summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRichard Kettlewell <rjk@greenend.org.uk>2014-02-09 16:09:52 +0000
committerColin Watson <cjwatson@debian.org>2016-12-26 00:55:51 +0000
commit0bdc6351d8a32c33e65542617c71da8ddcdeb331 (patch)
tree30ab10b4d50997eeeed998cc8a28a8b83a1554cf
parent01e8999cc86a0b2ffed5f98abed624b0e7c2707f (diff)
Various keepalive extensions
Add compatibility aliases for ProtocolKeepAlives and SetupTimeOut, supported in previous versions of Debian's OpenSSH package but since superseded by ServerAliveInterval. (We're probably stuck with this bit for compatibility.) In batch mode, default ServerAliveInterval to five minutes. Adjust documentation to match and to give some more advice on use of keepalives. Author: Ian Jackson <ian@chiark.greenend.org.uk> Author: Matthew Vernon <matthew@debian.org> Author: Colin Watson <cjwatson@debian.org> Last-Update: 2016-12-26 Patch-Name: keepalive-extensions.patch
-rw-r--r--readconf.c14
-rw-r--r--ssh_config.521
-rw-r--r--sshd_config.53
3 files changed, 34 insertions, 4 deletions
diff --git a/readconf.c b/readconf.c
index c1c3aae0d..3efba242f 100644
--- a/readconf.c
+++ b/readconf.c
@@ -173,6 +173,7 @@ typedef enum {
173 oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys, 173 oStreamLocalBindMask, oStreamLocalBindUnlink, oRevokedHostKeys,
174 oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes, 174 oFingerprintHash, oUpdateHostkeys, oHostbasedKeyTypes,
175 oPubkeyAcceptedKeyTypes, oProxyJump, 175 oPubkeyAcceptedKeyTypes, oProxyJump,
176 oProtocolKeepAlives, oSetupTimeOut,
176 oIgnoredUnknownOption, oDeprecated, oUnsupported 177 oIgnoredUnknownOption, oDeprecated, oUnsupported
177} OpCodes; 178} OpCodes;
178 179
@@ -308,6 +309,8 @@ static struct {
308 { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes }, 309 { "pubkeyacceptedkeytypes", oPubkeyAcceptedKeyTypes },
309 { "ignoreunknown", oIgnoreUnknown }, 310 { "ignoreunknown", oIgnoreUnknown },
310 { "proxyjump", oProxyJump }, 311 { "proxyjump", oProxyJump },
312 { "protocolkeepalives", oProtocolKeepAlives },
313 { "setuptimeout", oSetupTimeOut },
311 314
312 { NULL, oBadOption } 315 { NULL, oBadOption }
313}; 316};
@@ -1402,6 +1405,8 @@ parse_keytypes:
1402 goto parse_flag; 1405 goto parse_flag;
1403 1406
1404 case oServerAliveInterval: 1407 case oServerAliveInterval:
1408 case oProtocolKeepAlives: /* Debian-specific compatibility alias */
1409 case oSetupTimeOut: /* Debian-specific compatibility alias */
1405 intptr = &options->server_alive_interval; 1410 intptr = &options->server_alive_interval;
1406 goto parse_time; 1411 goto parse_time;
1407 1412
@@ -2047,8 +2052,13 @@ fill_default_options(Options * options)
2047 options->rekey_interval = 0; 2052 options->rekey_interval = 0;
2048 if (options->verify_host_key_dns == -1) 2053 if (options->verify_host_key_dns == -1)
2049 options->verify_host_key_dns = 0; 2054 options->verify_host_key_dns = 0;
2050 if (options->server_alive_interval == -1) 2055 if (options->server_alive_interval == -1) {
2051 options->server_alive_interval = 0; 2056 /* in batch mode, default is 5mins */
2057 if (options->batch_mode == 1)
2058 options->server_alive_interval = 300;
2059 else
2060 options->server_alive_interval = 0;
2061 }
2052 if (options->server_alive_count_max == -1) 2062 if (options->server_alive_count_max == -1)
2053 options->server_alive_count_max = 3; 2063 options->server_alive_count_max = 3;
2054 if (options->control_master == -1) 2064 if (options->control_master == -1)
diff --git a/ssh_config.5 b/ssh_config.5
index a7703fc77..a0457314c 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -250,8 +250,12 @@ Valid arguments are
250If set to 250If set to
251.Cm yes , 251.Cm yes ,
252passphrase/password querying will be disabled. 252passphrase/password querying will be disabled.
253In addition, the
254.Cm ServerAliveInterval
255option will be set to 300 seconds by default (Debian-specific).
253This option is useful in scripts and other batch jobs where no user 256This option is useful in scripts and other batch jobs where no user
254is present to supply the password. 257is present to supply the password,
258and where it is desirable to detect a broken network swiftly.
255The argument must be 259The argument must be
256.Cm yes 260.Cm yes
257or 261or
@@ -1485,7 +1489,14 @@ from the server,
1485will send a message through the encrypted 1489will send a message through the encrypted
1486channel to request a response from the server. 1490channel to request a response from the server.
1487The default 1491The default
1488is 0, indicating that these messages will not be sent to the server. 1492is 0, indicating that these messages will not be sent to the server,
1493or 300 if the
1494.Cm BatchMode
1495option is set (Debian-specific).
1496.Cm ProtocolKeepAlives
1497and
1498.Cm SetupTimeOut
1499are Debian-specific compatibility aliases for this option.
1489.It Cm StreamLocalBindMask 1500.It Cm StreamLocalBindMask
1490Sets the octal file creation mode mask 1501Sets the octal file creation mode mask
1491.Pq umask 1502.Pq umask
@@ -1544,6 +1555,12 @@ Specifies whether the system should send TCP keepalive messages to the
1544other side. 1555other side.
1545If they are sent, death of the connection or crash of one 1556If they are sent, death of the connection or crash of one
1546of the machines will be properly noticed. 1557of the machines will be properly noticed.
1558This option only uses TCP keepalives (as opposed to using ssh level
1559keepalives), so takes a long time to notice when the connection dies.
1560As such, you probably want
1561the
1562.Cm ServerAliveInterval
1563option as well.
1547However, this means that 1564However, this means that
1548connections will die if the route is down temporarily, and some people 1565connections will die if the route is down temporarily, and some people
1549find it annoying. 1566find it annoying.
diff --git a/sshd_config.5 b/sshd_config.5
index dd765b391..283ba8896 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -1427,6 +1427,9 @@ This avoids infinitely hanging sessions.
1427.Pp 1427.Pp
1428To disable TCP keepalive messages, the value should be set to 1428To disable TCP keepalive messages, the value should be set to
1429.Cm no . 1429.Cm no .
1430.Pp
1431This option was formerly called
1432.Cm KeepAlive .
1430.It Cm TrustedUserCAKeys 1433.It Cm TrustedUserCAKeys
1431Specifies a file containing public keys of certificate authorities that are 1434Specifies a file containing public keys of certificate authorities that are
1432trusted to sign user certificates for authentication, or 1435trusted to sign user certificates for authentication, or