Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A friend of mine sends me this. He is afraid that process 7680 is an intruder. Is it possible ? Could it be that he had run a sudo command (that would have forked a shell?). He mentioned connecting on ssh to the target machine recently.

ps aux|grep ssh
 root       681  0.0  0.0   6308   668 ?        Ss   Feb22   0:00 /usr/sbin/sshd
 fanfan     898  0.0  0.0   4024   152 ?        Ss   Feb22   0:00 /usr/bin/ssh-agent -s
 root     26308  0.3  0.0   7680  2340 ?        Ss   12:05   0:00 sshd: [accepted]
 nobody   26309  0.0  0.0   7652  1068 ?        S    12:05   0:00 sshd: [net]
 root     26311  0.0  0.0    964   160 pts/2    D+   12:05   0:00 grep ssh
share|improve this question

1 Answer 1

up vote 3 down vote accepted

It certainly could be someone trying to establish an ssh session with the computer. Depending on the operating system you're using, such sessions will be logged.

Usually they are logged in one of the below files:

/var/log/syslog
/var/log/auth
/var/log/auth.log
/var/log/secure
/var/logs/system.log

If you can't find anything, you can try running these commands with root privileges to give you an idea of where to look:

grep -ir ssh /var/log/*
grep -ir sshd /var/log/*
grep -ir breakin /var/log/*
grep -ir security /var/log/*

See if any suspicious IP's, hostnames or warnings show up in the logs. If so, you might blacklist them.

If you reboot the computer, remnant SSH sessions should dissolve. So if those processes keep spawning without your friend using SSH, something or someone else is connecting to the computer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.