I killed sshd but it's still running?

Question

On AIX 6100-05-01-1016 I accidentally killed the sshd. But for a suprise it still was running. Why? I did a:

kill PID

Q: ..so sshd doesn't reacts to normal kill signal? or are there any default security methods that starts an sshd if the old one get's killed?

Answer 1

I can't say for certain these days, but AIX used to run inetd. This is a daemon that listens to various ports and starts another daemon (like sshd or ftpd) on the connection. Check to see if inetd or xinetd is running (ps -e | grep inet), then look for /etc/inet.d or /etc/xinet.d. Beyond that we would need to see what is running (ps axo pid,cmd).

Answer 2

There is a master sshd process that listens to incoming connections, and in addition (for recent versions of OpenSSH) there are two processes called sshd for each incoming SSH connection, one running as root and the other running as the logged-in user. If your OpenSSH is compiled without privilege separation (I don't know whether that's supported on AIX), there'll be a single sshd process per connection in addition to the main one.

You must have killed either a per-connection sshd or the master process, but not both. If you can still logged in over SSH, then what you killed was a per-connection process.

Answer 3

Maybe there is a "hidden" script that checks that sshd runs or not, and if it doesn't run, it starts it.