ConfigServer Community Forum

Got an odd problem on the last server you guys set up.

The cxs daily cron will sometimes just hang and prevent the logrotate process from running. I'll notice it when I receive an email that /var is running out of drive space, due to logs growing in size.

If I kill the cxs cron, then logrotate will run. I've noticed this happening about 3 or 4 different times since last december. Just noticed...

I am using cxs v 4.14. I am editing the cxs Watch configuration via the WHM plug-in, under Configure cxs Watch

In that file, it shows my options as: --options mMOLfSGchednWDZR

After saving, I am clicking Restart cxs Watch .

When I receive a cxs Scan alert email, it shows in the SCAN REPORT my options as: --options mMOLfSGchexdnwZDRu

As you can see, they do not match.

What am I doing wrong?...

Ok I just started a scan on one of my servers and it doesn't look right

See what I mean here

screencast. com/t/KfXeMDUf

(Remove space before com Sorry can't post links yet is just an image from PuTTy)

Is that right? Or there is something I am doing wrong?

Hi Jonathan,
yesterday a hacker managed to ftp to a compromised password on a customer and uploaded a few modified files that he downloaded previously.

All the files are java scripts with the extension .JS, I have checked the code and added the code to the xtra file, using REGALL but CXS is not checking the .js files and the files are not quarantined.

What is the best approach to check .js...

first, cxs is awesome... incredible... like finding REAL NY PIZZA IN GEORGIA USA

--if i could.....

ok, i have a web cam for our studio

we use secure ftp

i have the program uploading a multiple camera single jpg image every 10 seconds

tail:
Jan 5 04:35:45 secure cxswatch : Ignoring file for the next 300 seconds: '/home/user/public_html/directory/thisfile.jpg'
Jan 5 04:42:29 secure cxswatch :...

Hello

I'm new to cxs, and just got this email in a few minutes before. What does it mean?

cxswatch Scanning /home/angelino/public_html/administrator/components/com_rsfirewall:
# Regular expression match = :
'/home/angelino/public_html/administrator/components/com_rsfirewall/models/checkrun.php'
# Regular expression match = :...

I keep getting this error.

WARNING: Quarantine disabled - Directory has incorrect permissions , run cxs --qcreate --quarantine /home/quarantine

I have moved the old quarantine directory elsewhere and ran cxs --qcreate --quarantine /home/quarantine but continue to get the error. I have also just tried chmod 0755 on the quarantine directory to no avail.

Any suggestions?

Thanks,
Eric

Good day,

I have a virus that can be uploaded to web site wthout blocking it while when upload c99.php for instant. it get blocked automatically

how i can apply this situation to be blocked automatically when uploaded

The last few days we notice that email reports from cxs if reporting a virus now say:
WARNING: Quarantine disabled - Directory missing, run cxs --qcreate --quarantine
WARNING: Quarantine disabled - Directory missing, run cxs --qcreate --quarantine
WARNING: Quarantine disabled - Directory [] has incorrect permissions , run cxs --qcreate --quarantine

We have our quarantine directory in...

Hi,

To lower load for a webhost is running the cron job necessary.

Basically I was thinking:

1. Run CXS cronjob once a week
2. Have CXSWatch run all the time.

IS this good enough? Opinions

Hello,

I just done the cxs v4.04 update and it broke the Documentation info.

Other Documents
reference.txt install.txt changelog.txt license.txt
cxs POD
Usage: perldoc PageName|ModuleName|ProgramName Examples: perldoc -f PerlFunc perldoc -q FAQKeywords perldoc -v PerlVar The -h option prints more help. Also try perldoc perldoc to get acquainted with the system.

this is what it shows now.

NOTE: Support for using suhosin is deprecated and will be removed in
the near future - use ModSecurity instead. If you are unable to use
ModSecurity, you will have to rely on either cxs Watch or manual scans

Does this only apply to scanning of PHP Upload scripts?

What I mean is: I use CXS Watch, and I also use Suhosin. Will CXS Watch stop working for PHP if I keep using Suhosin (in the...

New option added: --defapache . This is the default account
under which apache runs. This will be set to apache by default
except on cPanel servers where it is set to nobody by default

I have a cPanel server. So it is set to nobody by default.

Is there a more secure value rather than nobody or is that value required (and secure as-is)?

I don't fully understand what nobody means and any...

This morning in my logs I noticed the following messages being repeated over and over with random usernames. Any idea what causes this and is it something I should be concerned about?

Oct 22 00:03:01 server6 cxswatch : Adding new cPanel user PR7E2ppU...
Oct 22 00:03:01 server6 cxswatch : Failed to add user PR7E2ppU: Invalid Home directory []
Oct 22 00:03:01 server6 cxswatch : ...done
Oct 22...

Hello
how i can add a file to whitelist CXS?
it is possible?

Thanks!

Hello,

I am running CXS on my server and II have setup few WP blog with W3-Total-Cache. I am getting these alerts. Should I be concerned. :confused:
---------------------------------------------------------------------------
# Regular expression match = :
'plugins/w3-total-cache/inc/widget/new_relic.php'
# Regular expression match = :...

s = Old script version installed

I am not using the s and the report is returning to Old Script generating major problems for the analysis of the report. You can check please?

/usr/sbin/cxs --logfile /var/log/cxs.log --options m --user ZZZ --novirusscan --web --www

Report: :confused:
# Script version check

Hello
i see following log /var/log/cxswatch.log
how i can ignor this file for CXS?
becuase CXS check this file, so we not need CXS check this file, correct?

Thanks.

I've removed cxs from my server as I'm going to install it on a new one I'm moving to.

Below seems to state that I have to retire the old server before I change to the new server IP. Is that correct? :)

If you are going to retire the server that you initially had cxs licensed for or you have been required to change the server's IP address, then the licensed IP address can be changed. There is...

Hi,

Just done the update via web-gui and it's broken most of the other addons csf, cmq etc...

No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/csf.cgi): subprocess exited with status 2
No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/cmq.cgi): subprocess exited with status 2
No response from subprocess...