Subject: [Isms] ISMS #7: properly closing an SSH session

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 23 Jan 2008 21:48:30 +0100

ISMS #7: properly closing an SSH session
Status: open

Juergen Schoenwaelder wrote in
http://www1.ietf.org/mail-archive/web/isms/current/msg02602.html:

  I have a question for SSH experts (hope there are some on this list).
  I am wondering what the proper way of closing the SSH session is in
  our case. Note that we run a single SSH channel over the SSH transport
  and there are several options now.

  a) Be brutal and simply close the underlying TCP connection.

  b) Be a bit less brutal and send an SSH_DISCONNECT with say a
     reason code of SSH_DISCONNECT_BY_APPLICATION and be done.

  c) Be friendly and play the game of doing an SSH_CHANNEL_CLOSE
     exchange followed by SSH_DISCONNECT.

  d) Be overly friendly by exchanging SSH_CHANNEL_EOF before
     exchanging SSH_CHANNEL_CLOSE and doing an SSH_DISCONNECT.

  My reading of the RFCs indicates that d) is not really required and of
  course a) will always work. There might be reasons to do b) although
  it is not clear which benefit one would get (since my understanding is
  that SSH_DISCONNECT does not impact who is closing the TCP connection
  and who has to go into wait state).

  Any suggestions what should be done to play the SSH game nicely?

Q7.1: Is there a need to document this in the SSHTM specification or
      is this implementation detail? What do other documents using SSH
      do?

Q7.2: If we decide to standardize the connection closing behaviour,
      what is the suggested way to close the SSH connection?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 23 Jan 2008 17:06:52 -0500

>       is this implementation detail? What do other documents using SSH

No.  The mechanisms for closing SSH sessions are specified by SSH.  It is 
inappropriate for SSHTM to discuss connection setup at the layer of 
specific SSH protocol messages, any more than a TCP transport model would 
tell you when to send SYN, ACK, and RST messages to manage a TCP connection.

-- Jeff

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Mon, 28 Jan 2008 23:12:41 +0100

> tell you when to send SYN, ACK, and RST messages to manage a TCP 

I am fine to leave the question how to properly close an SSH session
to the SSH specifications.

<soap>
My problem while coding was simply that I did not find the answer in
the SSH specifications - I found several options and it was not really
clear to me which is the right one to use. But then this might be
considered a shortcoming of the SSH specifications.
</soap>

So I suggest the answer for Q7.1 is: "It is not appropriate for the
SSHTM document to detail how SSH sessions are closed." With that
answer, Q7.2 becomes obsolete and issue ISMS #7 can be closed.

If anyone on this list likes to object to this resolution of ISMS #7,
please speak up now.

/js