Comments (2)
Also looking to understand the intent of these values, specifically ClientAliveCountMax 0
and ClientAliveInterval 300
.
Based on the sshd_config docs:
Setting a zero
ClientAliveCountMax
disables connection termination.
Which makes me think the ClientAliveCountMax 0
nullifies any value set for ClientAliveInterval
.
I realize these values are just examples, but agree with @patrakov that the implication is that there is some security impact by leaving them at the defaults and would love to see some justification or additional reading.
Edit: On rereading the docs, I understood it differently. If ClientAliveCountMax
is 0, the server won't terminate the connection, but it will continue to poll to keep the connection alive. Still unsure of the security benefit of not terminating or of having such a large polling interval
from how-to-secure-a-linux-server.
According to the manpages, TCPKeepAlive
is a potential security risk, as it is spoofable.
Plus, there does not seem to be any reason to use both TCPKeepAlive
and ClientAlive*
values,
as they perform the same goal: to clean up lost connections.
ClientAlive*
values, however, are a preference between cleaning up unused resources (closing dropped connections) and possibly getting disconnected by a temporary connection loss.
TCPKeepAlive
Specifies whether the system should send TCP keepalive messages
to the other side. This allows connection loss to be noticed.
Beware that temporary loss of connection will cause the
connection to be closed.
We will disable this, as we will use the ClientAlive options.
TCPKeepAlive is spoofable, whilst ClientAlive is not.
ClientAliveCountMax
Sets the number of client alive messages which may be sent
without sshd receiving any messages back from the client.
If this threshold is reached while client alive messages are being sent,
sshd will disconnect the client, terminating the session.
Set this to 0 to disable connection termination.
We will set this to the default 3.
ClientAliveInterval
Sets a timeout interval in seconds after which if no data has
been received from the client, sshd will send a message through
the encrypted channel to request a response from the client.
We will set this to 15 seconds. This means an unresponsive
SSH client will be disconnected after 3 messages, 15 seconds
apart from each other (45 seconds, approx).
from how-to-secure-a-linux-server.
Related Issues (20)
- Translate into Mandarin HOT 2
- psad fails to update signatures HOT 1
- Implementing Post‑quantum Cryptography
- Gmail SMTP: You can no longer use the account's password HOT 2
- exim4 Gmail - TLS connection errors / "Authentication Required" HOT 3
- SSH keypair not able to login with passpharase HOT 1
- Fail2ban fails on fresh Debian12
- Disabling bash history on root account? HOT 3
- HashKnownHosts set to yes HOT 5
- psad missing ufw log setting
- sshd_config compression option no longer a security risk HOT 1
- sshd_config protocol 1 support completely removed resulting in protocol option being removed
- [Ubuntu 24.04] Error: fail2ban [5004]: ERROR No module named 'asynchat'
- Version this guide and create tags
- Ubuntu Guide is Unreachable HOT 1
- Suggestion: UFW Firewall for Cloudflare
- Please add Postgres section HOT 2
- Conflicting statements on CIS benchmarks HOT 1
- A dead article. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from how-to-secure-a-linux-server.