Weird Processes on my server from user....

[Dan Nelson]

In the last episode (Aug 07), Agus said:
> Hi guys,
> 
> Checking my server i found this processess....The user doesnt appear
> doing w..so its like if he was doing an scp or something like
> that...though in this case its sftp... But i read the man and doesnt
> have much information..so i dont understand what is going in the
> background with this proccesess or how can i check it...
> 
> the user is deamon and is a registered user...
> here is the pstree output:
> 
>  | |-+= 74888 root sshd: deamon [priv] (sshd)
>  | | \-+- 74891 deamon sshd: deamon at notty (sshd)
>  | |   \-+= 74892 deamon csh -c /usr/libexec/sftp-server
>  | |     \--- 74893 deamon /usr/libexec/sftp-server

I think you'll see this if the user is sftp'ing over SSHv1; the
sftp-server component has to be launched via a shell login because
SSHv1 doesn't have subsystems.

-- 
	Dan Nelson
	dnelson at allantgroup.com