Close SSH Connection Idle Timeout no Key Pressed
Secure Shell (SSH) is a widely-used protocol for securely accessing remote servers. By default, some SSH clients, such as OpenSSH, do not automatically close an SSH session after a certain period of inactivity. This can lead to orphaned sessions and resource utilization issues on the server.
SSH Idle Timeout Basics
When a user establishes an SSH session with a remote server and does not interact with it for some time, the session is considered idle. Different systems and configurations have varying defaults for idle timeout; some don't have a timeout at all. In such cases, sessions can remain active indefinitely until explicitly closed by the user or administrator.
Implications of Orphaned SSH Sessions
Orphaned SSH sessions can pose several issues:
- Resource utilization: Orphaned sessions may consume system memory, CPU cycles, and other resources, negatively affecting overall system performance.
- Security: Open SSH sessions could potentially allow unauthorized access if a user forgets to close them.
- Accounting: Orphaned sessions might interfere with accurate user activity tracking and accounting.
How to Close SSH Idle Sessions
Admins and users can take various steps to address idle SSH sessions:
Configure Client-side Settings
Some popular SSH clients, such as PuTTY and OpenSSH clients, allow configuring client-side settings to automatically close idle sessions:
PuTTY:
In the PuTTY configuration window, navigate to "Connection > SSH > Timeout". Set the "Seconds between keepalives" field, which sends a null packet at the specified interval to keep the connection active. Also, set the "Keepalives" option to "Send".
OpenSSH Client:
In the ~/.ssh/config file (create it if it doesn't exist), add this line:
Host *\
ServerAliveInterval 60\
ServerAliveCountMax 120This configuration will send a null packet approximately every minute (60 seconds) and stop trying to reconnect after two hours (120 attempts * 60 seconds per attempt).
Configure Server-side Settings
Administrators can configure the server-side settings to close idle SSH sessions. Common server-side solutions include:
TMOUT Variable:
Set the TMOUT variable in /etc/profile or ~/.bashrc to specify the timeout for all interactive shells (including SSH sessions):
export TMOUT=3600This will close any idle shell session after one hour (3600 seconds).
Using TCP Keepalive:
TCP keepalive is a mechanism that probes the connection status at regular intervals. Enable TCP keepalive by adding these lines in the /etc/ssh/sshd_config file:
ClientAliveInterval 60\
ClientAliveCountMax 120This configuration will send a null packet at regular intervals (60 seconds) and stop probing after two hours (120 attempts * 60 seconds per attempt).
mux and SSH Data Connections
Using tools like screen or tmux can keep a master SSH session active
```less
even when detached. These tools can prevent data connections from being closed, while the actual SSH session may still timeout due to idle settings. Using a combination of client-side and server-side settings alongside these tools can result in the most optimal configuration for handling idle SSH sessions.
- SSH idle timeout sessions can cause resource utilization and security issues on remote servers.
- Configuring client-side or server-side settings can address idle SSH sessions.
- Using TCP keepalive, TMOUT, or SSH clients' configuration options can automatically close idle SSH sessions.
- Tools like
screenandtmuxmaintain master SSH sessions even when detached while allowing separate data connections.