I have already written about how to deny access to users using OpenSSH. Today I am going to write about another interesting problem that can cause ssh connection time outs and how to increase SSH connection timeout in macOS, Linux, *BSD and Unix-like systems.
Basically, this is a security feature. Ssh connection freezes or drops out after N minutes of inactivity. According to the official OpenSSH man page:
This is usually the result of a packet filter or NAT device timing out your TCP connection due to inactivity. For security, reason most enterprises only use SSH protocol version 2. This problem only occurred with version 2.
If you work long hours using ssh and left workstation for some other work, your connection will be dropped by the remote server. It is a little annoying problem for me. So we can to get rid of this problem as follows.
Fix OpenSSH Server connection drops out after few minutes of inactivity
First, log into the remote server and then open your /etc/ssh/sshd_config file:
# vi /etc/ssh/sshd_config
Modify setting as follows:
- ClientAliveInterval: Sets a timeout interval in seconds (30) after which if no data has been received from the client, sshd will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client. This option applies to protocol version 2 only.
- ClientAliveCountMax: Sets the number of client alive messages (5) which may be sent without sshd receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session.
Close and save the file. Restart the sshd service:
# /etc/init.d/ssh restart
## OR ##
# service sshd restart
## For Linux+systemd ##
# systemctl restart sshd.service
Increase SSH connection timeout using client side configuration
Another option is to enable ServerAliveInterval option in the client’s $HOME/.ssh/ssh_config file. Very useful when you don’t have access to remote servers’ sshd config file. Open the terminal application and then type the following command:
$ vi ~/.ssh/ssh_config
Append/modify values as follows:
- ServerAliveInterval 15 : Sets a timeout interval in seconds after which if no data has been received from the server, ssh will send a message through the encrypted channel to request a response from the server. For example, set a timeout to 15 seconds.
- ClientAliveInterval 3 : Sets the number of server alive messages which may be sent without ssh command receiving any messages back from the server. If this threshold is reached while server alive messages are being sent, ssh will disconnect from the server, terminating the session. The server alive messages are sent through the encrypted channel and therefore will not be spoofable.
For example, when ServerAliveInterval is set to 15 and ServerAliveCountMax is left at the 3, if the server becomes unresponsive, ssh will disconnect after approximately 45 seconds. Again this option applies to protocol version 2 only. You can add above options in the /etc/ssh/ssh_config file on client side for all users too. See the following tutorials for more information:
- Top 20 OpenSSH Server Best Security Practices
- How To Set up SSH Keys on a Linux / Unix System
- keychain: Set Up Secure Passwordless SSH Access For Backup Scripts
We can also use Mosh (mobile shell) to connect from a desktop to a server. It is similar to SSH, with additional features meant to improve usability for mobile users, especially when the frequent discussion happens. Please read the man pages of ssh, sshd and sshd_config/ssh_config for more information online here or by typing the following man command:
$ man sshd_config
$ man sshd_config
$ man sshd
|Category||List of Unix and Linux commands|
|Firewall||CentOS 8 • OpenSUSE • RHEL 8 • Ubuntu 16.04 • Ubuntu 18.04 • Ubuntu 20.04|
|Network Utilities||dig • host • ip • nmap|
|OpenVPN||CentOS 7 • CentOS 8 • Debian 10 • Debian 8/9 • Ubuntu 18.04 • Ubuntu 20.04|
|Package Manager||apk • apt|
|Processes Management||bg • chroot • cron • disown • fg • jobs • killall • kill • pidof • pstree • pwdx • time|
|Searching||grep • whereis • which|
|User Information||groups • id • lastcomm • last • lid/libuser-lid • logname • members • users • whoami • who • w|
|WireGuard VPN||CentOS 8 • Debian 10 • Firewall • Ubuntu 20.04|