Bug 3484

Summary:

RFE: implement a "sftp_timeout" property on backend to automatically close idle connections

Product:

Portable OpenSSH

Reporter:

Renaud Métrich <rmetrich>

Component:

sftp-server

Assignee:

Assigned to nobody <unassigned-bugs>

Status:

CLOSED FIXED

Severity:

enhancement

CC:

djm, lonicerae

Priority:

Version:

9.1p1

Hardware:

All

OS:

Linux

Attachments:

Description	Flags
Proposed implementation using new "-t <sesion_timeout>" option to sftp-server	none

Description Renaud Métrich 2022-10-19 01:53:59 AEDT

Currently there is no way for the sftp backend (sftp-server or internal-sftp) to close idle connections (by idle I mean no order sent for some time by the sftp client).

This is very problematic for SFTP servers because clients can remain connected, which consumes file descriptors and resources in general, causing potentially system limits to be reached.
This is a case I handled recently, where system-wide file descriptors were exhausted, due to left-opened sftp sessions + corresponding systemd sessions.

There are "ClientAlive*" properties but these only work for dead clients.

So far, the only solution I found is to have a script that runs regularly and checks if /proc/<sftpserver>/fd/0 access time is older than a certain timestamp, and kill the PID accordingly.

See also Red Hat Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2135811.

Comment 1 Renaud Métrich 2022-10-20 20:27:22 AEDT

Created attachment 3618 [details]
Proposed implementation using new "-t <sesion_timeout>" option to sftp-server

Tested with:
- no parameter (no timeout)
- "-t 0" (no timeout)
- "-t 30" (30 seconds timeout)

Comment 2 Renaud Métrich 2022-10-20 20:32:40 AEDT

See also https://github.com/openssh/openssh-portable/pull/350

Comment 3 Flos Qi Guo 2022-10-20 20:44:38 AEDT

+1 for this. Indeed a very good proposal.

Comment 4 Damien Miller 2022-12-20 14:32:28 AEDT

I don't want to do this in sftp-server. See https://github.com/djmdjm/openssh-wip/pull/16 for a more general mechanism

Comment 5 Damien Miller 2023-02-10 14:48:35 AEDT

The more general mechanism shipped in OpenSSH 9.2

Comment 6 Damien Miller 2023-03-17 13:42:09 AEDT

OpenSSH 9.3 has been released. Close resolved bugs