Configure OpenSSH to disconnect idle SFTP clients

How to configure sftp-server subsystem specified in /etc/ssh/sshd_config to disconnect idle SFTP clients.

Neither sshd_config manual nor nor the sftp-server manual have info to configure such parameter for the subsystem.

Solution 1:

Until OpenSSH 8.2, you could abuse ClientAliveInterval and ClientAliveCountMax 0 to disconnect idle clients:

ClientAliveInterval 60
ClientAliveCountMax 0

But this has been declared as a bug in 8.2 and is no longer working. Since 8.2, there's no way to disconnect the idle clients, only unresponsive clients.

I believe these days, most OpenSSH installations are still pre-8.2, so you might still be able to use this. But it may stop working after upgrade one day.

As @KamilMaciorowski suggested in a comment, a clever wrapper (script) over the sftp-server executable would do too. It won't even be difficult. It would ignore SSH keepalives though (what some may like, some not). And it will need the sftp-server binary (instead of the default internal-sftp), what makes it complicated to chroot the session