# What is "sshd.pam" on port 2222?

**URL:** <https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864>\
**Category:** Rocky Linux Help & Support\
**Created:** [December 12, 2021, 12:59pm UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864 "2021-12-12T12:59:53Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![alt](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/alt/32/2676_2.png) [@alt](https://forums.rockylinux.org/u/alt)\
**Post date:** [December 12, 2021, 12:59pm UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/1 "2021-12-12T12:59:53Z")

</div>

I am working on setting up something to listen on port 2222 on my host, but was surprised to see that there is already something listening on that port.

What is `sshd.pam` and why is it listening on this port? I have sshd running as a systemd service, and I tried stopping it just to verify, and yes, sshd only listens to port 22 which is released when the sshd service is stopped.

Any help on what this is and where it comes from is much appreciated. I would like to release this port for my other use, but just killing the pid immediately starts up another instance of whatever this is. Naturally I want to clear this away in a proper manner so that I don’t risk conflicts later.

TLDR; What is running on port 2222 in my case, and how do I properly stop it so that I can run something else on that port?

```auto
❯ ss -ltnp | rg 2222
LISTEN 0 128 0.0.0.0:2222 0.0.0.0:* users:(("sshd.pam",pid=2460687,fd=3))
LISTEN 0 128 [::]:2222 [::]:* users:(("sshd.pam",pid=2460687,fd=4))

```

---

<div class="post-metadata">

**Author:** ![tjdoyle](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/tjdoyle/32/500_2.png) [@tjdoyle](https://forums.rockylinux.org/u/tjdoyle)\
**Post date:** [December 12, 2021, 2:17pm UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/2 "2021-12-12T14:17:53Z")

</div>

Hi,

SSH running on 2222 with pam is not the norm, please check your sshd config:

`/etc/ssh/sshd_config`

&

`/etc/ssh/sshd_config.d/`

Thanks Tom.

---

<div class="post-metadata">

**Author:** ![alt](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/alt/32/2676_2.png) [@alt](https://forums.rockylinux.org/u/alt)\
**Post date:** [December 12, 2021, 7:56pm UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/3 "2021-12-12T19:56:38Z")

</div>

I can’t find any mention of port 2222 in /etc/ssh 😕

---

<div class="post-metadata">

**Author:** ![tjdoyle](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/tjdoyle/32/500_2.png) [@tjdoyle](https://forums.rockylinux.org/u/tjdoyle)\
**Post date:** [December 12, 2021, 8:23pm UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/4 "2021-12-12T20:23:08Z")

</div>

Hi,

Is this a fresh install your trying to setup this on, I’m guessing not. Please provide more details about your setup?

Thanks Tom.

---

<div class="post-metadata">

**Author:** ![anemarkus](https://avatars.discourse-cdn.com/v4/letter/a/51bf81/32.png) [@anemarkus](https://forums.rockylinux.org/u/anemarkus)\
**Post date:** [December 12, 2021, 9:52pm UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/5 "2021-12-12T21:52:57Z")

</div>

> [@alt](#):
>
> ```auto
> ❯ ss -ltnp | rg 2222
> LISTEN 0 128 0.0.0.0:2222 0.0.0.0:* users:(("sshd.pam",pid=2460687,fd=3))
> LISTEN 0 128 [::]:2222 [::]:* users:(("sshd.pam",pid=2460687,fd=4))
> 
> ```

the output gives you the pid 2460687, so you could try

```auto
# lsof -p 2460687
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 2460687 root cwd DIR 253,0 242 96 /
sshd 2460687 root rtd DIR 253,0 242 96 /
sshd 2460687 root txt REG 253,0 852888 1015456 /usr/sbin/sshd
...
long list of files 

```

With that you should see which binary it is and what files it has open. Maybe that gives you a clue what it is.

---

<div class="post-metadata">

**Author:** ![alt](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/alt/32/2676_2.png) [@alt](https://forums.rockylinux.org/u/alt)\
**Post date:** [December 13, 2021, 8:09am UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/6 "2021-12-13T08:09:37Z")

</div>

I found what it was now, I had knockd running in a docker container, and for some reason it was keeping port 2222 open, though nothing was sending the knock sequence. I restarted the container and now port 2222 is released.

Thanks for the help!

---

<div class="post-metadata">

**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\
**Post date:** [August 25, 2023, 3:59am UTC](https://forums.rockylinux.org/t/what-is-sshd-pam-on-port-2222/4864/7 "2023-08-25T03:59:34Z")

</div>