sshd: add ClientAliveInterval to reap zombie mobile sessions #102

New issue

Open

opened 2026-05-24 17:59:25 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-24 17:59:25 +00:00

Owner

Problem

Mobile SSH from Kai's phone (Termux + Tailscale) leaves zombie sessions attached on kai-server when the phone backgrounds Tailscale (Android battery optimization). Counted 7 zombie pty sessions from the same source IP, oldest from ~36h prior, all idle, sshd had no idea they were dead.

Why this matters

The zombies don't break anything immediately but they (a) noise up w / last / session audits, (b) hold pty slots, (c) make it harder to spot a genuinely active mobile session during the next mobile-SSH debug round. Tracking doc for that debug effort: coilysiren/mobile-ssh-debug.md on Kai's workstation (not yet in a repo).

Proposed fix

Add to /etc/ssh/sshd_config.d/ (new drop-in, e.g. 99-mobile-keepalive.conf):

ClientAliveInterval 60
ClientAliveCountMax 3

This reaps dead sessions in ~3 minutes (60s × 3 unanswered probes) without affecting healthy long-running sessions. Mosh sessions are unaffected because they don't traverse sshd after handoff.

Out of scope (root cause is client-side)

Android battery optimization killing tailscaled in the background is the actual reconnect-hang cause. Fix is Settings → Apps → Tailscale → Battery → Unrestricted on the phone. This ticket is the server-side hygiene piece only.

Filed by Claude under coilysiren/agentic-os-kai AGENTS "Default TODO Destination" rule.

**Problem** Mobile SSH from Kai's phone (Termux + Tailscale) leaves zombie sessions attached on kai-server when the phone backgrounds Tailscale (Android battery optimization). Counted 7 zombie pty sessions from the same source IP, oldest from ~36h prior, all idle, sshd had no idea they were dead. **Why this matters** The zombies don't break anything immediately but they (a) noise up `w` / `last` / session audits, (b) hold pty slots, (c) make it harder to spot a genuinely active mobile session during the next mobile-SSH debug round. Tracking doc for that debug effort: `coilysiren/mobile-ssh-debug.md` on Kai's workstation (not yet in a repo). **Proposed fix** Add to `/etc/ssh/sshd_config.d/` (new drop-in, e.g. `99-mobile-keepalive.conf`): ``` ClientAliveInterval 60 ClientAliveCountMax 3 ``` This reaps dead sessions in ~3 minutes (60s × 3 unanswered probes) without affecting healthy long-running sessions. Mosh sessions are unaffected because they don't traverse sshd after handoff. **Out of scope (root cause is client-side)** - Android battery optimization killing tailscaled in the background is the actual reconnect-hang cause. Fix is `Settings → Apps → Tailscale → Battery → Unrestricted` on the phone. This ticket is the server-side hygiene piece only. **Filed by Claude** under coilysiren/agentic-os-kai AGENTS "Default TODO Destination" rule.

coilysiren referenced this issue

2026-05-24 18:25:21 +00:00

sshd: public exposure contradicts tangled-knot 'tailnet-only' comment; do security pass #103

coilysiren referenced this issue

2026-05-24 18:47:51 +00:00

Tailscale Android: per-app routing to Termux cycles up/down on ~10-min interval #105

coilysiren referenced this issue

2026-05-24 18:52:31 +00:00

Home 5GHz WiFi: Tailscale tunnel cycles up/down on ~2-5 min intervals from this network only #106

coilysiren referenced this issue

2026-05-24 20:00:26 +00:00

Home 5GHz WiFi: Tailscale tunnel cycles up/down on ~2-5 min intervals from this network only #106