Calculate SSH idle session timeout from ClientAliveInterval and ClientAliveCountMax settings.
sshd's ClientAliveInterval sets how often (in seconds) the server sends an encrypted no-op keepalive request to a client that has sent no data recently; ClientAliveCountMax is how many of those probes may go unanswered before sshd terminates the session. The effective idle timeout is therefore the product of the two — not either value alone — because the server tolerates ClientAliveCountMax missed probes before giving up, similar in spirit to TCP keepalive but implemented at the SSH protocol layer so it works through NAT and stateful firewalls that might otherwise silently drop long-idle TCP connections.
Idle timeout
timeout_seconds = ClientAliveInterval × ClientAliveCountMax
No — TCPKeepAlive operates at the TCP layer and only detects a dead network path (dropped connections, crashed client machine), while ClientAliveInterval is an SSH-protocol-level keepalive that also detects an unresponsive session and, critically, works reliably through NAT/firewalls that silently time out idle TCP connections regardless of TCP keepalive settings.
Shorter combined timeouts (e.g. 60s × 3 = 3 minutes) reduce how long a hijacked, forgotten, or network-partitioned session remains open with an active shell — a common hardening control for jump hosts and bastion servers per CIS benchmarks.
No — ClientAliveInterval only detects unresponsive clients at the protocol level; it does not interrupt or kill long-running foreground processes as long as the underlying connection is responding to keepalive probes. Idle here means no client-server traffic, not CPU idle.