find out what programm wants to open a ssh session?

[Avi Greenbury]

robert rottermann wrote:
> Hi there,
> on my Ubuntu 13.04 laptop I deleted all entries in .ssh/known_hosts.
> Since then, every couple of minutes I am asked that one of my remote
> hosts is not in known_hosts and whether it is OK to connect to it.

How are you asked? Could you get a screenshot so we can guess at which
agent is being invoked? :)

> Now I wonder what process would try to open a connection to that
> particular host.
> 
> How can I find out what process that would be?

Personally, I'd open up a terminal and, while that pop-up is showing,
see what the output of 

    sudo netstat -ntp  | grep :22

is; netstat will print out a list of current connections, and the grep
will extract those involving port 22 (which ssh uses). For example,
this is four ssh sessions I have open to a total of three hosts:

    avi at fantastic:~$ sudo  netstat -ntp  | grep :2
    [sudo] password for avi: 
    tcp        0      0 192.168.1.126:38334     192.168.2.48:22     ESTABLISHED 6560/ssh        
    tcp        0      0 192.168.1.126:33493     192.168.2.222:22    ESTABLISHED 10039/ssh       
    tcp        0      0 192.168.1.126:51534     192.168.2.222:22    ESTABLISHED 8758/ssh        
    tcp        0      0 192.168.1.126:43146     192.168.2.17:22     ESTABLISHED 28952/ssh   

That line before the '/ssh' is the PID of the process with the
connection. You could grep `ps auxwww` for this. Or, perhaps, pipe
`pstree -A` into less and search for it - that way you can go back up
the process tree and see what invoked the SSH client.

-- 
Avi