Why are there two sshd processes for each active ssh session? (Doc ID 1390241.1)

Last updated on JULY 29, 2016

Applies to:

Solaris Operating System - Version 10 5/08 U5 to 11.3 [Release 10.0 to 11.0]
Information in this document applies to any platform.


It may be noticed that when a SSH connection is made to a Solaris host there are two sshd daemons executed for that open and active session.

For example on a system with no active ssh connections one is made.

Initially there is one sshd process that is the listener for incoming connection requests.

# ps -efZ | grep sshd | grep global
global root 443 1 0 09:33:10 ? 0:00 /usr/lib/ssh/sshd
global root 4169 4167 0 08:03:43 pts/1 0:00 grep sshd

A ssh connection is opened to the host:

# ssh localhost
Last login: Thu Dec 22 08:02:11 2011 from localhost
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
You have mail.

After the connection is established the ps output shows the listener process plus the two processes started for the session. In this case it was a root user so the third processes, owned by the user, shows root in this scenario.

# ps -efZ | grep sshd | grep global
global root 443 1 0 09:33:10 ? 0:00 /usr/lib/ssh/sshd
global root 4171 443 0 08:03:58 ? 0:00 /usr/lib/ssh/sshd
global root 4172 4171 2 08:03:58 ? 0:01 /usr/lib/ssh/sshd


Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms