OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Wietse Venema (wietseporcupine.org)
Date: Tue Jun 04 2002 - 09:30:13 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    "Jordan Russell" <jr-list-postfixquo.to> writes:
    > Maybe I'm missing something, but why can't Postfix just print the 8-bit
    > characters verbatim when writing to syslog?

    Information in logfiles is provided by an untrusted source. It
    can be extremely dangerous. As a safety measure, Postfix logging
    always maps non-printable non-ASCII characters to ?, and always
    truncates text to a known length.

    By allowing raw data to be logged, you can't even trust the line
    boundaries in your logfile. Imagine if someone can insert newlines
    (or even carriage returns) in your logfile, or lines that begin
    with ~!command or other magic sequences that make xterms do weird
    things, and so on. Logfiles are dangerous.

            Wietse
    -
    To unsubscribe, send mail to majordomopostfix.org with content
    (not subject): unsubscribe postfix-users