With the recent brewhaha about SSH I can't help but wonder about other daemons running on my boxes that don't have privelage separation. Is it possible to give Syslog-ng a command line option (like named or ntpd)? So that after Syslog-ng binds to the network socket (with root privs) then it sets it's UID to something other than root? I realize that many of the options in syslog-ng might be more complex if this were done. I can think of many permissions and output file name and directory macros whose code would have to be modified if syslog-ng were to properly run as a regular user instead of ROOT and be able to properly handle error messages and such for permissions and directories and everything. However, it is inevitable with the facts that Syslog-NG is a network Daemon, that receives input and has macros based on that input to write to files, that a remote vulnerability in Syslog-NG will become known.... If Syslog-NG is running as a non-root UID then this is not a problem, (other than a big nuisance). -Ben.