I realized yesterday that all my computers that have been updated to the 8.6 version don't kick me out from inactive ssh sessions anymore. After some googling, I found that in the RHEL 8.6 release notes:

sshd_config:ClientAliveCountMax=0 disables connection termination

Setting the SSHD configuration option ClientAliveCountMax to 0 now disables connection termination. This aligns the behavior of this option with the upstream. As a consequence, OpenSSH no longer disconnects idle SSH users when it reaches the timeout configured by the ClientAliveInterval option.

So, according to that, I cannot set an idle auto-logout for the ssh sessions anymore, which is mandatory inside my organization network. How are we supposed to do now? I know the TMOUT variable can be used in .sh and .csh profiles (we already use it for our servers) but it also kills the local terminals, which is not suitable for desktop computers (but we still have to logout inactive ssh sessions connected to those). Everywhere I look online, the only way I see to disconnect an idle ssh session is with the ClientAliveCountMax and ClientAliveInterval settings and they don't have any effect anymore.

By the way, setting ClienAliveCountMax to anything else than 0 doesn't work either. Like if I put

ClientAliveInterval = 200
ClienAliveCountMax = 3

I stay connected forever. The only way I had to make that working was to set CountMax to 0 and it doesn't work anymore. Any tips to resolve this problem?

Thank you for your help!

Welcome to LinuxQuestions.

https://bugzilla.redhat.com/show_bug.cgi?id=2015828

When did you last update your systems. Looks like there was an update on 2022-05-10 to fix the bug.

Since I got no reply, I kept on searching and finally found a solution. I have to use TMOUT and autologout but with the condition that SSH_CONNECTION is defined.

For tcsh, create a .csh file in /etc/profile.d (like ssh-timeout.csh) and write

if ($?SSH_CONNECTION) then
unset autologout
# set to 15 min
set -r autologout=15
else
endif

For bash, create a .sh file in /etc/profile.d (like ssh-timeout.sh) and write

if [ "$SSH_CONNECTION" != "" ]; then
TMOUT=900 # 15 mins
readonly TMOUT
export TMOUT
fi


Like that, the local terminals are not killed but the ssh sessions get disconnected after 15 minutes of idle.

1 members found this post helpful.