Bug 1480510 - SSH connections get closed when time-based rekeyring is used and ClientAliveMaxCount=0
SSH connections get closed when time-based rekeyring is used and ClientAliveM...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openssh (Show other bugs)
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Jakub Jelen
Stefan Dordevic
Depends On:
Blocks: 1420851 1476743
  Show dependency treegraph
Reported: 2017-08-11 05:47 EDT by Renaud Métrich
Modified: 2018-04-10 14:20 EDT (History)
8 users (show)

See Also:
Fixed In Version: openssh-7.4p1-15.el7
Doc Type: Bug Fix
Doc Text:
Cause: The timeouts throughout the server code were not handled correctly. Consequence: Setting both time-based rekeying (RekeyLimit=default 45s) and client keep-alive (ClientAliveCountMax=0, ClientAliveInterval=900) in sshd resulted in the connection drop after the rekeying timeout. Fix: The code was updated to handle all combinations of timeouts correctly. Result: The rekeying no longer closes connection
Story Points: ---
Clone Of:
Last Closed: 2018-04-10 14:19:11 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
OpenSSH Project 2757 None None None 2017-08-14 06:44 EDT
Red Hat Knowledge Base (Solution) 3158191 None None None 2018-01-31 05:41 EST
Red Hat Product Errata RHSA-2018:0980 None None None 2018-04-10 14:20 EDT

  None (edit)
Description Renaud Métrich 2017-08-11 05:47:13 EDT
Description of problem:

When configuring time-based rekeyring on the SSHD server (e.g. RekeyLimit=default 45s)and configuring "ClientAliveMaxCount=0" on the SSHD server also, SSH connection gets unexpectedly closed by the SSHD server just before the rekeyring happens.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Stop the firewall (for convenience)

systemctl stop firewalld

2. Start a SSHD instance with custom rekeyring based on time and ClientAliveMaxCount=0 (requires ClientAliveInterval != 0)

/usr/sbin/sshd -D -ddd -p 8022 -o "ClientAliveCountMax=0" -o "ClientAliveInterval=900" -o "RekeyLimit=default 45s" -e

3. Connect to that SSHD instance and generate some traffic

ssh -p 8022 root@vm-rhel74 "date; while :; do sleep 30; date; done"

Actual results:

Immediately before Rekeyring is performed, connection gets closed with the following messages on the SSHD server:

Timeout, client not responding.
debug1: do_cleanup
debug1: PAM: cleanup
debug1: PAM: closing session
debug1: PAM: deleting credentials
debug3: PAM: sshpam_thread_cleanup entering

Expected results:

No connection closure.

Additional info:

This doesn't happen with "traffic-limit" rekeyring only (e.g. "RekeyLimit 4M").
Comment 2 Jakub Jelen 2017-08-11 11:02:36 EDT
Yes, that is indeed a bug. The select() returns on timeout, but it is interpreted as a ClientAlive timeout instead of rekey timeout (sigh ... too many timeouts for a single select()).

The same issue is still reproducible with latest OpenSSH 7.5 and also with current master.

The proposed workaround looks reasonable.

I filled a bug upstream [1] with a patch and briefly tested that it solves our problem. I can build a testing package next week.

[1] https://bugzilla.mindrot.org/show_bug.cgi?id=2757
Comment 13 errata-xmlrpc 2018-04-10 14:19:11 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.