diff --git a/AcceptThread.cpp b/AcceptThread.cpp
index 253121f7..6710d0c9 100644
--- a/AcceptThread.cpp
+++ b/AcceptThread.cpp
@@ -69,7 +69,11 @@ CAcceptThread::CAcceptThread( unsigned int nWorkerThreadsPerMaster, unsigned sho
 {
 	WorkerThreadsPerMaster=nWorkerThreadsPerMaster;
 
-	s=socket(AF_INET,SOCK_STREAM,0);
+	int type = SOCK_STREAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+	type |= SOCK_CLOEXEC;
+#endif
+	s=socket(AF_INET, type, 0);
 	if(s<1)
 	{
 		Server->Log("Creating SOCKET failed. Port "+convert((int)uPort)+" may already be in use",LL_ERROR);
diff --git a/LoadbalancerClient.cpp b/LoadbalancerClient.cpp
index 3ece2914..ebaedb32 100644
--- a/LoadbalancerClient.cpp
+++ b/LoadbalancerClient.cpp
@@ -38,7 +38,11 @@ void CLoadbalancerClient::operator ()(void)
 	rc = WSAStartup(MAKEWORD(2,2), &wsadata);
 	if(rc == SOCKET_ERROR)	return;
 #endif
-	SOCKET s=socket(AF_INET,SOCK_STREAM,0);
+	int type = SOCK_STREAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+	type |= SOCK_CLOEXEC;
+#endif
+	SOCKET s=socket(AF_INET, type,0);
 	if(s<1)
 	{
 		Server->Log("Creating SOCKET failed (LB)",LL_ERROR);
diff --git a/Server.cpp b/Server.cpp
index b59bf2ce..ecc07088 100644
--- a/Server.cpp
+++ b/Server.cpp
@@ -973,7 +973,12 @@ IPipe* CServer::ConnectStream(std::string pServer, unsigned short pPort, unsigne
 	server.sin_port=htons(pPort);
 	server.sin_family=AF_INET;
 
-	SOCKET s=socket(AF_INET, SOCK_STREAM, 0);
+	int type = SOCK_STREAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+	type |= SOCK_CLOEXEC;
+#endif
+
+	SOCKET s=socket(AF_INET, type, 0);
 	if(s==SOCKET_ERROR)
 	{
 		return NULL;
diff --git a/ServiceAcceptor.cpp b/ServiceAcceptor.cpp
index 8b550d99..08e2415f 100644
--- a/ServiceAcceptor.cpp
+++ b/ServiceAcceptor.cpp
@@ -48,7 +48,11 @@ CServiceAcceptor::CServiceAcceptor(IService * pService, std::string pName, unsig
 	if(rc == SOCKET_ERROR)	return;
 #endif
 
-	s=socket(AF_INET,SOCK_STREAM,0);
+	int type = SOCK_STREAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+	type |= SOCK_CLOEXEC;
+#endif
+	s=socket(AF_INET,type,0);
 	if(s<1)
 	{
 		Server->Log(name+": Creating SOCKET failed",LL_ERROR);
diff --git a/clientctl/Connector.cpp b/clientctl/Connector.cpp
index 9fac8629..fdc7079c 100644
--- a/clientctl/Connector.cpp
+++ b/clientctl/Connector.cpp
@@ -117,7 +117,11 @@ std::string Connector::getResponse(const std::string &cmd, const std::string &ar
 		pw=trim(getFile(pwfile_change));
 	}
 
-	SOCKET p=socket(AF_INET, SOCK_STREAM, 0);
+	int type = SOCK_STREAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+	type |= SOCK_CLOEXEC;
+#endif
+	SOCKET p=socket(AF_INET, type, 0);
 	sockaddr_in addr;
 	memset(&addr,0,sizeof(sockaddr_in));
 	if(!LookupBlocking(client, &addr.sin_addr))
diff --git a/file_linux.cpp b/file_linux.cpp
index a7610537..d50f719f 100644
--- a/file_linux.cpp
+++ b/file_linux.cpp
@@ -110,6 +110,9 @@ bool File::Open(std::string pfn, int mode)
 			return false;
 	}
 	
+#if defined(O_CLOEXEC)
+	flags |= O_CLOEXEC;
+#endif
 	
 	fd=open64((fn).c_str(), flags|O_LARGEFILE, imode);
 
diff --git a/fileservplugin/CClientThread.cpp b/fileservplugin/CClientThread.cpp
index 18a1f0bf..296865bd 100644
--- a/fileservplugin/CClientThread.cpp
+++ b/fileservplugin/CClientThread.cpp
@@ -815,7 +815,11 @@ bool CClientThread::ProcessPacket(CRData *data)
                     break;
                 }
 
-				hFile=open64(filename.c_str(), O_RDONLY|O_LARGEFILE);
+				int flags = O_RDONLY | O_LARGEFILE;
+#if defined(O_CLOEXEC)
+				flags |= O_CLOEXEC;
+#endif
+				hFile=open64(filename.c_str(), flags);
 				
 				if(hFile == INVALID_HANDLE_VALUE)
 				{
@@ -1601,7 +1605,11 @@ bool CClientThread::GetFileBlockdiff(CRData *data, bool with_metadata)
 		hFile=CreateFileW(Server->ConvertToWchar(filename).c_str(), FILE_READ_DATA, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS|FILE_FLAG_SEQUENTIAL_SCAN, NULL);
 #endif
 #else //_WIN32
-		hFile=open64(filename.c_str(), O_RDONLY|O_LARGEFILE);
+		int flags = O_RDONLY | O_LARGEFILE;
+#if defined(O_CLOEXEC)
+		flags |= O_CLOEXEC;
+#endif
+		hFile=open64(filename.c_str(), flags);
 #endif //_WIN32
 
 		if(hFile == INVALID_HANDLE_VALUE)
@@ -1817,7 +1825,11 @@ bool CClientThread::GetFileHashAndMetadata( CRData* data )
 	hFile=CreateFileW(Server->ConvertToWchar(filename).c_str(), FILE_READ_DATA, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS|FILE_FLAG_SEQUENTIAL_SCAN, NULL);
 #endif
 #else //_WIN32
-	hFile=open64(filename.c_str(), O_RDONLY|O_LARGEFILE);
+	int flags = O_RDONLY | O_LARGEFILE;
+#if defined(O_CLOEXEC)
+	flags |= O_CLOEXEC;
+#endif
+	hFile=open64(filename.c_str(), flags);
 #endif //_WIN32
 
 	if(hFile == INVALID_HANDLE_VALUE)
diff --git a/fileservplugin/CTCPFileServ.cpp b/fileservplugin/CTCPFileServ.cpp
index fa3933f7..6531cfe7 100644
--- a/fileservplugin/CTCPFileServ.cpp
+++ b/fileservplugin/CTCPFileServ.cpp
@@ -113,7 +113,11 @@ bool CTCPFileServ::Start(_u16 tcpport,_u16 udpport, std::string pServername, boo
 
 	if(tcpport!=0)
 	{
-		mSocket=socket(AF_INET,SOCK_STREAM,0);
+		int type = SOCK_STREAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+		type |= SOCK_CLOEXEC;
+#endif
+		mSocket=socket(AF_INET, type, 0);
 		if(mSocket<1) return false;
 
 #ifndef DISABLE_WINDOW_SIZE
diff --git a/fileservplugin/CUDPThread.cpp b/fileservplugin/CUDPThread.cpp
index 972b7be4..f8d01733 100644
--- a/fileservplugin/CUDPThread.cpp
+++ b/fileservplugin/CUDPThread.cpp
@@ -110,7 +110,11 @@ void CUDPThread::init(_u16 udpport,std::string servername, bool use_fqdn)
 	use_fqdn_=use_fqdn;
 
 	{
-		udpsock=socket(AF_INET,SOCK_DGRAM,0);
+		int type = SOCK_DGRAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+		type |= SOCK_CLOEXEC;
+#endif
+		udpsock=socket(AF_INET, type, 0);
 
 		int optval=1;
 		int rc=setsockopt(udpsock, SOL_SOCKET, SO_REUSEADDR, (char*)&optval, sizeof(int));
diff --git a/urbackupclient/client.cpp b/urbackupclient/client.cpp
index 2ac22ff9..467f80ed 100644
--- a/urbackupclient/client.cpp
+++ b/urbackupclient/client.cpp
@@ -2157,7 +2157,7 @@ bool IndexThread::deleteShadowcopy(SCDirs *dir)
 
 	int rc = os_popen("/etc/urbackup/"+scriptname+" "+guidToString(dir->ref->ssetid)+" "+escapeDirParam(dir->ref->volpath)
 		+" "+escapeDirParam(dir->dir)+" "+escapeDirParam(dir->target)+" "+escapeDirParam(dir->orig_target)
-		+ (dir->ref->clientsubname.empty() ? "" : (" " + escapeDirParam(dir->ref->clientsubname))), loglines);
+		+ (dir->ref->clientsubname.empty() ? "" : (" " + escapeDirParam(dir->ref->clientsubname)))+" 2>&1", loglines);
 	if(rc!=0)
 	{
 		VSSLog("Error removing snapshot to "+dir->target, LL_ERROR);
@@ -2645,7 +2645,7 @@ int IndexThread::execute_hook(std::string script_name, bool incr, std::string se
 #endif
 
 	std::string output;
-	int rc = os_popen(quoted_script_name + " " + (incr ? "1" : "0") + " \"" + server_token + "\" " + convert(index_group), output);
+	int rc = os_popen(quoted_script_name + " " + (incr ? "1" : "0") + " \"" + server_token + "\" " + convert(index_group)+" 2>&1", output);
 
 	if (rc != 0 && !output.empty())
 	{
@@ -4449,7 +4449,7 @@ bool IndexThread::start_shadowcopy_lin( SCDirs * dir, std::string &wpath, bool f
 	std::string loglines;
 	int rc = os_popen("/etc/urbackup/"+scriptname+" "+guidToString(ssetid)+" "+escapeDirParam(dir->ref->target)+" "+
 		escapeDirParam(dir->dir)+" "+escapeDirParam(dir->orig_target)
-		+ (index_clientsubname.empty()?"":(" " + escapeDirParam(index_clientsubname))), loglines);
+		+ (index_clientsubname.empty()?"":(" " + escapeDirParam(index_clientsubname)))+" 2>&1", loglines);
 
 	if(rc!=0)
 	{
diff --git a/urbackupclient/client_restore.cpp b/urbackupclient/client_restore.cpp
index 3c8269e8..99b259b5 100644
--- a/urbackupclient/client_restore.cpp
+++ b/urbackupclient/client_restore.cpp
@@ -766,7 +766,11 @@ namespace
 
 	bool ping_server(void)
 	{
-		SOCKET udpsock=socket(AF_INET,SOCK_DGRAM,0);
+		int type = SOCK_DGRAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+		type |= SOCK_CLOEXEC;
+#endif
+		SOCKET udpsock=socket(AF_INET, type,0);
 
 		std::string server=Server->getServerParameter("ping_server");
 
@@ -1143,8 +1147,12 @@ bool has_network_device(void)
 	int           nInterfaces;
 	int           i;
 
+	int type = SOCK_DGRAM;
+#if !defined(_WIN32) && defined(SOCK_CLOEXEC)
+	type |= SOCK_CLOEXEC;
+#endif
 /* Get a socket handle. */
-	sck = socket(AF_INET, SOCK_DGRAM, 0);
+	sck = socket(AF_INET, type, 0);
 	if(sck < 0)
 	{
 		return true;
diff --git a/urbackupcommon/fileclient/FileClient.cpp b/urbackupcommon/fileclient/FileClient.cpp
index aac9e288..85c96a95 100644
--- a/urbackupcommon/fileclient/FileClient.cpp
+++ b/urbackupcommon/fileclient/FileClient.cpp
@@ -156,7 +156,11 @@ void FileClient::bindToNewInterfaces()
 				if(std::find(broadcast_iface_addrs.begin(), broadcast_iface_addrs.end(), source_addr.sin_addr.s_addr)!=broadcast_iface_addrs.end())
 					continue;
 
-				SOCKET udpsock=socket(AF_INET,SOCK_DGRAM,0);
+				int type = SOCK_DGRAM;
+#if defined(SOCK_CLOEXEC)
+				type |= SOCK_CLOEXEC;
+#endif
+				SOCKET udpsock=socket(AF_INET, type,0);
 				if(udpsock==-1)
 				{
 					Server->Log(std::string("Error creating socket for interface ")+std::string(ifap->ifa_name), LL_ERROR);
@@ -210,7 +214,11 @@ void FileClient::bindToNewInterfaces()
 		Server->Log("Getting interface ips failed. errno="+convert(errno)+
 			". Server may not listen properly on all network devices when discovering clients.", LL_ERROR);
 
-		SOCKET udpsock=socket(AF_INET,SOCK_DGRAM,0);
+		int type = SOCK_DGRAM;
+#if defined(SOCK_CLOEXEC)
+		type |= SOCK_CLOEXEC;
+#endif
+		SOCKET udpsock=socket(AF_INET, type,0);
 		if(udpsock==-1)
 		{
 			Server->Log("Error creating socket", LL_ERROR);