On 21/9/2026, "Maarten de Vries" <[email protected]> wrote:
>Ehh, if you have a security tool that reads logs and executes shells >commands found in them, I think you should uninstall it. > >Putting this responsibility on smtpd is just wrong. It's not trivial to >ensure the log output is safe to mishandle in a shell. If this is >considered a problem for smtpd, I imagine there could be no end of bug >reports about weird things that end up in logs. > >If smtpd does try to avoid logging special shell characters, it makes >the logs less useful or more complicated to read. The only thing >services should worry about is not to log sensitive data like passwords. > >Log scanners should simply not parse and execute commands from logs. > Hi Maarten, Yes, I agree completely that in this case it turned out to be the security tool that caused the issue. That has now been fixed. I also agree that the logs without any modification can be useful to investigate what's happening. But maybe an option for escaping or filtering what goes to the logs would be useful. Otherwise these curl and perl script calls left in the logs are an accident waiting to happen. Best regards, David
