Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

before login:

$ ps -elf | grep sshd
5 S root     26135     1  0  80   0 - 13115 ?      17:26 ?        00:00:00 /usr/sbin/sshd
0 S test     26480 21337  0  80   0 -  4154 -      18:41 pts/27   00:00:00 grep --colour=auto sshd

after login:

$ ps -elf | grep sshd
5 S root     26135     1  0  80   0 - 13115 ?      17:26 ?        00:00:00 /usr/sbin/sshd
4 S root     26577 26135  0  80   0 - 24204 ?      18:42 ?        00:00:00 sshd: test [priv] 
5 S test     26582 26577  0  80   0 - 24204 ?      18:42 ?        00:00:00 sshd: test@pts/30 
0 S test     26653 21337  0  80   0 -  4155 -      18:42 pts/27   00:00:00 grep --colour=auto sshd

What are the two processes for?

4 S root     26577 26135  0  80   0 - 24204 ?      18:42 ?        00:00:00 sshd: test [priv] 
5 S test     26582 26577  0  80   0 - 24204 ?      18:42 ?        00:00:00 sshd: test@pts/30

Thanks,

share|improve this question

1 Answer 1

up vote 31 down vote accepted

Privilege separation - one process that retains root privileges to do things that only root can do, and another that does everything else. See UsePrivilegeSeparation in sshd_config(5)

share|improve this answer
    
Thanks for the pointer, after I took a closer look at it, it looks that there are 3 processes created during login, one running in privileged mode, one runs in unprivileged "sshd" user, after authentication finishes, this unprivileged process got killed and a new sshd process created under the login name. Is there anywhere documenting this in detail, e.g. the interactions between these processes? Thanks. –  wei Apr 1 at 18:27
4  
@wei, yes, it's documented in BXR.SU/OpenBSD/usr.bin/ssh/sshd.c. If you search for fork, you'll find that it's used once in privsep_preauth() and again in privsep_postauth(). –  cnst Apr 1 at 20:10
    
@cnst thank you! –  wei Apr 1 at 20:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.