Rogue ssh processes in F10

[physicsgeek42]

I have noticed my computer operation very slowly today, so I did a quick ps -ax to reveal a couple of sshd processes, which I thought was very odd, seeing as I'm on a laptop and have no recollection of enabling ssh access. One process was labeled [priv] and the other [net]. When I tried to kill the 2 processes, I was told they didn't exist. Another ps -ax revealed the same processes, but with different numbers. Couldn't kill those either. I ended up doing a killall sshd, which seems to have got it, and my computer is back up to it's normal speed, but what would cause this? I'm not sure what information would be most helpful, but I'm running F10 on an HP dv6663ca laptop. I'm on a university wired network (using my onboard gbit ethernet card, forgot which model but it was one of the ones that would get blown up by the 2.6.27 beta and RC builds), which I believe is DHCP, but I do not believe has any internal security at all. I had recently (i.e. when this started) been using wifi (4965agn), but that was secured.

Also, has this happened to anybody else? Any workarounds other than just killing the processes? Any info would be much appreciated.

if you do not need sshd, disable the service.

See the logs for sshd, at /var/log/secure: you may be sufferingone of those stupid sshd attacks, which are mostly harmless (apart from the fact that they steal bandwidth from you) assuming your passwords are good.

[jedsen]

"service sshd stop" as root will kill the process and "chkconfig sshd off" will turn the ervice off on all run levels so it doesn't start at boot.