[Bug 1978816] Re: sshd: ClientAliveCountMax=0 not honoured as expected

[Paride Legovini]

Hello James and thanks for your bug report. The "Make
ClientAliveCountMax=0 have sensible semantics" change you refer to is
actually an upstream change, see the OpenSSH bugfixes here:

  https://www.openssh.com/releasenotes.html

the upstream bug being:

  https://bugzilla.mindrot.org/show_bug.cgi?id=2627

which has a comment similar to yours here.

Even if the new behavior may be sometimes inconvenient I don't think
we're going to make Ubuntu deviate from what upstream does (for reasons
you clearly understand). As an Ubuntu bug I think this is Invalid, but
I'm marking it as Incomplete for now. Please comment back if there's
anything I missed or misunderstood, or mark this report as Invalid if
you agree with my findings. Thanks!

** Bug watch added: OpenSSH Portable Bugzilla #2627
   https://bugzilla.mindrot.org/show_bug.cgi?id=2627

** Changed in: openssh (Ubuntu)
       Status: New => Incomplete

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssh in Ubuntu.
https://bugs.launchpad.net/bugs/1978816

Title:
  sshd: ClientAliveCountMax=0 not honoured as expected

Status in openssh package in Ubuntu:
  Incomplete

Bug description:
  $ apt-cache policy openssh-server
  openssh-server:
    Installed: 1:8.2p1-4ubuntu0.4
    Candidate: 1:8.2p1-4ubuntu0.4

  $ lsb_release -a
  No LSB modules are available.
  Distributor ID: Ubuntu
  Description:    Ubuntu 20.04.4 LTS
  Release:        20.04
  Codename:       focal

  After upgrading from 'bionic' the openssh ClientAlive* parameters are
  not functioning as expected in sshd:

  /etc/ssh/sshd_config:ClientAliveInterval 900
  /etc/ssh/sshd_config:ClientAliveCountMax 0

  The expected behaviour is that after 900s with no traffic in the
  session the server terminates the connection.  There appears to be a
  custom patch in the package which changes this:

      - sshd(8): Make ClientAliveCountMax=0 have sensible semantics: it will
        now disable connection killing entirely rather than the current
        behaviour of instantly killing the connection after the first liveness
        test regardless of success.

  It is unclear why this is a beneficial change in the default behaviour
  of sshd.  If the user doesn't want the session disconnected then they
  should set ClientAliveInterval=0.  It also defeats our requirement to
  have idle ssh sessions terminated when nothing has been done for 15
  minutes.

  It is tempting to mark this as a security issue due to unexpected
  change in behaviour and the fact it would leave idle sessions open
  whereas a vanilla ssh package would close them.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1978816/+subscriptions