Kurt Jaeger
2013-Aug-21 15:21 UTC
sftp logging, filenames with strange characters and parsing the logfile
Hi! The OpenSSH sshd sftp function can be configured to send logging to syslog. When a file is open'ed or closed with unexpected characters, those characters are send directly to syslog, e.g. a file with a '"' in it: Aug 21 17:09:11 test internal-sftp[10128]: open "/usr/home/test/te"st" flags WRITE,CREATE,TRUNCATE mode 0664 This makes is difficult and error-prone to parse the logfile. Would it be possible to mask those characters in filenames, e.g. like the quotemeta function in perl does or the %xx escapes used in apache ? Alternativly, if the logging is changed so that the filename comes at the end, then the parser can just read until end-of-line (if the filename does not contain a newline...) Something like this: Aug 21 17:09:11 test internal-sftp[10128]: open flags WRITE,CREATE,TRUNCATE mode 0664 name /usr/home/test/te"st -- MfG/Best regards, Kurt Jaeger 7 years to go ! Dr.-Ing. Nepustil & Co. GmbH fon +49 7123 93006-0 pi at nepustil.net Rathausstr. 3 fax +49 7123 93006-99 72658 Bempflingen mob +49 171 3101372