ssh outputs messages to the terminal after other processes have been started on the server side. As ssh doesn't write its name and it isn't the only process, it may be difficult to know where messages like that come from. For instance, I got 12 lines X11 connection rejected because of wrong authentication. after the prompt, while I wasn't using the remote machine. The ssh binary contains such a message, so that I suppose it comes from it (however I'm not sure as sshd contains it too). So, one should have: ssh: X11 connection rejected because of wrong authentication. or sshd: X11 connection rejected because of wrong authentication. if this comes from sshd.