I'm looking for an effective way to kill idle login sessions (console, ssh, etc). There are tons of answers on the internet on how to do this, but they all cover only very basic use cases.
The requirements are:
- The setting must apply to all login sessions (login session being defined as a pam session).
- It must not be overridable by the user.
- It must be difficult / impossible to fool. Unfortunately this is a bit of a subjective requirement. If the user puts a drinking bird on their keyboard, then that's not worth protecting against. But if they can just set a setting in their ssh client config, or shell profile to effectively neutralize the timeout, then that should be protected against.
- Activity is defined as any IO on the SSH stream (before encryption). Though worst case it could be defined as IO on the TTY/STDIN/STDOUT/STDERR. The former is preferred as things like ssh tunneling should keep it active. But with a high enough timeout (hours), the latter would be acceptable.
The solutions which do not work:
Cron job parsing
This doesn't work because not all sessions will show up in this list. For example you can do
ssh foo.example.com bash, and this session will not show up in the list.
You can also do
ssh -N foo.example.com, or a background
ControlMaster process, which will not show up.
This is another recommendation I see a lot, and it doesn't work as killing idle connections is not at all what it was meant to do. These settings were meant to detect and kill dead connections, not idle ones.
These settings are very easy to bypass by setting
ServerAliveInterval on the client.
This is a very weak solution as it requires a shell, and is easily overridden by the user.