SSH Agent running, system compromised??

marco18 · 08-13-2007, 03:13 PM

Hey there! Looking for some security weaknesses of my system, I closed the ssh port and shot down the ssh daemon (I don't use ssh at all).
But surprisingly, I found a process running called "ssh-agent". It is not a system service and I can't find it anywhere to avoid it from starting on boot. So, my questions are two:

1) Where else apart from the init.d folder are contained the services or apps that are loaded on system boot?

2) What's the risk I take if I let this process running (with the ssh port is closed)?

Any help will be welcomed. Thanks!

lefty.crupps · 08-13-2007, 03:45 PM

Read here about places where startup programs can happen:
. http://www.linuxquestions.org/questi...d.php?t=543046
Also it could be started by the 'at' command or by 'cron' (which has many locations...).

Even with SSH port closed, ssh can be specified to attach to another port, so this agent could be listening to another port as a sneaky maneuver...

you could also look at that process in a Tree via command line to see what is starting ssh-agent:
ps axjf (use [shift][page up] or [shift][page down] to look through the results)
run 'man ps' at a command line to learn more about that...

let us know how it turns out!

zhangmaike · 08-13-2007, 04:07 PM

I'd recommend reading the man page for ssh-agent.

Code:

SSH-AGENT(1)              BSD General Commands Manual             SSH-AGENT(1)

NAME
     ssh-agent -- authentication agent

SYNOPSIS
     ssh-agent [-a bind_address] [-c | -s] [-t life] [-d] [command [args ...]]
     ssh-agent [-c | -s] -k

DESCRIPTION
     ssh-agent is a program to hold private keys used for public key authenti-
     cation (RSA, DSA).  The idea is that ssh-agent is started in the begin-
     ning of an X-session or a login session, and all other windows or pro-
     grams are started as clients to the ssh-agent program.  Through use of
     environment variables the agent can be located and automatically used for
     authentication when logging in to other machines using ssh(1).

...

Matir · 08-13-2007, 06:25 PM

ssh-agent is not a service that listens for incoming ssh connections. It caches your private ssh key for use in passwordless authentication TO other systems. Many installations have an ssh-agent in your profile by default.

marco18 · 08-13-2007, 08:37 PM

So it isn't a risk for me. Better that way

. Thanks a lot guys!