Defensible server-side idle policy
For short, infrequent administrative sessions, enable server-side idle probes with ClientAliveInterval around 300 to 600 seconds and ClientAliveCountMax set to 3. That closes an unresponsive session after roughly 15 to 30 minutes while tolerating normal pauses in interactive work. If the client already sends keepalives, do not disable server probes; instead make the server idle window longer than the client keepalive cycle so the client can maintain NAT or firewall state without triggering an unwanted server close.
Likely explanation versus confirmed facts
| Item | Status | Notes |
|---|
ClientAliveInterval sends an application-layer probe only after the interval passes with no client data. | Well-established OpenSSH behavior | More application-aware than TCP keepalive. |
ClientAliveCountMax tolerates unanswered probes before sshd closes the connection. | Well-established OpenSSH behavior | Default is commonly 3, but is release-dependent. |
| Idle overhead is mainly session hygiene, not large CPU savings. | Planning assumption | Measure the specific host before claiming savings. |
| A shorter firewall or NAT TCP idle timeout closes the session first. | Planning assumption | The effective limit is the shorter of sshd and middlebox timeouts. |
Configuration steps for this case
- Confirm the deployed OpenSSH version:
ssh -V.
- Check effective server settings:
sshd -T 2>/dev/null | grep -E 'clientaliveinterval|clientalivecountmax|tcpkeepalive'. If Match blocks apply, use sshd -T -C user=...,host=...,addr=....
- Back up
/etc/ssh/sshd_config, then set or adjust:
ClientAliveInterval 300
ClientAliveCountMax 3
Use 600 seconds instead of 300 if administrative pauses are commonly longer.
- Validate syntax without restarting:
sshd -t.
- Reload the daemon so new connections use the policy:
systemctl reload sshd or the equivalent for your init system.
Established sessions generally keep their previous behavior until reconnected; verify this on your release before assuming existing connections are unaffected.
Verification
- Open a test admin session, stop all client input, and confirm the server closes after approximately
ClientAliveInterval × ClientAliveCountMax.
- Repeat with a client-side keepalive configured and confirm the server does not close the session sooner than the intended window.
Missing diagnostic
Provide the idle TCP timeout of any intermediate firewall or NAT between client and server. If that timeout is shorter than the sshd idle window, the middlebox—not sshd—sets the effective limit, and the recommendation changes to aligning the sshd window below the middlebox timeout or adjusting the middlebox.
Assumptions: values are starting points for low-traffic administrative access, not universal defaults. OpenSSH defaults vary by release; in many releases ClientAliveInterval defaults to 0 (disabled) and ClientAliveCountMax to 3. Confirm for the deployed release before relying on any assumed default.
ssh