How do I stay logged in while ClientAliveInterval is set?

Question

For compliance reasons all of my Debian servers are set to timeout after 15 minutes using the following configuration in /etc/ssh/sshd_config

ClientAliveInterval 900
ClientAliveCountMax 0

Of course this makes operating on these servers annoying and dangerous as any idle time could potentially disconnect.

I am looking for a simple command that will keep a client session alive without modifying the existing configuration.

Answer 1

If you are following a security technical implementation guideline it currently states

ClientAliveInterval                        600
ClientAliveCountMax                        0

that will disconnect and idle ssh session (i.e. a putty window) after 10 minutes.

In RHEL 7 the default values for those two items, from a clean install from rhel-server-7.9-x86_64-dvd.iso, or centos, is 0 and 3 respectively which results in an ssh session never auto terminating.

see for more detail: https://stackoverflow.com/questions/71174746/clientaliveinterval-is-not-closing-the-idle-connection

most relevant: These are not for user-idle circumstances, they are - as that man page excerpt notes - for unresponsive SSH clients. The client will be unresponsive if the client program has frozen or the connection has been broken. The client should not be unresponsive simply because the human user has stepped away from the keyboard: the ssh client will still receive packets sent from the server.

It is at the client, in putty.exe, under Connection and Options for controlling the connection there is seconds between keepalives (0 to turn off). That by default is 0. Set that to a number less than the ClientAliveInterval set in sshd_config.

If not using putty.exe, from Windows, and using ssh from another linux box, then the client ssh is config'd via /etc/ssh/ssh_config however there is no corresponding item in there that I am aware of to send a keepalive packet every so often.

Note: using putty.exe from windows with its default keepalive of 0, and the ssh server having a ClientAliveInterval set, even having vi open will get disconnected resulting in a lost file that vi will recover via its .swp file. Or if running a program constantly spitting output, that is from the server side and the ssh connection will get terminated killing your job... there has to be something from the client side (a key press) that counts and causes a keepalive. So with putty.exe from Windows it's a fairly easy fix, for ssh from linux to linux I don't know how to prevent disconnect without a keyboard key press at the client side in the ssh session.

update: from linux to linux it seems you need to use ssh -o and various options. See for more details: How does tcp-keepalive work in ssh?

for example: ssh -o ServerAliveInterval=5 -o ServerAliveCountMax=1

kinda like with /etc/yum.conf having gpgcheck=1, and just doing yum install --nogpgcheck :)

Answer 2

I think You disabled the configuration by setting ClientAliveCountMax to 0. So setting it to 1 should do the job.

ClientAliveCountMax

Sets the number of client alive messages which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive.

The default value is 3. If ClientAliveInterval is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds.

But I have to admit I agree with @TienPhan. It's better to keep the configuration off the server. Still it depends on the use case. If all users should be handled the same way, server side configuration is the option.

Answer 3

In fact, we don't need to set the Interval Time at Server side. More stuff won't make you happy.

You can use "ServerAliveInterval" and add it to ~/.ssh/config file as below:

host *
        ServerAliveInterval 120

Note: 120 is seconds, you can change what you want.

Then it affects to all of servers in this file. Or you can set for individual server.