What is com.openssh.ssh-agent and how did it get on my computer?

Question

Level 1

19 points

What is com.openssh.ssh-agent and how did it get on my computer?

Is there any word on what this agent/daemon(?) is and how it got onto my computer? Is it normal that it comes up when entering the launchctl command? Can I verify somehow that it's configuration files are all set to not let someone remotely this computer?

I believe I may have been hacked based on a a ton of different things that I'm still trying to sort out. Phone and chat support it seems are not well equipped to deal with these sort of very legitimate technical questions and have otherwise been surprisingly misinformed, occasionally contradicting each other entirely.

I came across another question here https://discussions.apple.com/thread/5305907?start=0&tstart=0. I ran the 5 terminal commands suggested and one of the things that the terminal printed for the third command pipeline was com.openssh.ssh-agent. I know it's used in the remote connection feature on terminal but I've never made a remote connection to anyone.

I can't find it by searching "openssh" in Finder and I am not listing anything under the privacy feature for Spotlight.

MacBook Pro with Retina display, macOS Sierra (10.12.3)

Posted on Feb 25, 2017 10:22 AM

Reply

Answer 1

Barney-15E

Level 10

113,082 points

Feb 25, 2017 11:35 AM in response to ChaseDaniel

Which Launchctl command? There are many subcommands. Launchctl on its own doesn't do anything.

OpenSSH is an open source implementation of secure shell (i.e. remote login). It is the ssh implementation that Apple uses in macOS (as this tech note indicates: https://developer.apple.com/library/content/technotes/tn2449/_index.html)

Reply

Answer 2

ChaseDaniel Author

Level 1

19 points

Feb 25, 2017 12:46 PM in response to Barney-15E

Do you mean it has additional uses other than the Terminal Remote Connection option under File? I don't see much there other than update notes. The third pipeline of five from the link above in my question:

{ launchctl list | sed 1d | awk '!/0x|com\.apple|org\.(x|openbsd)/{print $3}'; echo; crontab -l 2> /dev/null; } | open -ef

Reply

Answer 3

Barney-15E

Level 10

113,082 points

Feb 25, 2017 2:18 PM in response to ChaseDaniel

ssh-agent does authentication for remote login, not necessarily for someone logging into your machine, but for you to log into another. So its existence is not nefarious and may be normal as the man page indicates it will start up once logged in.

Here is some information on OpenSSH: ssh-agent(1)

If Remote Login is not selected in the Sharing System prefs, you cannot ssh into your Mac.

You can also look inside your ~/.ssh/ folder for a config file. By default it is not there. You can "cat" it and see what is in there.

The other config file is in /etc/ssh/ and is called ssh_config. The default file on macOS is completely commented out (i.e. all lines begin with #).

Reply