I have read a degree of mixed reports on the security implications and/or value of allowing
TCPKeepAlive yes in
/etc/ssh/sshd_config (for OpenSSH-server). Anything definitive on the security best practices regarding
ClientAliveInterval, etc would be warmly welcomed.
From what I gather there appears to be no real and/or immediate risk of having
TCPKeepAlive yes (source) beyond the possibility that someone could spoof a TCP packet to stop an SSH session from timing out. I.e.
You will note in the next section that a spoofing issue exists with keep alive
(source - under the heading "SSH Users")
I read this as meaning that the risk of it actually having any serious security impact on the SSH session itself is nil.
However, a GitHub user notes:
You're quite right. It seems that there's no actual exploitable vulnerability with TCPKeepAlive -- yet
Implying that it's only a matter of time before it may become exploitable?!
Another source suggests that there is little value in
TCPKeepAlive yes, so long as
ClientAliveInterval is configured appropriately.
A blog post (from 2013) titled "Hardening your SSH server" (under the heading "Prevent zombies") suggests:
To avoid infinitely hanging sessions, this should be left on.
Although as it doesn't mention
ClientAliveInterval, I'm guessing perhaps that may not be 100% relevant now?
Please note that despite my significant googling, all of my sources, bar the 2013 blog post, come from the GitHub thread I've linked to. Beyond those few mentions. I can find nothing substantial one way or the other. Further sources, especially authoritative ones would be warmly welcomed.