Which timeout applies first when Teleport idle_timeout and max_session_ttl are both configured?
0 reputation · 02 Sept 2022, 02:11 UTC
I am configuring session controls on a Teleport cluster (assume a recent 15.x release) and want both protections: disconnecting users who stop typing, and capping total session length regardless of activity. Teleport documents idle_timeout for inactivity-based disconnection and max_session_ttl as a hard lifetime limit, but the interaction between the two is not fully clear to me.
My specific uncertainty is about graceful cancellation behavior. The idle timeout path appears to send a warning to the client and terminate the SSH channel cleanly, while recorded session files are preserved for audit. I am unsure whether the TTL-based termination follows the same graceful path or drops the connection differently, and whether the audit log records a distinguishable termination reason for each case.
There also seem to be edition differences: the warning message behavior reportedly varies between Teleport Enterprise and the open-source edition, and some SSH clients may ignore the warning entirely.
When both settings are active, which one takes precedence if they would fire at nearly the same time? Does max_session_ttl termination emit the same client warning and audit reason as idle_timeout? Is the graceful warning behavior identical in the open-source edition?