I've got a little TurnKey Linux Debian Squeeze VM that I use for SFTP. I had a user login and transfer a file the other day and now I can't seem to kill the session.

I'm still a little shaky in Linux but here are the symptoms:

  • netstat - tanp shows the user with an established connection with a PID/Program name of 2603/sshd
  • kill -term 2603 runs successfully but...
  • netstat -tanp shows the foreign address in TIME_WAIT with an additional entry of ESTABLISHED with the same foreign address and a new PID

Lather, rinse, repeat.

I confirmed with the user that he's not actually connected (he in fact uninstalled the SFTP client on his side).

I also tried restarting ssh and rebooting the VM several times and it pops back up as ESTABLISHED.

Any idea what's happening or how I can kill this?

  • It looks like your are killing sshd deamon. can you give the whole netstat - tanp line ? you may edit IP if not like 192.168.X.Y – Archemar Sep 15 '14 at 13:25
  • Thanks for the comment @Archemar. When I booted the VM this morning the ESTABLISHED connection was gone. I assume there is a time threshold defined somewhere that removes the entry after a certain period of time? – bupkis Sep 15 '14 at 17:24
  • There is a SSH connection timeout. But the connection should not survive a reboot, and not even a SSHD restart for that matter. – John WH Smith Oct 20 '14 at 16:34

The sequence you described looks very much like something was re-connecting each time. There is no way for a connection to survive a reboot (they aren't stored on disk anywhere, and ram gets cleared), so if that foreign address was connected again after the reboot then they must have been making new connections on the other side.

Lots of software will reconnect automatically. If you believe the user had fully terminated his client, then its also possible a virus on his computer was connecting, or maybe that foreign address wasn't even this particular user? How secure are your passwords?

If it happens again, you can look at the auth logs to see each SSH login attempt, and you can also change the user's password to prevent further logins.


kill -term 2603 will send a SIGTERM which can be caught, try sending a SIGKILL, kill 2603. Also, does the PID change whenever you send kill -term 2603? Or does it stay at 2603? If it changes, the process is restarting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.