For StarOS release 21.0 onwards, a user cannot access the /flash directory if the user logs in from a
non-local context.
Important
Secure Session Logout
When StarOS is disconnected from an SSH client, the default behavior has sshd terminate the CLI or SFTP
session in about 45 seconds (using default parameters). Two SSH Configuration mode CLI commands allow
you to disable or modify this default sshd disconnect behavior.
For higher security, Cisco recommends at least a client-alive-countmax of 2 and client-alive-interval of
5. Smaller session logout values may lead to occasional ssh session logouts. Adjust values to balance
security and user friendliness.
Important
The client-active-countmax command sets the number of client-alive messages which may be sent without
sshd receiving any messages back from the SSH client (default =3). If this threshold is reached while the
client-alive messages are being sent, sshd disconnects the SSH client thus terminating the session.
The client-alive-interval command sets a timeout interval in seconds (default = 15) after which if no data
has been received from the SSH client, sshd sends a message through the encrypted channel to request a
response from the client. The number of times that the message is sent is determined by the
client-alive-countmax parameter. The approximate amount of time before sshd disconnects an SSH client
disconnect = client-alive-countmax X client-alive-interval.
The client-alive mechanism is valuable when the client or server depend on knowing when a connection has
become inactive.
The client-alive messages are sent through the encrypted channel and, therefore, are not spoofable.Important
These parameter apply to SSH protocol version 2 only.Important
Changing Default sshd Secure Session Logout Parameters
The following command sequence modifies the default settings for the ClientAliveCountmax (default = 3)
and ClientAliveInterval (default = 15 seconds) parameters.
Step 1
Enter the context configuration mode.
[local]host_name# configure
Step 2
Go to the SSH Configuration mode.
[local]host_name(config)# context context_name
ASR 5500 System Administration Guide, StarOS Release 21.4
35
Getting Started
Secure Session Logout
To Next Page
Loading...
Need help?
General
