sshd - time out idle connections

[Polytropon]

On Fri, 3 May 2013 17:22:04 +0200, Fleuriot Damien wrote:
> Allow me to add a bit of context here.
> 
> 
> We're wrapping things up to obtain the PCI DSS certification which
> is awarded for running through a long and annoying series of hoops.
> This certification is rather important to our business so like it
> or not, we have to play along.

I'm familiar with this stupid concept. They are forcing you to
fiddle with things that work fine as it is, just to get a sheet
of shiny paper. After all, this sheet of paper allows you to
raise your prices. :-)



> Allowing the use of screen defeats the purpose of logging out idle
> connections, I don't think we're going to pass this specific
> requirement if we let users run screen.

What _defines_ an idle connection? Let's say a user logs in via
SSH and leaves the session untouched. Idle for 5 minutes? True.
Disconnect.

But what about this? After logging in, the user starts some program,
maybe something like top, mc (Midnight Commander) or pine. Is this
also considered idle?

Is idle tied to "keystrokes received on the other end", or more
like "data send to the client"? Is one sufficient, or are both
required, to consider a connection "not idle", therefor not
disconnecting it? What about batch processes? Can a user log in,
submit a batch job, and then leave, while his batch job starts
to run 10 minutes later (and finishes after 30 minutes)?

Does the oh so holy specification for the glorious certification
say anything about it, something you could incorporate into the
concept and _then_ come up with an idea for implementation?

The only chance to _really_ comply with the "certification rule"
and therefor defeat any countermeasures possibly taken by users
(tmux, screen, detach et al.) is to disconnect _any_ connection
regardless of what the user is doing, killing all additional
background processes and "at"-timed commands. Does this stop
users from being idle more than 5 minutes? Sure, but it also
STOPS THEM FOR DOING ACTUAL WORK, depending on how they use
their SSH connections for that! However, the most excellent
certification does not take that into mind, so why should you? ;-)





-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...