https://bugzilla.mindrot.org/show_bug.cgi?id=3650
Bug ID: 3650
Summary: [RFE] Implement a global channel timeout mechanism
Product: Portable OpenSSH
Version: 9.5p1
Hardware: All
OS: OpenBSD
Status: NEW
Severity: enhancement
Priority: P5
Component: ssh
Assignee: unassigned-bugs@mindrot.org
Reporter: josh@honorablemenschen.com
The ChannelTimeout directive specifies how long a channel is allowed to
remain idle before it is closed, which (according to bug 3362) is
supposed to be used to enable idle users to be disconnected.
Unfortunately, it does not work unless you a) know exactly which
channel your user is using and b) only set the timeout for that
channel. For example:
User A logs into the SSH server with X11 forwarding enabled, then makes
an SSH connection to a remote server. Once on that server, they start
an Xterm window in the background and work in that.
User B logs into the SSH server and just starts working in that
session.
Which channel timeout should be enabled to disconnect any user that
logs in after being idle for 5 minutes? If you use session:shell then
user A will be disconnected 5 minutes after they start using the Xterm
window, no matter what they do - because their interactive shell is
idle. If you use x11-connection, then user B will never get
disconnected for being idle, because they are not using X11 forwarding.
If you use * for the channel, then you have the same problem as with
using the session:shell timeout, with the added bonus that if any users
open other channels then those channels will get disconnected after 5
minutes of idle even if the user is still active in a different
channel. None of these result in a reliable method of disconnecting
users for being idle (and ONLY for being 100% idle).
What needs to be set up is a *GLOBAL* channel timeout, which has its
idle counter reset when there's activity on *ANY* channel, and
disconnects the user from all open channels when it hits the defined
value. Otherwise there is no universal method for disconnecting idle
client sessions to replace the previously used
CLientAliveInteval/ClientAliveCountMax functionality that the
ChannelTimout was added to (theoretically) replace.
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
Bug ID: 3650
Summary: [RFE] Implement a global channel timeout mechanism
Product: Portable OpenSSH
Version: 9.5p1
Hardware: All
OS: OpenBSD
Status: NEW
Severity: enhancement
Priority: P5
Component: ssh
Assignee: unassigned-bugs@mindrot.org
Reporter: josh@honorablemenschen.com
The ChannelTimeout directive specifies how long a channel is allowed to
remain idle before it is closed, which (according to bug 3362) is
supposed to be used to enable idle users to be disconnected.
Unfortunately, it does not work unless you a) know exactly which
channel your user is using and b) only set the timeout for that
channel. For example:
User A logs into the SSH server with X11 forwarding enabled, then makes
an SSH connection to a remote server. Once on that server, they start
an Xterm window in the background and work in that.
User B logs into the SSH server and just starts working in that
session.
Which channel timeout should be enabled to disconnect any user that
logs in after being idle for 5 minutes? If you use session:shell then
user A will be disconnected 5 minutes after they start using the Xterm
window, no matter what they do - because their interactive shell is
idle. If you use x11-connection, then user B will never get
disconnected for being idle, because they are not using X11 forwarding.
If you use * for the channel, then you have the same problem as with
using the session:shell timeout, with the added bonus that if any users
open other channels then those channels will get disconnected after 5
minutes of idle even if the user is still active in a different
channel. None of these result in a reliable method of disconnecting
users for being idle (and ONLY for being 100% idle).
What needs to be set up is a *GLOBAL* channel timeout, which has its
idle counter reset when there's activity on *ANY* channel, and
disconnects the user from all open channels when it hits the defined
value. Otherwise there is no universal method for disconnecting idle
client sessions to replace the previously used
CLientAliveInteval/ClientAliveCountMax functionality that the
ChannelTimout was added to (theoretically) replace.
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs