3 of 6
added Host match line in config (otherwise it wouldn't work), added why not enabled by default, added that it prevents it from happening, removed useless default value to repeat in config, added about the TCP keepalive
gertvdijk
  • 67.9k
  • 33
  • 191
  • 287

You may also want to setup application-level keep-alives for ssh to prevent SSH from freezing on connection issues. My ~/.ssh/config contains this:

Host *
ServerAliveInterval 15

This makes ssh client send application-level keep-alives every 15 seconds. Whenever three of them fail consecutively (configurable using ServerAliveCountMax), the client considers the connection as hung and closes it.

Opposed to the other option TCPKeepAlive, this is checked within the encrypted channel and is not spoofable.


It is being noted that those keep-alives also help to, uhm, keep long-idling connections alive, i.e. prevent you from having half-closed tcp sessions hanging for hours untouched.

I highly recommend turning this feature on if you run into this regularly, but you should also know about the slight security risk it may impose. A known-plaintext attack might become easier if the attacker knows the interval and contents of an idle connection. This might be the reasons for why it isn't enabled by default.

ulidtko
  • 5.8k
  • 1
  • 37
  • 50