I have a monitoring app that utilizes ssh keys to ssh into our linux hosts to run various commands. We have noticed that with some regularity, even though the ssh processes seem to work fine, we are getting open ssh connections that are no longer active.

We are trying to find a way to tell if the connections are still be used in order to terminate them.

I know we could modify the sshd_config directives as follows...

ClientAliveInterval 300
ClientAliveCountMax 0

But we don't want to affect interactive sessions. We only want non-interactive sessions that can easily be identified by the username.

Any ideas?

Use a shorter interval for ClientAliveInterval and set ClientAliveCountMax to at least 1. That way the session will be closed sooner when the client becomes unavailable.

Also, you might consider using ForceCommand with the keys. That doesn't have to be set in sshd_config. Instead it can be prepended to the public key on the server in ~/.ssh/authorized_keys or wherever you have actually been keeping the public keys. See "man sshd" and scroll down to the section "AUTHORIZED_KEYS FILE FORMAT" and look at command="" there.

Thanks for the tips Turbocapitalist. However, I don't think either will work. We don't want to drop interactive sessions, even if they have been unused for days. When users leave for the evening, they commonly just lock there PC (citrix VM). So when they come back to work, we want their interactive sessions to still be where they left them.

The second option of authorized keys is not viable either because we only have access to the client side, not the server side. And in this case, we are talking about thousands of sshd servers.

What we need is something specific this particular user id (the one used to login by the monitoring tool), and only kill those processes which are inactive.

Thanks

Have them use the terminal emulator tmux on the remote machine. Then if the connection is broken, then can reconnect with SSH and then reattach to the old tmux session and be exactly where they left off.

Like that.

SSH certificates then?

You can set those configuration directives so that they apply to just that one account by using a Match clause. But using tmux is probably the answer.

Of all the options you have suggested, this one seems the best option in our environment. Can you point me at more detail? Thanks

If you mean the Match block, information would be in the manual page for sshd_config. However, it will look something like this added to the tail end of /etc/ssh/sshd_config on the server:

That would leave the other accounts unaffected.

If you have 1000's of servers then that can be deployed through your orchestration service, like Puppet, Ansible, or Chef.

However, tmux is probably what you want. There are a lot of fair to middling beginners' guides for it around. They are easy to find. The formula given above in my previous post works for well fo resuming a session or starting a new one if there was not a session in progress. tmux is added by default to most new server distros.
screen is an older equivalent but I find tmux preferable.

If it's possible, I need a way to apply the exception on the client, not the server. So ssh and not sshd

The programs you are interacting with are on the server and so all relevant events will take place on and with the server. So again the short answer is still "no" in regards to being able to work this out with the client only.

And, again, see if tmux is on the server already. If not, and if you really can't add it, then see if screen is there instead.

or

There is a good chance that you have one or the other as part of the default setup.

I'm not sure how you can tell which are "no longer active" -- I can't duplicate that condition on my server.
That said,
will show you sshd connections and identify the userid:
The return could be parsed to kill PIDs that are inactive (again, how do you know they're inactive -- all the connections in my example are active) OR kill the PIDs that don't belong to interactive users.

HTH

How would you define "inactive"?

If the user ends their login session on the client, any open ssh connections they have should be terminated.

If they leave for the day with their login session(s) still open and ssh connections from those sessions, the ssh connection will remain open assuming other client and server configs allow it.

Since the sessions are still open we must assume the user login session is still active. So again, how would you define "inactive"?