Is this a strange ssh process??

I saw the following processes which made sshd critical some time ago. But now it has gone..

==============
ps ax|grep ssh

27472 ? S 0:00 sshd: unknown [net]
27473 ? S 0:00 sshd: unknown [net]
27478 ? S 0:00 sshd: unknown [net]
27479 ? S 0:00 sshd: unknown [net]
27480 ? S 0:00 sshd: unknown [net]
27481 ? S 0:00 sshd: unknown [net]
27482 ? S 0:00 sshd: unknown [net]
27483 ? S 0:00 sshd: unknown [net]
27484 ? S 0:00 sshd: unknown [net]
27485 ? S 0:00 sshd: unknown [net]


==============

# ll /proc/27485/
total 0
dr-xr-xr-x 3 sshd sshd 0 May 30 19:37 ./
dr-xr-xr-x 267 root root 0 Mar 3 08:16 ../
-r--r--r-- 1 root root 0 May 30 19:37 cmdline
-r--r--r-- 1 root root 0 May 30 19:37 cpu
lrwxrwxrwx 1 root root 0 May 30 19:37 cwd -> /var/empty/sshd/
-r-------- 1 root root 0 May 30 19:37 environ
lrwxrwxrwx 1 root root 0 May 30 19:37 exe -> /usr/sbin/sshd*
dr-x------ 2 root root 0 May 30 19:37 fd/
-r--r--r-- 1 root root 0 May 30 19:37 maps
-rw------- 1 root root 0 May 30 19:37 mem
-r--r--r-- 1 root root 0 May 30 19:37 mounts
lrwxrwxrwx 1 root root 0 May 30 19:37 root -> /var/empty/sshd/
-r--r--r-- 1 root root 0 May 30 19:37 stat
-r--r--r-- 1 root root 0 May 30 19:37 statm
-r--r--r-- 1 root root 0 May 30 19:37 status

==============

# lsof -p 27472
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 27472 sshd cwd DIR 8,4 4096 6012939 /var/empty/sshd
sshd 27472 sshd rtd DIR 8,4 4096 6012939 /var/empty/sshd
sshd 27472 sshd txt REG 8,4 268956 557366 /usr/sbin/sshd
sshd 27472 sshd mem REG 8,4 106896 541795 /lib/ld-2.3.2.so
sshd 27472 sshd mem REG 8,4 28228 1228932 /usr/lib/libwrap.so.0.7.6
sshd 27472 sshd mem REG 8,4 30488 540760 /lib/libpam.so.0.75
sshd 27472 sshd mem REG 8,4 14832 540688 /lib/libdl-2.3.2.so
sshd 27472 sshd mem REG 8,4 76508 540720 /lib/libresolv-2.3.2.so
sshd 27472 sshd mem REG 8,4 12508 540726 /lib/libutil-2.3.2.so
sshd 27472 sshd mem REG 8,4 52584 1228855 /usr/lib/libz.so.1.1.4
sshd 27472 sshd mem REG 8,4 91004 540692 /lib/libnsl-2.3.2.so
sshd 27472 sshd mem REG 8,4 972156 540755 /lib/libcrypto.so.0.9.7a
sshd 27472 sshd mem REG 8,4 385252 8536088 /usr/kerberos/lib/libkrb5.so.3.1
sshd 27472 sshd mem REG 8,4 72552 8536078 /usr/kerberos/lib/libk5crypto.so.3.0
sshd 27472 sshd mem REG 8,4 5540 8536072 /usr/kerberos/lib/libcom_err.so.3.0
sshd 27472 sshd mem REG 8,4 1571796 2687137 /lib/tls/libc-2.3.2.so
sshd 27472 sshd mem REG 8,4 8548 540741 /lib/liblaus.so.1.0.0
sshd 27472 sshd mem REG 8,4 76712 8536074 /usr/kerberos/lib/libgssapi_krb5.so.2.2
sshd 27472 sshd mem REG 8,4 51916 540708 /lib/libnss_files-2.3.2.so
sshd 27472 sshd mem CHR 1,5 105800 /dev/zero
sshd 27472 sshd 0u CHR 1,3 99822 /dev/null
sshd 27472 sshd 1u CHR 1,3 99822 /dev/null
sshd 27472 sshd 2u CHR 1,3 99822 /dev/null
sshd 27472 sshd 3u unix 0xe5b21e40 2905064552 socket
sshd 27472 sshd 4u IPv4 -1389902764 TCP IP1Is this a strange ssh process??sh->IP2:60763 (ESTABLISHED)
sshd 27472 sshd 6w FIFO 0,5 2905064533 pipe

 

 

 

 

Top