Some Linux security questions 2265

composlinuxmisc

This is the daemon that accepts ssh (and scp) requests. I am astonished that it takes much CPU time. My machine has been up for 10 days and this is what it says for sshd:

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 5055 0.0 0.0 3664 1552 ? S Jul20 0:00usr-sbin-sshd

N.B.: I do not use ssh or scp much. Time, BTW, in this list is not the % time, but the total time -- in this case in Minutes and Seconds. I note, with the top command, that sshd is using 0% of the cpu time.

You certainly want to see why sshd is so busy. Something is suspicious because it is using so much processor time. The sshd process itself does not use much time. Were you to login using ssh or scp from another machine, about all sshd does is fork off another process to do the work.

This is normal unless you have a pathetically slow processor or unless you run processor-intensive jobs (or a lot of them). My processors are always 100% busy because I have four BOINC applications running to soak up all the available processor time not otherwise used.

All logs are invar-log. (almost all) In particular,var-log-messages contains most of what you may want to see. Nothing to worry about. kdmgreet is probably waiting for you to login to the windowing system, and X is the main windowing software.

You can do this with iptables (firewall) or by configuring sshd correctly. There is an O'Reilly book, "SSH, The Secure Shell" that will help.

-- .~. Jean-David Beyer Registered Linux User 85642. V PGP-Key: 9A2FC99A Registered Machine 241939. ^^-^^ 05:50:01 up 10 days, 12:28, 3 users, load average: 4.22, 4.14, 4.05