Secure Session Logout - Cisco ASR 5000 Series Administration Manual

Getting Started
Important

Secure Session Logout

When StarOS is disconnected from an SSH client, the default behavior has sshd terminate the CLI or SFTP
session in about 45 seconds (using default parameters). Two SSH Configuration mode CLI commands allow
you to disable or modify this default sshd disconnect behavior.
Important
The client-active-countmax command sets the number of client-alive messages which may be sent without
sshd receiving any messages back from the SSH client (default =3). If this threshold is reached while the
client-alive messages are being sent, sshd disconnects the SSH client thus terminating the session.
The client-alive-interval command sets a timeout interval in seconds (default = 15) after which if no data
has been received from the SSH client, sshd sends a message through the encrypted channel to request a
response from the client. The number of times that the message is sent is determined by the
client-alive-countmax parameter. The approximate amount of time before sshd disconnects an SSH client
disconnect = client-alive-countmax X client-alive-interval.
The client-alive mechanism is valuable when the client or server depend on knowing when a connection has
become inactive.
Important
Important
Changing Default sshd Secure Session Logout Parameters
The following command sequence modifies the default settings for the ClientAliveCountmax (default = 3)
and ClientAliveInterval (default = 15 seconds) parameters.
Step 1 Enter the context configuration mode.
host_name
[local]
Step 2
Go to the SSH Configuration mode.
host_name
[local]
For StarOS release 21.0 onwards, a user cannot access the /flash directory if the user logs in from a
non-local context.
For higher security, Cisco recommends at least a client-alive-countmax of 2 and client-alive-interval of
5. Smaller session logout values may lead to occasional ssh session logouts. Adjust values to balance
security and user friendliness.
The client-alive messages are sent through the encrypted channel and, therefore, are not spoofable.
These parameter apply to SSH protocol version 2 only.
configure
#
context context_name
(config)#
ASR 5500 System Administration Guide, StarOS Release 21.4
Secure Session Logout
35