3

When I work on my server remotely, sometimes my SSH connections get dropped due to network issues. When I re-connect to my server, the dropped sessions remain open. I can see them when I run w.

I'm aware that I can kill them using their PID, but I would like to auto-kill dropped sessions, if that's possible.

How can I achieve that?

5

Enable one of the SSH keepalive messages, for example by enabling TCPKeepAlive or ClientAliveInterval in the server's sshd config.

Similarly, in the client config you can use TCPKeepAlive and ServerAliveInterval.

TCPKeepAlive used to just be KeepAlive, if you have an old version of OpenSSH.

TCP keepalives are a feature that is part of TCP, and operates outside the encrypted tunnel built by SSH. So someone could, for example, spoof them to pretend the connection is still open when it isn't.

ClientAlive/ServerAlive operates inside the encrypted tunnel, so it can't be spoofed (but I believe it's a new option, and of course costs more CPU time).

  • I already have TCPKeepAlive yes in my sshd_config file, it doesn't seem to help... – eden881 Apr 29 '16 at 18:58
  • 1
    @eden881 how long have you waited? TCP keepalives will probably take hours to time out the connection. You can tune that, system-wide, see /proc/sys/net/ipv4/tcp_keepalive_* (Client/ServerAliveInterval can be set much quicker). – derobert Apr 29 '16 at 19:05
  • @eden881 e.g., the settings here (which I think are default) are the first keepalive is sent 2 hours after the last bit of data was sent, then probes are sent every 75 seconds. If no response is received after 9 probes, then the connection is killed. So, all in all almost 2¼ hours after the network dies, TCP keepalives will kill the connection. – derobert Apr 29 '16 at 19:09
  • Ok, and how can I change those values in a way that survives reboots? – eden881 Apr 29 '16 at 19:15
  • @eden881 /etc/sysctl.conf or /etc/sysctl.d/ (I'm sure we have a question about those somewhere on the site) — but you might want to think long and hard about reducing it, connections being reset because the network went down for 15 minutes are really annoying too. Especially if the dead sessions staying around aren't really causing a problem. – derobert Apr 29 '16 at 19:24
0

They should get closed as soon as the TCP timeout is reached or KeepAlive messages do not receive any answer from your old connection. There is nothing to worry about.

If they don't, there is some bug in the openssh, which should get reported upstream.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.