SSH keep alive: stop idle SSH connections from timing out

Why idle SSH sessions drop

Firewalls and NAT routers often drop connections that carry no traffic for a while. An idle SSH session sends nothing, so a box between you and the server can cut it silently, and your terminal freezes until TCP gives up.

When you press a key and ssh writes to the dead connection, it fails, often with client_loop: send disconnect: Broken pipe. That message shows up after an idle drop or a network change.

Client side: ServerAliveInterval

Fix it on your own machine with ServerAliveInterval. It defaults to 0 (off) and sets the seconds of silence after which ssh sends a message through the encrypted channel asking the server to respond. ServerAliveCountMax defaults to 3 and sets how many unanswered messages ssh allows before it disconnects.

With 60 and 3, ssh notices a dead server after about 180 seconds, prints Timeout, server HOST not responding. and exits with status 255. Set it for every host at the end of ~/.ssh/config, because ssh uses the first value it finds and more specific Host blocks belong above it:

Host *
    ServerAliveInterval 60
    ServerAliveCountMax 3

For one session, pass it on the command line with ssh -o ServerAliveInterval=60 user@host. ssh -G host | grep -i alive prints the values ssh will actually use; we tested with the OpenSSH 10.0 packages in Debian 13. Debian's client uses 300 instead of 0 when BatchMode yes is set, a Debian-specific change.

Server side: ClientAliveInterval

If you run the server, ClientAliveInterval (default 0, off) and ClientAliveCountMax (default 3) do the same from the other end in /etc/ssh/sshd_config. ClientAliveCountMax 0 disables the disconnect, so the server keeps sending messages without ever dropping the client.

# After adding "ClientAliveInterval 60" and "ClientAliveCountMax 3" to /etc/ssh/sshd_config
sudo sshd -t
sudo sshd -T | grep -i clientalive
sudo systemctl reload ssh

sshd -t checks the file, sshd -T shows the effective values and the reload applies them to new connections. On Fedora and RHEL the unit is called sshd.

TCPKeepAlive and ConnectTimeout are different things

TCPKeepAlive is on by default on both sides and uses TCP-level keepalive packets. They travel outside the encrypted channel, so they can be spoofed, and Linux waits 7,200 seconds, two hours, before sending the first one (net.ipv4.tcp_keepalive_time). A firewall with a shorter idle timeout drops the connection first, so ServerAliveInterval and ClientAliveInterval are the settings that help.

ConnectTimeout (default none, so the system TCP timeout applies) only limits how long ssh waits to set up a connection and finish the handshake. ssh: connect to host ... port 22: Connection timed out means the connection never opened: a wrong address, a firewall blocking you or a server that is down, not an idle drop.

Mosh for networks that change under you

If the connection drops because you move between networks, try mosh 1.4.0 (October 2022). It logs in over SSH, starts mosh-server and then talks UDP on a port between 60000 and 61000, so your firewall must allow that range.

Install it on both ends (sudo apt install mosh) and connect with mosh user@host. It roams across Wi-Fi and IP changes, survives laptop sleep and shows your typing right away, but it has no port forwarding or X forwarding.

Keepalives do not protect your job

None of these settings keep a program running when the connection does drop. The session dies, the shell gets SIGHUP and its jobs die with it, so run long jobs in tmux or screen or start them with nohup. The tmux detach and attach guide and the nohup guide cover both.