[SOLVED] Sshd PID IP return

yo8rxp · 01-03-2015, 07:57 AM

Hi !
Some thing bothers me
Seems that scp /sftp sessions does show their respective PID under ps aux | grep ssh | grep notty

Code:

ps aux | grep sshd | grep notty
gabriel   6594  0.0  0.0  13104  1688 ?        S    15:39   0:00 sshd: gabriel@notty 
gabriel   6796  0.0  0.0  13248  1824 ?        S    15:52   0:00 sshd: gabriel@notty

So far so good , but say, in order to kill PID associated with specific IP address , i have to look into netstat to look for that PID , unfortunateley the PID reported by ps does not show under netstat ,

Code:

Desktop gabriel # netstat -a | grep 6594
Desktop gabriel # netstat -a | grep 6796
Desktop gabriel #

and without IP versus PID i could blindly kill sshd processes

How do i do that ?

..please do not reply with the big question "why ?"

Habitual · 01-03-2015, 09:14 AM

Code:

lsof | grep sshd | grep ESTAB

?

allend · 01-03-2015, 09:37 AM

Have you tried 'netstat -atnp' or 'ss -atnp'?

robertjinx · 01-03-2015, 05:19 PM

notty means there is no terminal, something like sftp.

Code:

lsof | awk '$2 == PID {print}' | grep TCP

NOTE: You need to run the command as root.

yo8rxp · 01-04-2015, 01:36 AM

thanks everyone !

Unfortunateley , none of the above does work , decided to create users for each device (tablet 1 to 10 , mobile, so on) , in this way it is a simple matter to kill -9 sshd sessions opened by android sshfs individualy without blind killing all sshd PID's

Quote:

gabriel@Desktop ~ $ ps aux | grep gabriel-mobile | grep notty
gabriel+ 3329 0.0 0.0 13204 1804 ? S 09:23 0:00 sshd: gabriel-mobile@notty
gabriel@Desktop ~ $

Quote:

Desktop gabriel # kill -9 3329
Desktop gabriel # ps aux | grep notty | grep gabriel-mobile
Desktop gabriel #

I would still like to use same user on multiple devices, and somehow to get the relevance within sshd PID and IP address
If anyone comes with another ideea , please post it here as it is not marked as "Solved"

robertjinx · 01-04-2015, 09:27 AM

Doesn't look like you even tried:

Code:

lsof | awk '$2 == PID {print}' | grep TCP

robertjinx · 01-04-2015, 09:38 AM

This idea is a bit better:

Code:

lsof -n |awk '$2 == 11306 && $8 == "TCP" {print $9}'

11306 is the pid of one of the sftp processes:

Code:

root     11306  8665  0 16:35 ?        00:00:00 sshd: robert@notty

yo8rxp · 01-04-2015, 09:46 AM

Damn ! , using ftp proto on android phone instead of ssh and I was searching for ssh , damn mistake ,,,blushing here LOL

Thank you robertjinx for busting the brain out !
Sincerely, Gabriel