Why in all this telnetd flap has nobody mentioned that /bin/login should be relinked STATICALLY? That at least defers the LD_* class of problem until after login has done the setuid and exec, but still leaves things like IFS passed to scripts. Still, my own rule of thumb is that any binary that talks to the net, handles inbound connections, handles authentication, etc ... should not be depending on shared libs. It's well worth the miniscule disk space hit. Vendors, LISSEN UP. _H*