Post #31

惊人的事实: sshd 居然没有 idle connection timeout! 几乎所有人都经历过 ssh remote shell 放置一段时间就连接断掉的情况, 记得刚工作的时候配置 terminal 的 ssh 保活是我的必备, 我一直以为 sshd 有 idle timeout 这一功能, 就像 redis 的 TIMEOUT 一样, 今天发现居然并没有. 唯一相关的三个选项是: TCPKeepAlive Specifies whether the system should send TCP keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find it annoying. On the other hand, if TCP keepalives are not sent, sessions may hang indefinitely on the server, leaving “ghost” users and consuming server resources. The default is “yes” (to send TCP keepalive messages), and the server will notice if the network goes down or the client host crashes. This avoids infinitely hanging sessions. To disable TCP keepalive messages, the value should be set to “no”. This option was formerly called KeepAlive. ClientAliveCountMax Sets the number of client alive messages (see below) which may be sent without sshd(8) receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from TCPKeepAlive (below) (above). The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by TCPKeepAlive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive. The default value is 3. If ClientAliveInterval (see below) is set to 15, and ClientAliveCountMax is left at the default, unresponsive SSH clients will be disconnected after approximately 45 seconds. This option applies to protocol version 2 only. ClientAliveInterval Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client. This option applies to protocol version 2 only. tcpkeepalive 是在 tcp 层做保活, clientalive 是在 ssh 层做保活, 断开连接的情况仅限于心跳检查失败 sshd 才主动断连接, 并不是 idle timeout. 也就是说大家所遭遇的 idle timeout 都是防火墙搞的….