I can kill them using their PID, but I would like to auto-kill dropped sessions, if that's possible.

How can I achieve that?

Improve this question

2 Answers 2

Reset to default
7

Enable one of the SSH keepalive messages, for example by enabling TCPKeepAlive or ClientAliveInterval in the server's sshd config.

Similarly, in the client config you can use TCPKeepAlive and ServerAliveInterval.

TCPKeepAlive used to just be KeepAlive, if you have an old version of OpenSSH.

TCP keepalives are a feature that is part of TCP, and operates outside the encrypted tunnel built by SSH. So someone could, for example, spoof them to pretend the connection is still open when it isn't.

ClientAlive/ServerAlive operates inside the encrypted tunnel, so it can't be spoofed (but I believe it's a new option, and of course costs more CPU time).

Improve this answer
5
  • I already have TCPKeepAlive yes in my sshd_config file, it doesn't seem to help...
    – eden881
    Apr 29, 2016 at 18:58
  • 1
    @eden881 how long have you waited? TCP keepalives will probably take hours to time out the connection. You can tune that, system-wide, see /proc/sys/net/ipv4/tcp_keepalive_* (Client/ServerAliveInterval can be set much quicker).
    – derobert
    Apr 29, 2016 at 19:05
  • @eden881 e.g., the settings here (which I think are default) are the first keepalive is sent 2 hours after the last bit of data was sent, then probes are sent every 75 seconds. If no response is received after 9 probes, then the connection is killed. So, all in all almost 2¼ hours after the network dies, TCP keepalives will kill the connection.
    – derobert
    Apr 29, 2016 at 19:09
  • Ok, and how can I change those values in a way that survives reboots?
    – eden881
    Apr 29, 2016 at 19:15
  • @eden881 /etc/sysctl.conf or /etc/sysctl.d/ (I'm sure we have a question about those somewhere on the site) — but you might want to think long and hard about reducing it, connections being reset because the network went down for 15 minutes are really annoying too. Especially if the dead sessions staying around aren't really causing a problem.
    – derobert
    Apr 29, 2016 at 19:24
0

They should get closed as soon as the TCP timeout is reached or KeepAlive messages do not receive any answer from your old connection. There is nothing to worry about.

If they don't, there is some bug in the openssh, which should get reported upstream.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .