On AIX 6100-05-01-1016 I accidentally killed the sshd. But for a suprise it still was running. Why? I did a:

kill PID

Q: ..so sshd doesn't reacts to normal kill signal? or are there any default security methods that starts an sshd if the old one get's killed?


I can't say for certain these days, but AIX used to run inetd. This is a daemon that listens to various ports and starts another daemon (like sshd or ftpd) on the connection. Check to see if inetd or xinetd is running (ps -e | grep inet), then look for /etc/inet.d or /etc/xinet.d. Beyond that we would need to see what is running (ps axo pid,cmd).

  • but doesn't inetd just start the corresponding daemon when a connection is made to a given port ? i.e. would one see an sshd process before an actual connection is made ? (rather than just inetd listening on port 22 ?) – Andre Holzner Aug 30 '11 at 5:47

There is a master sshd process that listens to incoming connections, and in addition (for recent versions of OpenSSH) there are two processes called sshd for each incoming SSH connection, one running as root and the other running as the logged-in user. If your OpenSSH is compiled without privilege separation (I don't know whether that's supported on AIX), there'll be a single sshd process per connection in addition to the main one.

You must have killed either a per-connection sshd or the master process, but not both. If you can still logged in over SSH, then what you killed was a per-connection process.


Maybe there is a "hidden" script that checks that sshd runs or not, and if it doesn't run, it starts it.

  • that's why I wonder whether after killing it it still has the same process id or not (see my comment above) – Andre Holzner Aug 30 '11 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.