Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 794870

Summary: Configure ssh sessions to have a default timeout
Product: [Retired] oVirt Reporter: Perry Myers <pmyers>
Component: ovirt-nodeAssignee: Fabian Deutsch <fdeutsch>
Status: CLOSED WORKSFORME QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: acathrow, apevec, cshao, dyasny, fdeutsch, gouyang, jboggs, leiwang, mburns, moli, ovirt-bugs, ovirt-maint, sgrubb, ycui, zdover
Target Milestone: ---Keywords: FutureFeature
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: 2.4.0 Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: 742997 Environment:
Last Closed: 2012-05-08 13:18:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 742997    
Bug Blocks:    

Description Perry Myers 2012-02-17 20:03:15 UTC 
Description of problem:
Configure ssh sessions to have a default timeout

Needinfo from security team on what the best practices for this timeout are

From sgrubb:

The DISA STIG recommends 15 minutes.

This is what we use:
ClientAliveInterval 900
ClientAliveCountMax 0
Comment 1 Fabian Deutsch 2012-05-08 11:18:02 UTC 
Mike,

is there a specific person to ask to get an answer for a reasonable timeout?
Comment 2 Steve Grubb 2012-05-08 12:13:14 UTC 
The DISA STIG recommends 15 minutes. Its something a lot of people have to meet. You could make it 10 minutes if you want. But the point is to have something.
Comment 3 Mike Burns 2012-05-08 12:36:30 UTC 
(In reply to comment #1)
> Mike,
> 
> is there a specific person to ask to get an answer for a reasonable timeout?

Steve Grubb...

I think setting to 15min makes sense, but might make sense to make it configurable on the security tab
Comment 4 Fabian Deutsch 2012-05-08 13:18:55 UTC 
Okay, I just looked and confirmed that we already have a working (and tested) timeout of 15min. This timeout is set in recipe/common-post.ks