Ytdyklly

I can't seem to find an answer to this simple question, which I need for some compliance documentation.

On a default install of CentOS 6.5 (OpenSSH 5.3p1-94.el6), after how long of being idle will a user's SSH session be terminated? I believe the following can be set to increase the idle timeout, but they are commented out by default.

$ grep -i alive /etc/ssh/sshd_config

#TCPKeepAlive yes

#ClientAliveInterval 0

#ClientAliveCountMax 3

Also, is there a command to dump a list of the current sshd settings? I don't see anything in man sshd.

The commented lines in sshd_config usually display the defaults. This is the case with all of the lines in your question. You can verify this in the sshd_config manpage. Here are the relevant snippets:

TCPKeepAlive

Specifies whether the system should send TCP keepalive messages to the other side.  If they are sent, death of the
connection or crash of one of the machines will be properly noticed.  However, this means that connections will die
if the route is down temporarily, and some people find it annoying.  On the other hand, if TCP keepalives are not
sent, sessions may hang indefinitely on the server, leaving “ghost” users and consuming server resources.



The default is “yes” (to send TCP keepalive messages), and the server will notice if the network goes down or the
client host crashes.  This avoids infinitely hanging sessions.





To disable TCP keepalive messages, the value should be set to “no”.





This option was formerly called KeepAlive.

ClientAliveCountMax

Sets the number of client alive messages (see below) which may be sent without sshd(8) receiving any messages back
from the client.  If this threshold is reached while client alive messages are being sent, sshd will disconnect the
client, terminating the session.  It is important to note that the use of client alive messages is very different
from TCPKeepAlive (below) (above).  The client alive messages are sent through the encrypted channel and therefore will not
be spoofable.  The TCP keepalive option enabled by TCPKeepAlive is spoofable.  The client alive mechanism is
valuable when the client or server depend on knowing when a connection has become inactive.



The default value is 3.  If ClientAliveInterval (see below) is set to 15, and ClientAliveCountMax is left at the
default, unresponsive SSH clients will be disconnected after approximately 45 seconds.  This option applies to protocol version 2 only.

ClientAliveInterval

Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a
message through the encrypted channel to request a response from the client.  The default is 0, indicating that
these messages will not be sent to the client.  This option applies to protocol version 2 only.

You can set up SSH keepalive for either the client or server side:

Client side

File: /etc/ssh/ssh_config

Content:

Host *

ServerAliveInterval XX

ServerAliveCountMax YY

Server side

File: /etc/ssh/sshd_config

Content:

ClientAliveInterval XX

ClientAliveCountMax YY

Extracted from: http://www.sysadmit.com/2016/02/linux-y-vmware-ssh-evitar-desconexion.html

OpenSSH will not terminate a shell session that has been idle for some time. This is not something that OpenSSH does. Terminating an idle shell session is unrelated to the configuration of OpenSSH.

The settings that you are showing are related to timeouts when the connection goes down and are unrelated to the shell on the remote host and what the user is doing or not doing there.

To dump the sshd configuration, use the "extended test mode" as root:

sshd -T

This is documented in the sshd(8) manual (looking at OpenSSH_7.7, LibreSSL 2.7.2 on OpenBSD here):

-T

Extended test mode. Check the validity of the configuration
file, output the effective configuration to stdout and then exit.
Optionally, Match rules may be applied by specifying the
connection parameters using one or more -C options.

This option was added to sshd for OpenSSH 5.1/5.1p1 in 2008.

If the requirement is to close the SSH connection after a period of inactivity, the shells themselves provide timeout variables.

For bash:

TMOUT: If set to a value greater than zero, TMOUT is treated as
the
default timeout for the read builtin. The select command terminates
if input does not arrive after TMOUT seconds when input is coming from a terminal. In an interactive shell, the value is
interpreted as the number of seconds to wait for input after issuing
the primary prompt. Bash terminates after waiting for that number of
seconds if input does not arrive.

test this by running TMOUT=10 and wait for 10 sec to close the connection.

For tcsh:

The autologout shell variable can be set to log out or lock the shell
after a given number of minutes of inactivity.

In tcsh, the syntax for setting the timeout for ten minutes is set autologout=10. This doesn't work in the original csh.

If you want the timeout to be 10 seconds for everyone, do the following for the server config (sshd_config):

ClientAliveInterval 10

ClientAliveCountMax 0

If you want the timeout to be 10 seconds for local clients, do the following for the client config (ssh_config):

ServerAliveInterval 10

ServerAliveCountMax 0

If the AliveCountMax parameter is non-zero, it probably won't work because the server will reply resetting the timer (unless there's a connection problem). You can see this by running the ssh client with debugging turned on.