Re: logsurfer: test config file: ´.*´ - - - 0 exec "/bin/echo $0"

J4 said:
> Dear all log analysers,
>
> 	I compiled & installed logsurfer1.5b from Source Forge.
>
> The logsurfer man page states that when I use a configuration file
> containing this line then all std in ought to be sent to std out.
> =B4.*=B4 - - - 0 exec "/bin/echo $0"
>
> Just to check that echo is there,
> # which echo
> /bin/echo
>
>
> However, this does not happen in my case:
[snip]

There's some unusual hidden characters in the config file, they show up i=
n
the strace read():

read(3, "\302\264.*\302\264 - - - 0 exec \"/bin/echo $"..., 1023) =3D 35

- rewrite the config file, without those \302 and \264 chars and all
should be well.

And as a security note, you should running logsurfer as root, and don't
put log data into shell commands like the "echo $0" in the example.
Attackers can usually insert data into log entries, for example if someon=
e
entered " ; some_evil_command" as an ssh login name then the line would
get appended to that echo command with bad results.

Kerry