GithubHelp home page GithubHelp logo

SSH options about how-to-secure-a-linux-server HOT 2 OPEN

patrakov avatar patrakov commented on August 25, 2024
SSH options

from how-to-secure-a-linux-server.

Comments (2)

smoogan avatar smoogan commented on August 25, 2024 3

Also looking to understand the intent of these values, specifically ClientAliveCountMax 0 and ClientAliveInterval 300.
Based on the sshd_config docs:

Setting a zero ClientAliveCountMax disables connection termination.

Which makes me think the ClientAliveCountMax 0 nullifies any value set for ClientAliveInterval.
I realize these values are just examples, but agree with @patrakov that the implication is that there is some security impact by leaving them at the defaults and would love to see some justification or additional reading.

Edit: On rereading the docs, I understood it differently. If ClientAliveCountMax is 0, the server won't terminate the connection, but it will continue to poll to keep the connection alive. Still unsure of the security benefit of not terminating or of having such a large polling interval

from how-to-secure-a-linux-server.

AngeloThys avatar AngeloThys commented on August 25, 2024

According to the manpages, TCPKeepAlive is a potential security risk, as it is spoofable.
Plus, there does not seem to be any reason to use both TCPKeepAlive and ClientAlive* values,
as they perform the same goal: to clean up lost connections.

ClientAlive* values, however, are a preference between cleaning up unused resources (closing dropped connections) and possibly getting disconnected by a temporary connection loss.

TCPKeepAlive

Specifies whether the system should send TCP keepalive messages
to the other side. This allows connection loss to be noticed.
Beware that temporary loss of connection will cause the
connection to be closed.
We will disable this, as we will use the ClientAlive options.
TCPKeepAlive is spoofable, whilst ClientAlive is not.

ClientAliveCountMax

Sets the number of client alive messages which may be sent
without sshd receiving any messages back from the client.
If this threshold is reached while client alive messages are being sent,
sshd will disconnect the client, terminating the session.
Set this to 0 to disable connection termination.
We will set this to the default 3.

ClientAliveInterval

Sets a timeout interval in seconds after which if no data has
been received from the client, sshd will send a message through
the encrypted channel to request a response from the client.
We will set this to 15 seconds. This means an unresponsive
SSH client will be disconnected after 3 messages, 15 seconds
apart from each other (45 seconds, approx).

from how-to-secure-a-linux-server.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.