What it meas by [priv] in sshd for user's process?

arghagain · 07-12-2009, 02:10 AM

When I do

Code:

ps aux | grep andy

I saw:

root 11015 0.0 0.0 10004 2808 ? Ss 02:03 0:00 sshd: andy [priv]
andy 11020 0.0 0.0 10004 1684 ? S 02:04 0:00 sshd: andy@pts/0

What it means by andy [priv]? Also I was the only one that logged into my server, but I saw "andy [priv]" using sshd appear to be ran under root. I logged in using andy account of course, but usually I only saw andy@pts/0. It should not show me the "andy [priv]".

This means my server has security issue or someone has compromised my server? thanks...

unSpawn · 07-12-2009, 06:31 AM

The "[priv]" argv0 means this is the privilege separation thread sshd runs for the user logigng in. That is a good thing.
If OpenSSH would show none it would mean that /etc/sshd_config "UsePrivilegeSeparation" was set to "no" which is a BAD thing (like seeing "root sshd: root [priv]").