Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend of mine sends me this. He is afraid that process 7680 is an intruder. Is it possible ? Could it be that he had run a sudo command (that would have forked a shell?). He mentioned connecting on ssh to the target machine recently.

ps aux|grep ssh
 root       681  0.0  0.0   6308   668 ?        Ss   Feb22   0:00 /usr/sbin/sshd
 fanfan     898  0.0  0.0   4024   152 ?        Ss   Feb22   0:00 /usr/bin/ssh-agent -s
 root     26308  0.3  0.0   7680  2340 ?        Ss   12:05   0:00 sshd: [accepted]
 nobody   26309  0.0  0.0   7652  1068 ?        S    12:05   0:00 sshd: [net]
 root     26311  0.0  0.0    964   160 pts/2    D+   12:05   0:00 grep ssh
share|improve this question
up vote 4 down vote accepted

It certainly could be someone trying to establish an ssh session with the computer. Depending on the operating system you're using, such sessions will be logged.

Usually they are logged in one of the below files:


If you can't find anything, you can try running these commands with root privileges to give you an idea of where to look:

grep -ir ssh /var/log/*
grep -ir sshd /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*

See if any suspicious IP's, hostnames or warnings show up in the logs. If so, you might blacklist them.

If you reboot the computer, remnant SSH sessions should dissolve. So if those processes keep spawning without your friend using SSH, something or someone else is connecting to the computer.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .