Bug 3484 - RFE: implement a "sftp_timeout" property on backend to automatically close idle connections
Summary: RFE: implement a "sftp_timeout" property on backend to automatically close id...
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sftp-server (show other bugs)
Version: 9.1p1
Hardware: All Linux
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-10-19 01:53 AEDT by Renaud Métrich
Modified: 2023-03-17 13:42 AEDT (History)
2 users (show)

See Also:

Attachments
Proposed implementation using new "-t <sesion_timeout>" option to sftp-server (3.01 KB, patch)
2022-10-20 20:27 AEDT, Renaud Métrich 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Renaud Métrich 2022-10-19 01:53:59 AEDT 
Currently there is no way for the sftp backend (sftp-server or internal-sftp) to close idle connections (by idle I mean no order sent for some time by the sftp client).

This is very problematic for SFTP servers because clients can remain connected, which consumes file descriptors and resources in general, causing potentially system limits to be reached.
This is a case I handled recently, where system-wide file descriptors were exhausted, due to left-opened sftp sessions + corresponding systemd sessions.

There are "ClientAlive*" properties but these only work for dead clients.

So far, the only solution I found is to have a script that runs regularly and checks if /proc/<sftpserver>/fd/0 access time is older than a certain timestamp, and kill the PID accordingly.

See also Red Hat Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2135811.
Comment 1 Renaud Métrich 2022-10-20 20:27:22 AEDT 
Created attachment 3618 [details]
Proposed implementation using new "-t <sesion_timeout>" option to sftp-server

Tested with:
- no parameter (no timeout)
- "-t 0" (no timeout)
- "-t 30" (30 seconds timeout)
Comment 2 Renaud Métrich 2022-10-20 20:32:40 AEDT 
See also https://github.com/openssh/openssh-portable/pull/350
Comment 3 Flos Qi Guo 2022-10-20 20:44:38 AEDT 
+1 for this. Indeed a very good proposal.
Comment 4 Damien Miller 2022-12-20 14:32:28 AEDT 
I don't want to do this in sftp-server. See https://github.com/djmdjm/openssh-wip/pull/16 for a more general mechanism
Comment 5 Damien Miller 2023-02-10 14:48:35 AEDT 
The more general mechanism shipped in OpenSSH 9.2
Comment 6 Damien Miller 2023-03-17 13:42:09 AEDT 
OpenSSH 9.3 has been released. Close resolved bugs