Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Please help me understand this ps aux output

ps aux | grep daniel

root      2564  0.2  0.5   8404  2764 ?        Ss   04:11   0:00 sshd: daniel [priv] 
daniel    2621  0.0  0.2   8404  1424 ?        S    04:11   0:00 sshd: daniel@pts/0  
daniel    2622  2.7  0.5   5684  2756 pts/0    Ss   04:11   0:00 -zsh
daniel    2637  0.0  0.2   2760  1064 pts/0    R+   04:11   0:00 ps aux
daniel    2638  0.0  0.1   3372   756 pts/0    S+   04:11   0:00 grep daniel

I don't understand the first 2 lines with sshd. As far as I'm aware, I'm the only person ssh'd into my VPS. So why are TWO instances of sshd showing up?

Also, please correct me if I'm wrong. The -zsh is because I'm ssh'd into a zsh shell and ps aux and grep are because those are the commands I just ran.

share|improve this question
up vote 4 down vote accepted

The first process is the child process launched by sshd in response to your connection, the second is the child process launched that binds the psuedo terminal to the ssh session.

This is perfectly normal, you'll note that the second process is running under your credentials whereas the first is owned by root. This helps prevent privilege escalation - the process you are interacting with has your privileges so you couldn't exploit it to carry out a root privileged operation.

Yes, the zsh process is your shell, and the grep is your current command.

It can be easier to visualise the relationship between processes if you use the f parameter for ps:

 ps auwxf | less

This gives you a tree showing the parent/child relationships.

share|improve this answer
Mystery solved, awesome answer! – Barb Jun 19 '12 at 4:57

Have you considered the possibility that you may have accidentally exited an ssh session but did not end/close it? If not, try restarting the VPS and see if it returns.

share|improve this answer
Rebooted and it still looks the same. What's disturbing to me is that one of the users is root – Barb Jun 19 '12 at 4:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .