Hello,

We use CloudLinux. In the daily scan e-mail I receive this output in most of the users:

(174) USERNAME, Scanning /home/alespa:
# Socket:
'/home/USERNAME/.cagefs/tmp/mysql.sock'

The files are symlink to mysql.sock:

root@HOST # ls -la '/home/USERNAME/.cagefs/tmp/mysql.sock'
lrwxrwxrwx 1 root nobody 25 Mar 5 19:33 /home/USERNAME/.cagefs/tmp/mysql.sock -> /var/lib/mysql/mysql.sock...

Hi,

How do i add some custom rule?

I found out some file with name dvmessages.php causing ddos on joomla site and i want cxs clean it every cron is running. Any idea how to do it?

dvmessages.php file contains:

defined( '_JEXEC' ) or die(@eval(base64_decode($_REQUEST )));
jimport( 'joomla.plugin.plugin' );

The CXS watch process is causing heavy load on the server.
A reboot is required to recover the server

Even running the process with a nice value and setting --Wsleep and --throttle doesnt improve the situation

nice -n 19 /usr/sbin/cxs --Wstart --allusers --www --smtp -Q /home/quarantine --qoptions Mv --mail root --Wmaxchild 3 --Wloglevel 0 --Wsleep 6 --filemax 0 --Wrateignore 300 --throttle 2...

Hello,

Im trying to set cxs to quarantine all files or folders named root or sym but it does not work. Mybe Im not using it correctly, Im placing roules in cxs.extra like this:
file:root
file:sym
regfile:root
regfile:sym

In this case I have set 4 type but eaven if I use only one type like file:sym and if I place folder named sym in some users account the cxs will not quarantine it. Could you...

We already installed CXS on our servers but we are still getting phishing complaints. Most of the complaints are subdomains being created by someone else.

Any suggestion or help?

Updating to cPanel 11.36 I see in every module
(cxs / modsec / csf) this error:

Can't use string ( _defheader.tmpl ) as a HASH ref while strict refs in use at /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Template/Context.pm line 809.

Hello,

CXS 'seems' to have identified this, but for some reason it's not getting quarantined. We've looked over the settings and we must just be missing it. Why isn't this getting quarantined?

Scanning FTP file...
Time : Tue Jan 15 07:07:35 2013 -0600
FTP user : #####
FTP file : /home/#####/public_html/cgi-bin/dm/dm.cgi
FTP owner : ##### (931)
Remote IP : ##.##.##.## (##.##.##.##)
Blocked : No...

Good morning,

This file has been flagged repeatedly but it appears that it may be legit. Can someone confirm?

cxswatch Scanning /home/terrysco/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap:
# (compressed file: plupload.silverlight.dll) MS Windows Binary/Executable :
'/home/homedir/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap'

thanks,
dean

What cron is cxs supposed to be going to when I use the submit cron feature from the WHM interface? I don't see it in root cron. I also noticed that cxs did not run automatically after setting it up. Obviously I can manually place the cron job in root cron, I just wanted to make sure. Thanks.

15226 root 18 0 40652 34m 1412 D 14.4 0.6 0:13.98 cxswatch starting...

I see the cxswatch starting... process continuously running on a few of our servers. On one inparticular it seems to produce a significant load:

We do need this daemon to run.

Here are the results of:

ps -ef | grep cxs

root 15226 1 6 04:22 ? 00:00:26 cxswatch starting...
root 15228 15226 0 04:22 ? 00:00:00 cxswatch -...

hi
Once installed cxs
in whm >>>>cxs plugin
ConfigServer eXploit Scanner - cxs version failed at /usr/local/cpanel/whostmgr/docroot/cgi/addon_cxs.cgi line 19.
and not start cxs watch

Help please

the CXS investigated and put some files in quarantine, and these files were not normal and restore the files when they return blank in the user account, anyone there to help me know how much work it, now a thank you

Hi

We have a problem with a typo3 installation and cxs / modsec.
When saving a page in typo3 backend the following error messages appear:

Error in init.php: Path to TYPO3 main dir could not be resolved correctly.

This happens if the last 6 characters of this path, ..../etc/cxs/ (end of $temp_path), is NOT typo3/ for some reason.
You may have a strange server configuration. Or maybe you...

Some sites with Wordpress and the plugin Better WP Security result in :
Known exploit = [Exploited .htaccess ]:

¿Is an exploit or a false positive?

.htacces contet:

# BEGIN Better WP Security
Options -Indexes

Order allow,deny
Allow from all
Deny from 81.114.75.174

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny...

Hi,

tonight several sites was hacked, one on my server... cxs has scan that user

cxswatch Scanning /home/user/public_html/templates/atomic/error.php:
# (quarantined to /home/quarantine/scan/user/error.php.1355351045_1) ClamAV detected virus = :
'/home/user/public_html/templates/atomic/error.php'

----------- SCAN SUMMARY -----------
Scanned directories: 0
Scanned files: 1
Ignored items: 0...