[psychoxl99]

Every once in a while, I will get multiple sshd processes running as root, visible when I run "top". However, running "finger", I am the only user. Any ideas as to what could cause this?

[CyBerHigh]

Well are you logging into the computer via ssh when you notice the multiple ssh running?

ssh is a daemon that forks to handle each connection. So if you are logging in though ssh, perhaps your ssh client opens server ssh connections possible for file sharing? Or they could be other random people/bots attempting to see if they can log in. Possible searching for boxes with ssh and no root password.

[crazytoon]

Try using netstat to see who is connected to your ssh daemon.

netstat -a|grep ssh

[psychoxl99]

Thanks for the netstat tip. I did that and saw about 4 "established" connections from a Russian domain. Pretty sure they were hostile, we're not telling anybody in Russia to connect to us via SSH.

Does "established" mean they actually have our password in, or could it mean they're running programs to guess our password?