--- title: "sshd: what Remote Login is, why it uses the network, and whether to block it · Kilobat" url: "https://kilobat.app/processes/sshd" description: "sshd is the SSH server behind Remote Login on a Mac. What its traffic is, what is normal, and what breaks if you block it or turn it off." --- Nearby devices # What is sshd? `sshd` is the OpenSSH server that macOS uses for Remote Login. When another computer logs in to this Mac with SSH, or copies files with SFTP or scp, the session goes through `sshd`. Process: `sshd` · Also seen as: `sshd-session`, `sshd-keygen-wrapper` · Made by OpenSSH project, shipped by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It is the SSH server for Remote Login, so other computers can log in to this Mac with SSH or copy files with SFTP. Safe to block Safe to block if nobody logs in to this Mac remotely. It's cleaner to turn off Remote Login in Sharing settings. Path `/usr/sbin/sshd` `/usr/libexec/sshd-keygen-wrapper` launchd label `com.openssh.sshd` Signing identifier `com.apple.sshd` `com.apple.sshd-keygen-wrapper` ## What it is The man page calls `sshd` the OpenSSH daemon. It listens for connections from clients and forks a new daemon for each one, which handles encryption, authentication and the session. On macOS, launchd starts it as `com.openssh.sshd`, through `/usr/libexec/sshd-keygen-wrapper`. Apple's Remote Login article says that it lets you access the Mac from another computer with SSH or SFTP. Apple lists TCP port 22 for SSH, SFTP and scp. ## Why it uses the network - **Remote sessions.** Commands typed in an SSH session, and their output, travel between the two computers. - **File copies.** SFTP, scp and rsync over SSH copy files to or from this Mac through `sshd`. - **Tunnels.** An SSH client can forward ports through the connection, so other traffic travels inside it. ## How much is normal With Remote Login off, macOS's built-in SSH service normally does not listen on port 22. Another service can still use that port. An interactive session uses little data. File copies use as much as the files. If you didn't turn on Remote Login, a management profile from your organization may have. Ask your administrator. ## When it uses a lot, and why - **File transfers.** Copying a large folder with scp, SFTP or rsync over SSH sends every byte. - **Port forwarding.** Traffic that a client tunnels through SSH counts as `sshd` traffic on this Mac. - **Login attempts.** If port 22 is reachable from the internet, other computers can try to log in. Each attempt is small, but they can be frequent. ## Is it safe to block? Safe to block Safe to block if nobody logs in to this Mac remotely. It's cleaner to turn off Remote Login in Sharing settings. What breaks if you block it - SSH, SFTP and scp to this Mac stop working. - Tools that connect to this Mac over SSH, such as remote editors and deploy scripts, fail. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Choose Apple menu › System Settings › General › Sharing. 2. Turn off Remote Login if you don't use it. 3. If you need it, click the Info button next to Remote Login. Choose “Only these users” and add only the users who need it. 4. Don't make port 22 reachable from the internet unless you need it. ## See how much it uses 1. In Terminal, list the SSH connections to this Mac now. ``` sudo lsof -nP -i :22 ``` Needs an administrator password. 2. Open Activity Monitor from Applications › Utilities. Click Network, then search for `sshd`. ## With Kilobat 1. In the Kilobat app list, search for `sshd`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'sshd' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'sshd' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Questions **Is sshd running on my Mac by default?** Remote Login is off unless you or your organization turned it on. Check System Settings › General › Sharing. **Does this page cover the ssh command?** No. `ssh` is the client that you run to connect to other computers. Kilobat writes reports after typed SSH sessions. ## Sources - sshd(8), man page installed with macOS 27.2 - launchd property list com.openssh.sshd, macOS 27.2 - [Apple Support: Allow a remote computer to access your Mac](https://support.apple.com/guide/mac-help/allow-a-remote-computer-to-access-your-mac-mchlp1066/mac) - [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229) Checked on 1 November 2026. ## Related - [screensharingd](https://kilobat.app/processes/screensharingd): Part of macOS. It accepts Screen Sharing and VNC connections from other computers, so another person can see and control this Mac. - [smbd](https://kilobat.app/processes/smbd): Part of macOS. It is the SMB file server for File Sharing, so its traffic is other computers reading and writing this Mac's shared folders. - [ssh: connect to host port 22: Operation timed out on Mac](https://kilobat.app/guides/ssh-port-22-operation-timed-out) - [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming)