1

While the following config added into the cloud_init.cfg file (user data file for building an Ubuntu16/18 VM) does result in those 2 parameters getting their values increased from default 300 and 0 resp. as I want, it completely replaces the much bigger sshd_config contents that would have otherwise been placed (automatically) into /etc/ssh/sshd_config during VM deployment:

write_files:
  - path: /etc/ssh/sshd_config
    content: |
         ClientAliveInterval 30000
         ClientAliveCountMax 50

Is there perhaps a way of just getting these 2 parameter values alone changed in that config leaving the rest of it intact? Placing entire config with the 2 amended values into the cloud_init.cfg didn't work, probably because of some formatting issues. I suppose I should be looking to change those values in some sshd_config template used to create sshd_config and not directly in the latter file itself.

Many thanks in advance!

dandreye
  • 17

2 Answers2

1

Since Ubuntu 20.04, the default /etc/ssh/sshd_config ships with a new Include /etc/ssh/sshd_config.d/*.conf directive precisely to solve your initial problem and to spare us of tricky (and error-prone) text manipulation using sed and friends, as creating a new file with just the wanted overrides is much, much easier.

So now it's preferable to add a drop-in config file at /etc/ssh/sshd_config.d/ rather than directly editing /etc/ssh/sshd_config

This way your cloud_init.cfg could be:

write_files:
  - path: /etc/ssh/sshd_config.d/00-clientalive.conf
    content: |
         ClientAliveInterval 30000
         ClientAliveCountMax 50

That said... are you sure you want a ClientAliveInterval of 30000? Note that this is not an "inactivity timeout", but rather an unresponsiveness check interval: on every ClientAliveInterval seconds without data, the server will check if the client is still alive (and on failure repeat that up to ClientAliveCountMax times), and only disconnect the client if it's unresponsive.

So if all you want is to prevent idle disconnects, lower values such as 10, 30 or even 300 will work just fine. As long as the client is responsive, it can be inactive indefinitely without being disconnected. Make sure TCPKeepAlive is also set (it is by default), it might help too.

And for more permanent, self-monitoring and auto-reconnecting sessions, you might take a look at autossh

MestreLion
  • 20,086
  • Thank you for expanding on your initial reply. One clear difference I noticed with amended values (30k and 50 resp.) is that my idle sessions were no longer disconnected, so I was pretty sure they got fixed by this very change... at least I can't recall having to make any further changes. – dandreye Jun 05 '23 at 21:02
  • @dandreye Any ClientAliveInterval value apart from the default 0 will prevent idle disconnects. But raising this to 50 x 30000 (almost 18 days!), will not only prevent idle but also unresponsive disconnects. If the client goes down for whatever reason (turned off, internet down, etc) the server will not take any action (for 18 days), and the connections on the server side will remain open. So when the client re-connects (as a new connection), if it tries for example to re-setup reverse tunnels on server, it will fail because those ports will still be "in use" by a zombie connection. – MestreLion Jun 06 '23 at 05:13
  • If one side goes goes down, you usually want both sides to be aware of that and drop their side of the connection: the client can try to re-connect (and autossh really helps) , and the the server can free up the used ports. Might not be too relevant with ordinary connections, but if you're setting up tunnels it becomes paramount for the server to make those ports available again. – MestreLion Jun 06 '23 at 05:22
0

Apparently adding this one into /etc/ssh/sshd_config does the trick (tested, works):

runcmd:
  - sed -i 's/ClientAliveInterval 300/ClientAliveInterval 30000/' /etc/ssh/sshd_config
  - sed -i 's/ClientAliveCountMax 0/ClientAliveCountMax 50/' /etc/ssh/sshd_config
  - service ssh restart
dandreye
  • 17