Is it possible to see MacOS's sshd process in the output of ps?

Question

I am running the following version of MacOS:

$ sw_vers
ProductName:            macOS
ProductVersion:         14.5
BuildVersion:           23F79

I observe that when I run ssh localhost, I am able to log in.

However, when I run the following command, I see only the grep process itself:

ps aux | grep sshd
hqin             93708   0.1  0.0 410059824     48 s005  S+   11:55AM   0:00.00 grep sshd

Is there some additional magic I can use to see the ssh server's process?

Answer 1

macOS doesn't leave sshd running all the time. Instead, there is a launchd job for sshd, defined in /System/Library/LaunchDaemons/ssh.plist. That means that launchd itself listens for connections on the SSH port (22/TCP), and if it receives a connection attempt, it launches sshd on-demand to service the connection.

If you're familiar with traditional Unix "internet daemons" like inetd and xinetd, this is the same idea.

You can verify this with sudo lsof -i :22, and seeing that there are indeed listeners on port 22, but those listeners belong to process ID #1, which is launchd.