Why are there two ssh daemons running in top?

Question

I have Ubuntu 10.04.1 , SSH server is running fine, but I wonder, why there are two sshd instead of one? Isn't one multithreades daemon enough? Is this an option?

Answer 1

Doesn't top show userland threads by default? One is likely a thread of the other.

If you look in htop (a more interactive top) you can sort by tree and find out. You can also disable showing threads in its options screen (F2, Display Options and check Hide userland threads)

Answer 2

The OpenSSH server forks for every incoming connection, so it's normal to see multiple sshd processes, especially when you are logged in on the server, or when the computer is connected to the internet with a public IP address (scriptkiddies trying all the time).

From the manual:

 sshd listens for connections from clients.  It is normally started at boot from /etc/rc.  It forks a new daemon for
 each incoming connection.  The forked daemons handle key exchange, encryption, authentication, command execution,
 and data exchange.

If nobody is logged in, or trying to log in, there should be only one sshd process.