6 ms·

It recommends: # Configure idle time logout ClientAliveInterval <value in seconds> but i don't think this is correct. AFAICT, this is a keep-alive mechani

• LinuxBender 5y ago
  Correct. For that you would populate the variable TMOUT to a positive number in seconds and make that variable read-only grep ^read /etc/profile.d/timeout.sh readonly TMOUT=7200 This variable can also be set in tmux and gnu screen. People usually figure out fairly quick how to bypass the timer but it is handy when people console into servers via the drac/ilo and forget to log out. Some shells don't do anything with TMOUT so a bastion must only have vetted shells.
• darkhelmet 5y ago
  You are correct. This is widely copy/pasted bad advice and does the exact opposite of what the comment says. It is not an idle timeout logout at all. Instead, it causes sshd to periodically send probes to the client. This has a couple of effects, most notably keeping tcp sessions "active" and frequently exchanging packets (this can be useful to keep connections through statefull firewalls alive if you are genuinely idle), and to rapidly detect and disconnect a client that has actually gone away. I think the origin of this incorrect description is the CIS documents. They have the exact same gross mistake in them. I think the ClientAlive probes are useful and should be on, but it's definitely not an "idle logout" as claimed.