2

I've found something odd in my system monitor. In my process list was 'ssh-agent', now I'm not too familiar with SSH but I know that it can't be normal for an SSH service to be running on a VANILLA desktop Ubuntu installation. I've ran rkhunter and it came back with nothing in particular.

I ran this command and here are the results:

trev@trev-pc:~$ ps -aux | grep ssh
trev     1635  0.0  0.0  11140    48 ?        Ss   Feb18   0:00 /usr/bin/ssh-agent /usr/bin/dbus-launch --exit-with-session /usr/bin/im-launch mate-session
trev    15992  0.0  0.0  15192  2144 pts/1    S+   20:06   0:00 grep --color=auto ssh

What's going on here? Is this something to be concerned about?

16

No, this is not something to be concerned about. This is ssh-agent, not sshd, which is the SSH daemon. If you have a look at man ssh-agent:

 ssh-agent is a program to hold private keys used for public key
 authentication (RSA, DSA, ECDSA, ED25519).  The idea is that ssh-agent is
 started in the beginning of an X-session or a login session, and all
 other windows or programs are started as clients to the ssh-agent
 program.

The way it works is that when you use SSH to connect to somewhere (the command-line client ssh is installed by default, and other programs, like the file browser can also act as SSH clients), the connecting program will use the agent instead of loading the private key itself:

 The agent will never send a private key over its request channel.
 Instead, operations that require a private key will be performed by the
 agent, and the result will be returned to the requester.  This way,
 private keys are not exposed to clients using the agent.

The benefits are that you only need to unlock the private key once per session (the agent will then store it in memory), and clients never see your unencrypted private key directly.

It's the opposite of a backdoor, in a way.

  • Thank you, I'm not very good with this kind of stuff! I appreciate the well written reply. – ctrev Feb 21 '16 at 4:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.