8

Using PuTTY on my Windows laptop, I am able to ssh into my Mac desktop, but once I've logged in, I can't find any sshd process running on the Mac. E.g. running the following right after ssh-ing into the Mac:

% ps -eo pid,command | grep sshd | grep -v grep

...produces no output. Of course, needless to say, I get the same results (no output) if I use ps -ef instead of ps -eo pid,command.

Also, there's no /var/run/sshd.pid file.

What's going on? Does OS X use a different program to handle incoming ssh logins?

kjo
  • 1,020
  • 2
  • 14
  • 21

2 Answers2

10

No - OS X uses OpenSSH and you can inspect the source code used here.

Based on your output, it looks like sshd is not active on the machine. Also ps|grep ssh[d] will prevent your grep process from matching the target. Some people get concerned when they don't see sshd running, since it gets started on demand when launchd detects an incoming network request. Are you certain ssh is active? You could verify this with lsof|grep ssh if you have doubts.

Look for this when one ssh has been initiated recently on Lion:

Last login: Mon Jul 16 17:58:26 2012 from 10.0.1.35
mac:~ mike$ ps -ef|grep sshd
0   60320     1   0  4:23PM ??         0:00.00 /usr/libexec/launchproxy /usr/sbin/sshd -i
0   60321 60320   0  4:23PM ??         0:00.15 /usr/sbin/sshd -i
501 60330 60321   0  4:23PM ??         0:00.01 /usr/sbin/sshd -i
501 60336 60331   0  4:23PM ttys003    0:00.00 grep sshd
bmike
  • 235,889
  • Downvoted for not showing also the output you get from ps -eo pid,command|grep sshd. It will show at least as many processes as those shown by ps -ef|grep sshd, proving that my failure to observe a sshd process is not explained by my choice of flags to ps. – kjo Jul 18 '12 at 12:59
  • 4
    Seriously - you down vote over a ps argument choice? The PID is clearly the second column and the command is the last column in the -ef but it's your vote to cast. Your criticism of everyone that stepped up to try to help seems an odd way to attract more help. – bmike Jul 18 '12 at 14:00
  • My comment, and downvote, was in response to your original post, which started: "It looks like your syntax is a bit off." Which syntax in particular is off, and how exactly does this "off syntax" cause my not being able to see an sshd process? Later you write: "Also ps|grep ssh[d] will prevent your grep process from matching the target." I don't see why this is relevant, since, I did not use ps|grep sshd, nor did I use ps|grep ssh. Finally,... – kjo Jul 18 '12 at 19:26
  • ...you wrote: "Some people get concerned when they don't see sshd running, since it gets started on demand when launchd detects an incoming network request." Given that I clearly wrote that I searched for the sshd process immediately after ssh-ing into the Mac, your last remark, as well as the questions you ask in the revised version of your answer, make me question whether you actually read my post. – kjo Jul 18 '12 at 19:26
4

Is it okay to post to a really old question... I was looking to answer the same today and will attempt to clarify the clarify.

Remote Login enabled in System Preferences Sharing and port 22 is open:

% netstat -p tcp -lna | grep '\*\.22'
tcp4       0      0  *.22 *.*  LISTEN     
tcp6       0      0  *.22 *.*  LISTEN

Then lsof shows launchd is the one listening (found the right options for lsof in the man page and executed as root):

# lsof -iTCP -sTCP:LISTEN | grep ssh
launchd    1 root   50u  IPv6 0xc3c700cb936cd50f      0t0  TCP *:ssh (LISTEN)
launchd    1 root   51u  IPv4 0xc3c700cb9452be6f      0t0  TCP *:ssh (LISTEN)
launchd    1 root   53u  IPv6 0xc3c700cb936cd50f      0t0  TCP *:ssh (LISTEN)
launchd    1 root   58u  IPv4 0xc3c700cb9452be6f      0t0  TCP *:ssh (LISTEN)

And when you ssh into the system you see that ssh-agent and sshd are spawned to deal with the connection.

 # ps -ef | grep ssh | grep -v grep
 501  1231     1   0 12:52PM ??         0:00.02 /usr/bin/ssh-agent -l
 0    1257     1   0 12:53PM ??         0:00.04 sshd: xxxxx [priv] 
 501  1259  1257   0 12:53PM ??         0:00.02 sshd: xxxxx@ttys002
bjbk
  • 9,463
Greg
  • 41
  • Are you implying that ssh-agent runs on the remote side, and that it is responsible to deal with the connection? How does this fit to man ssh-agent stating that ssh-agent is »started in the beginning of […] a login session« and then »used for authentication when logging in to other machines using ssh«? Doesn’t this imply that the agent rather runs on the local side rather than the remote side, typically before the user has even started ssh to connect to a remote server? – Synoli Feb 26 '17 at 23:58