Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227488

Re: ssh session times out annoyingly fast, why?

Show all headers | View raw

On Tue, Sep 29, 2020 at 11:13:59AM -0400, Stefan Monnier wrote:
>> In general it's kind of dumb on modern hardware to expire sessions
>> that are still exchanging TCP keepalives unless you're under extreme
>> pressure from a DoS attack or somesuch.
>
>Indeed, I'd be *very* surprised if a connection was dropped despite
>exchange of TCP keepalives.  It seems much more likely that the
>keepalives aren't used by the application (quite common and normal) or
>that they get filtered somewhere.

Nope, it's reasonably common on the internet and a complete PITA.

>> But people rarely get to choose the other end's firewall
>> configuration, so enter kludges like the ssh protocol keepalives.
>
>According to `man ssh(d)_config` one reason to use SSH's `Clientalive` or
>`ServerAlive` is that, contrary to TCP keepalives, it can't be spoofed.

The issue with spoofing is potentially *too much* keeping alive, and if 
you read further that can be relevant if you for some reason need to 
know that an ssh connection has died but (e.g.) a malicious third party 
is using TCP keepalives to prevent ssh from knowing that the other end 
is down. If the problem you're trying to solve is not enough keeping 
alive (that is, your ssh connection is dying) rather than too much 
keeping alive, this reason is irrelevant. The protocol keepalives 
*also* fix the problem of firewalls timing out connections with TCP
keepalives. I don't know why the man page doesn't just say that, maybe 
ideological opposition to accomodating firewall stupidity.

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

ssh session times out annoyingly fast, why? Britton Kerin <britton.kerin@gmail.com> - 2020-09-22 01:40 +0200
  Re: ssh session times out annoyingly fast, why? Joseph Loo <jloo20111002@gmail.com> - 2020-09-22 01:50 +0200
  Re: ssh session times out annoyingly fast, why? Toni Mas Soler <antomassol@gmail.com> - 2020-09-22 11:40 +0200
  Re: ssh session times out annoyingly fast, why? Gary Dale <gary@extremeground.com> - 2020-09-22 22:50 +0200
  Re: ssh session times out annoyingly fast, why? Anssi Saari <as@sci.fi> - 2020-09-23 21:50 +0200
    Re: ssh session times out annoyingly fast, why? Greg Wooledge <wooledg@eeg.ccf.org> - 2020-09-23 21:50 +0200
      Re: ssh session times out annoyingly fast, why? Britton Kerin <britton.kerin@gmail.com> - 2020-09-26 23:20 +0200
        Re: ssh session times out annoyingly fast, why? Greg Wooledge <wooledg@eeg.ccf.org> - 2020-09-28 14:10 +0200
      Re: ssh session times out annoyingly fast, why? Michael Stone <mstone@debian.org> - 2020-09-29 14:20 +0200
        Re: ssh session times out annoyingly fast, why? Gene Heskett <gheskett@shentel.net> - 2020-09-29 14:50 +0200
          Re: ssh session times out annoyingly fast, why? Michael Stone <mstone@debian.org> - 2020-09-29 15:00 +0200
            Re: ssh session times out annoyingly fast, why? Tom Dial <tddial@comcast.net> - 2020-09-30 05:00 +0200
        Re: ssh session times out annoyingly fast, why? <tomas@tuxteam.de> - 2020-09-29 16:30 +0200
          Re: ssh session times out annoyingly fast, why? tomas@tuxteam.de - 2020-09-29 16:40 +0200
            Re: ssh session times out annoyingly fast, why? Michael Stone <mstone@debian.org> - 2020-09-29 16:50 +0200
              Re: ssh session times out annoyingly fast, why? <tomas@tuxteam.de> - 2020-09-29 17:00 +0200
          Re: ssh session times out annoyingly fast, why? Michael Stone <mstone@debian.org> - 2020-09-29 16:50 +0200
            Re: ssh session times out annoyingly fast, why? Stefan Monnier <monnier@iro.umontreal.ca> - 2020-09-29 17:20 +0200
              Re: ssh session times out annoyingly fast, why? Michael Stone <mstone@debian.org> - 2020-09-29 17:30 +0200

csiph-web