Request to add idle session timeout

[joseph-reynolds]

This is a request to add a session idle timeout mechanism to console-client.c.
Specifically, if there is no activity for a specific time period (in seconds, default 30 minutes, configurable by command-line option with a way to specify unlimited time) then the session will be dropped.

See also for requirements source:

• NIST SP800-63B requires a timeout of 30 minutes for "assurance level 2" (high confidence that the authentication is still valid), or 15 minutes for "assurance level 3" (very high confidence). https://pages.nist.gov/800-63-3/sp800-63b.html
• OWASP suggests idle timeouts of 15-30 minutes. https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#session-expiration

This was discussed in the August 18, 2021 OpenBMC security working group meeting: https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI

[jk-ozlabs]

Yep, that's definitely doable. We'll want to make this a command-line option to enable the timeout, with no timeout as default - there are other (BMC-internal) utilities that call obmc-console-client that don't currently expect a timeout. We'd just specify this argument in the ssh session options.

Will the IPMI SoL and websocket sessions implement their own timeout? Or will they also rely on the obmc-console-client's ?

[jk-ozlabs]

Will the IPMI SoL and websocket sessions implement their own timeout? Or will they also rely on the obmc-console-client's ?

.. and/or will these timeouts all be separately configurable? That might lead to a design where we implement the timeout in the upper layer, rather than in obmc-console-client itself..

[joseph-reynolds]

Addressing 2 comments above. Note this is related to an email thread: https://lore.kernel.org/openbmc/99bf8737-daec-1d75-42a8-3c5c3b08430a@linux.ibm.com/T/#u

1. A default of no timeout (unlimited connection time) seems correct.

2. I don't know how ipmitool sol connects to the host console (overview here) or what provisions IPMI has for session timeouts. I should look into that.

3. I am not aware of any requirements for websocket connections to have any kind of timeouts. Per BMC architecture I understand websockets are used for:

• Event subscription services with the expectation that the connection lasts forever.
• Virtual media via USB-IP (Universal Serial Bus over IP).
• KVM (Keyboard-Video-Mouse) connections

I expect KVM sessions should have idle timeouts, but I don't know that area.

4. ... will these timeouts all be separately configurable ...

The idea behind specifying the timeout as a command-line parameter is so we can have a different timeout for each kind of connection (SSH port 22, 2200, 2201, via ipmi sol, etc.). For a contrived example, maybe you want a 30 minute timeout for BMC command line sessions, but no timeout for host console sessions. This parameter could be passed into the obmc-console-client program via the systemd service instance files such as https://github.com/openbmc/obmc-console/blob/master/conf/obmc-console-ssh%40.service.in

5. Also, we should consider idle timeouts for sessions established to the BMC's serial port (for example, tty0 connects to the BMC's console and then to the BMC command shell).

With the 5 items above, please note my immediate goal is limited to establish session idle timeouts for the console service.

[jk-ozlabs]

Hi Joseph,

Thanks for the responses; let's continue the discussion here. In response to your points:

2. I don't know how `ipmitool sol` connects to the host console (overview [here](https://github.com/openbmc/docs/blob/master/architecture/interface-overview.md#host-console)) or what provisions IPMI has for session timeouts.  I should look into that.

Underneath, it uses the same facility, but bypasses obmc-console-client (I believe it connects to obmc-console-server's unix-domain socket directly). So, that will either have to change, or we add a separate timeout configuration there.

3. I am not aware of any requirements for websocket connections to have any kind of timeouts.   Per [BMC architecture](https://github.com/openbmc/docs/blob/master/architecture/interface-overview.md#web-services) I understand websockets are used for:

* Event subscription services with the expectation that the connection lasts forever.
* Virtual media via USB-IP (Universal Serial Bus over IP).
* KVM (Keyboard-Video-Mouse) connections

and:

• remote console sessions

(ie, exactly like ssh-ing to port 2200, just over a websocket instead). This is what enables the serial console on the BMC web interface, and uses obmc-console for that.

I expect KVM sessions should have idle timeouts, but I don't know that area.

Yep, let's just focus on the obmc-console bits here.

1. Also, we should consider idle timeouts for sessions established to the BMC's serial port (for example, tty0 connects to the BMC's console and then to the BMC command shell).

That's not linked to obmc-console though, that'll be a local login configuration.

What do you want to happen for the "physical serial port on the back of the machine, connected to host console" case? That has no authentication, and no session to time-out. We've assumed that the requirement for physical access to the machine to be a sufficient protection there; is that still the case?

With the 5 items above, please note my immediate goal is limited to establish session idle timeouts for the console service.

Yep, let's stick to that.

[joseph-reynolds]

Thanks for the discussion.

For the IPMI SoL session idle/inactivity timeouts:

• I see "microseconds of idle time for active sessions" in:
  • phosphor-net-ipmid/blob/master/session.hpp - isSessionActive(activeGrace, ...).
  • phosphor-net-ipmid/blob/master/sessions_manager.cpp - Manager::cleanStaleEntries calls isSessionActive("60 seconds", ...)
• Do IPMI SoL sessions have a 60 second (seconds, not minutes) idle timeout? Help needed.
• I didn't see any idle session timeouts or inactive timeouts in phosphor-net-ipmid/blob/master/sol/sol_manager.hpp or https://github.com/openbmc/openbmc-test-automation/blob/master/ipmi/test_ipmi_sol.robot

For the "physical serial port on the back of the machine" case:

• I agree the traditional defense is to limit physical access to the machine.
• For defense-in-depth we could consider:
  • For connections to the BMC's console: This gives access to either (a) the BMC's U-Boot, or (b) a BMC login process, depending on the state of the BMC. As you mentioned (a) U-Boot is not a session-based interface. For (b) we could consider using something Bash's TMOUT variable or similar.
  • For connections to the host console: This is at the raggedy edge of the BMC, but the host console typically gives access to the host's bootloader or hypervisor or command shell, and some of these may provide their own idle timeouts. The BMC may want to provide an idle timeout for this connection, which can be used when the underlying session does not have its own timeout mechanism. (Like the TMOUT variable on the screen command.)

Yes, I meant to say: sessions to the host console (ssh port 2200 to the BMC) should offer idle timeouts.