topic Re: SSH TIMEOUT SESSION in Operating System - HP-UX

SSH TIMEOUT SESSION

ANDREA_6 — Fri, 07 Nov 2003 03:16:48 GMT

Hello,

I'm trying to connect from my workstation to an HP-UX 11 server using ssh.
Between my pc and the server hpux there is a firewall.
It works, but after sometimes the connection broke down.

I tryed to set TMOUT parameter in /etc/profile to 36000 value, but the problem is not solved.
I would like to know something about the "KeepAlive" parameter on /opt/etc/ssh/sshd_config.
If is not a router/firewall problem, can this parameter ("KeepAlive") solve my problem related to timeout?

In that case Which is the correct syntax to restart and reload configuration file in sshd daemon?
I think "kill -sighup "... Is it correct?

Thanks in advance,
Andrea

Re: SSH TIMEOUT SESSION

Christian Gebhardt — Fri, 07 Nov 2003 04:07:20 GMT

Hi

you can use
kill -SIGHUP
kill -HUP
kill -1
stop and restart daemon also works.

The other problem, look at man sshd:
----------------------------------------
KeepAlive
Specifies whether the system should send keepalive messages to the other side. If they are sent, death of the connection or crash of one of the machines will be properly noticed. However, this means that connections will die if the route is down temporarily, and some people find it annoying. On the other hand, if keepalives are not sent, sessions may hang indefinitely on the server, leaving ``ghost'' users and consuming server resources.
----------------------------------------

If you have "KeepAlive no" sshd do not disconnect sessions due to network problems.

Maybe your problem deals with the following (man sshd):

----------------------------------------
ClientAliveInterval
Sets a timeout interval in seconds after which if no data has been received from the client, sshd will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client. This option applies to protocol version 2 only.

ClientAliveCountMax
Sets the number of client alive messages (see above) which may be sent without sshd receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. It is important to note that the use of client alive messages is very different from Keepalive (below). The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The TCP keepalive option enabled by Keepalive is spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become inactive.

The default value is 3. If ClientAliveInterval (above) is set to 15, and ClientAliveCountMax is left at the default, unresponsive ssh clients will be disconnected after approximately 45 seconds.

----------------------------------------

Re: SSH TIMEOUT SESSION

Andrew Cowan — Sat, 08 Nov 2003 14:27:20 GMT

Hi Andrea,

Remember that many firewalls are set to chop idle sessions after say 90 minutes. This is to prevent users leaving sessions open and going home etc.

I wouldn't describe this as a firewall "problem" as vendors see this as an extra security feature.

Re: SSH TIMEOUT SESSION

Steven E. Protter — Sat, 08 Nov 2003 18:50:16 GMT

Secure shell will respond to the TMOUT variable in the environment. That means if you leave the session idle at a command line it will timeout after the number of seconds in TMOUT if its set.

If its not set, then its got to be the firewall getting you.

SEP

Re: SSH TIMEOUT SESSION

Tom Ward_1 — Sat, 08 Nov 2003 19:47:52 GMT

f the KeepAlive or ClientAliveInterval don't resolve your problem. I've had very good luck with a utility named spinner. It's available at http://www.laffeycomputer.com/spinner.html.
I haven't compiled this under HPUX, but it may work for you.

Installed on the remote host it will send a stream of characters that will provide activity to hold the connection.

I normally use "spinner -nT". It doesn't interfere with the display and does a great job of holding a connection.

Regards,
Tom