Bug 794870

Summary:	Configure ssh sessions to have a default timeout
Product:	[Retired] oVirt	Reporter:	Perry Myers <pmyers>
Component:	ovirt-node	Assignee:	Fabian Deutsch <fdeutsch>
Status:	CLOSED WORKSFORME	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	acathrow, apevec, cshao, dyasny, fdeutsch, gouyang, jboggs, leiwang, mburns, moli, ovirt-bugs, ovirt-maint, sgrubb, ycui, zdover
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	2.4.0	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:	742997	Environment:
Last Closed:	2012-05-08 13:18:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	742997
Bug Blocks:

Description Perry Myers 2012-02-17 20:03:15 UTC

Description of problem:
Configure ssh sessions to have a default timeout

Needinfo from security team on what the best practices for this timeout are

From sgrubb:

The DISA STIG recommends 15 minutes.

This is what we use:
ClientAliveInterval 900
ClientAliveCountMax 0

Comment 1 Fabian Deutsch 2012-05-08 11:18:02 UTC

Mike,

is there a specific person to ask to get an answer for a reasonable timeout?

Comment 2 Steve Grubb 2012-05-08 12:13:14 UTC

The DISA STIG recommends 15 minutes. Its something a lot of people have to meet. You could make it 10 minutes if you want. But the point is to have something.

Comment 3 Mike Burns 2012-05-08 12:36:30 UTC

(In reply to comment #1)
> Mike,
> 
> is there a specific person to ask to get an answer for a reasonable timeout?

Steve Grubb...

I think setting to 15min makes sense, but might make sense to make it configurable on the security tab

Comment 4 Fabian Deutsch 2012-05-08 13:18:55 UTC

Okay, I just looked and confirmed that we already have a working (and tested) timeout of 15min. This timeout is set in recipe/common-post.ks