Skip to content

bug: Agent leaks SSH X11 Forwarding #18263

Open
@spikecurtis

Description

@spikecurtis

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

When SSH sessions with X11 forwarding are not cleanly closed, the Coder Agent maintains the X11 forwarding and associated TCP sockets.

The end user reports

I do not have thousands of "concurrent" sessions going. But during the lifetime of one workspace, I end up creating 100's of ssh sessions.
At each time, I have maybe 15 ssh sessions active.
I have 15 persistent tmux sessions running on the machine.
From meeting to meeting, whenever I need to disconnect, close the lid of my laptop.... The ssh sessions get disconnected. Next time I start coding in the day, I start another 15 ssh sessions and connect to those running 15 tmux sessions.
So in accumulation, there should be 100's of initiated ssh sessions in one day. While only the most recent 15 are connected. The rest should be dead.
Each ssh session, I open with this command

ssh -X -o StrictHostKeyChecking=no -l <username> <workspace>

Relevant Log Output

$ xauth list | wc -l
3476

Expected Behavior

TCP sockets and associated X11 forwarding should get closed when the underlying SSH session is closed, and within a reasonable time even after an "unclean" disconnection.

Steps to Reproduce

From the Coder admin:

I can sometimes reproduce this behavior on my own workspaces with the following steps:

  1. Connect with ssh -X, but the port is released as soon as I terminate the ssh session.
  2. Disconnect from the corporate VPN that gives access to Coder
  3. Kill the ssh session

Sometimes (but not always) this permanently leaks the :6010, :6011, etc port that the coder agent bound to. I think there is a problem cleaning these up when ssh sessions are not terminated cleanly.

Environment

  • Host OS: Client = macOS, Agent = Linux
  • Coder version: v2.21.3

Additional Context

No response

Metadata

Metadata

Assignees

Labels

s2Broken use cases or features (with a workaround). Only humans may set this.

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy