1

In response to ClientAliveInterval and ClientAliveCountMax restrictions server side, a client can choose to send null packets by setting ServerAliveInterval and ServerAliveCountMax values appropriately.

How can I still ensure that a session is considered valid only if there has been legitimate data exchanged (i.e. non-null packets)? Essentially how do I make the SSH server ignore all null packets from the client?

If the client goes out of their way to write a loop using top or a dummy shell script to keep session alive, that's a different issue since it's an active act of leaving a session open. I am trying to prevent a session kept open when the user has locked their screen or walked away for a prolonged period.

Thanks.

EDIT: for further clarity I must add that the server in question here is an SSH jump server on which a user will not be allowed to obtain TTY. Hence relying simply on sshd_config is not sufficient.

1 Answer 1

1

Since it's (the lack of) terminal activity you're interested in, it's at that level that you should check for idleness.

Fortunately bash has a built-in idle function and will exit if you set the TMOUT variable to a number of seconds, and that number of seconds elapses without the shell doing anything. There is no effect while the shell has a command in the foreground.

To prevent the user from overriding this, you would make the variable readonly.

Putting this all together, you would create a file /etc/profile.d/tmout.sh which contains:

TMOUT=900
readonly TMOUT
export TMOUT

This would cause the shell to exit if the shell is idle for 15 minutes (900 seconds). Making it readonly means that variable cannot be changed again in the same shell session.

6
  • This works until you get some smart-alec who runs exec tcsh; unsetenv TMOUT; exec bash. TMOUT is now unset.
    – doneal24
    Nov 20, 2018 at 17:38
  • @DougO'Neal Yes, you could get around it that way. But your quality of life would suffer... Nov 20, 2018 at 17:56
  • Yes, but the suffering can now continue forever.
    – doneal24
    Nov 20, 2018 at 18:15
  • Indeed. But that doesn't seem to be the scenario the user wants to address. Nov 20, 2018 at 18:20
  • That's right.. so here's the full setup. The server in question where I want to enforce this is a jump server. I plan to disallow TTY. The concern is that I don't want users to leave their session open through the jump server - they are free to use tmux or screen on the target but I don't want to give them shell on the jump server. However setting the sshd_config values is insufficient for this purpose. Nov 20, 2018 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .