ConfigServer Community Forum

hi
i installed cxs on centos 5.9 box .but when i want start cxswatch in ssh . i see this error
Starting cxswatch daemon:getrlimit: use RLIMIT_..., not RLIMIT_... at /usr/sbin/cxs line 232

more details about my centos :
cxs version : v4.19
php version : 5.2.17
perl version : v5.8.8
Apache version : 2.2.23

how can i solve the problem ?

I could not find in FAQ if CXS works without cPanel.

If yes, what would be the disadvantage, or what functions may not work?

I understand that this is a cmd line utility. So it should work, theoretically. I prefer to ask before making a wrong purchase.

Hello,

I have CXS installed on my server as well as CSF.

Recently i created a website with Wordrpess and Magictoolbox Zoom Plus Plugin.

Everything on the front is working fine. Though a strange behavior occurs when someone uses the zoom function of the plugin.

I get an email from CXS like the one below, and this comes in large numbers all the time.

----------- SCAN REPORT -----------...

Hi,

I got two questions:

Questions #1
I get this error when restarting the Watch Dameon:
/etc/init.d/cxswatch restart
Stopping cxswatch daemon:
Starting cxswatch daemon:/etc/init.d/cxswatch: line 44: /etc/cxs/cxswatch sh: Permission denied

So how do I fix this?

Questions #2

I installed ClamAv thru Cpanel or should I uninstall and install it manually. So how or what do I do for Part 6 of the...

I just installed CXS on my server and enabled CXSWatch Daemon to scan uploaded files.
It's working fine for most of exploit uploads but the only problem is that it doesn't quarantine symlink scripts.
I read all documentiations but didn't find anything for this.

Any idea?

Hi Everyone,
Where are scan logs stored on the server please?

Thanks

Rockyuk

Hi Everyone,
I am new to this type of script/software and had a few questions, when installed out of the box and when the cxs Watch Daemon - cxs Watch is running does this automatically scan all files?

If not, how do I set that and what is the command pleasing?

Also, if anyone could post commands for other functions like setting up Cron jobs, etc. would be really helpful.

Thanks

Rockyuk

Why not moved virus file on quarantine folder?

Mar 15 02:35:05 sr41 cxswatch : Child 3: Regular expression match = '/home/s4hostin/public_html/shell/1/pas.php'
Mar 15 02:35:05 sr41 cxswatch : Child 3: (Hits:1) (Viruses:0) (Fingerprints:0) '/home/s4hostin/public_html/shell/1/pas.php'
Mar 15 02:44:20 sr41 cxswatch : Child 3: Regular expression match = '/home/s4hostin/public_html/shell/1/pas.php'...

Hello!
I found spam scripts, this uploud from Shell c99, and have chmod 755.
How disable set chmod 755 on files?

Hello,

Before week, i installed new server and cxs program.
Now if i upload c99 file we can look ftp.
first week if i upload c99 file the system automatic delete.

could you give command i should want automatic delete.

please give information

thanks

Hello,

I have a Cpanel Service + Mail Scanner installed on my server that includes CMQ, CMC, CMM, CE, CXS ,...
I'm moving to a new server with different IP and need to update my Cpanel Service license with the new server IP.
I found the following pages for CXS and MSFE but there is no modify page for updating whole Cpanel Service features.

Anybody knows how could I update my Cpanel Service...

Hello,
I was installed CXS on cPanel server.
CXS Deleted all files is encoded php.
All files will delete what is harmful and what is not malicious.
example : configuration.php whmcs encoded by phpencode org.
or ...

What do i do?
Thanks

Hi, I have a Hybrid Server with WHM/Cpanel. I use CSF currently. I want to buy/install CXS, but I do not have mod security installed. What is the best way to install mod security and if I do install it, will it cause any issues with PHP / vbulletin, etc that is installed already?

Thank you

I have a customer with a 6GB cpanel account that I have had to restore a few times recently. Both times, the server nearly crashed, as the load approached 120! On the 3rd restore, I finally figured out what the problem... it was cxs scanning all the files being restored!

To solve the problem I did the following:

Went to Service Monitor in WHM and temporarily disabled monitoring of cxswatch....

I just need to put some files in the cxs.ignore file but I'm a noob at regexp so please, help me build the specific regexp for the following:

a. Needed pfile: regexp#1: (specific filename WITH specific extension, REGARDLESS of path)
/untgz.php

b. Needed pfile: regexp#2: (specific filename, REGARDLESS of extension, REGARDLESS of path)
/thisismyfile.*​

For the past hour I have been flooded with tens of such emails from cxs. In the email it refers to a non existing file on the server,(I believe a bot is searching for exploitable scripts on the domain.) as the upload path ( each different path on each email) and the file does not exist. however cxs states that the file has been quarantined. How is this possible if the hacker cannot upload any...

Is it possible not to receive the cxs world writable emails? This is really getting out of hands with 10+ servers using cxs.

Thank you.

Hi,

We've been running into this issue for at least the last year now, and it appears the old post regarding this issue has disappeared, so I figured we would bring it back to your attention.

We run cPanel on all of our servers, we have CXS on about 10-15 of them. Sometimes pure-ftpd will randomly stop functioning for no apparent reason. The process will be running, but trying to connect will...

Hello,

How can cxs quarantine a directory with cxs.extra?
This line dont work:

regall:quarantine:directoryname

Thank you

For some reason I'm constantly getting hit hard from obsmtp dot com which is a Google IP address. One of the matching IP addresses is 68.18.3.39. I want to completely block anything from 64.18.0.0 and on. Would the correct way to input that into my deny config file be like this?

68.18.0.0/32

Update:
I think I was able to get it.
68.18.0.0/16 I believe blocks all from 68.18.*.*