ConfigServer Community Forum

I am getting over 800 emails a day about how CXSWATCH is failing to start.

If I stop the service, will the scans I am getting emailed about stop?

And will it make CXS useless?

Thank you.

Hi guys

I'd like to know if I should configure CXS with ClamAV Unofficial Signatures Option if i'm using the following on clamav:

Thoughts?

Aloha,

I recently purchased the ConfigServer cPanel setup package, and have now noted a ClamAV Logwatch error regarding it being outdated.

I've followed the instructions listed within the body of the email, and the update process states the package is not installed.

# yum update clamav
Loaded plugins: fastestmirror, rhnplugin, universal-hooks
This system is receiving updates from CLN....

We're converting some of our older servers using CXS to use the --smtp parameter. CXS is working properly and we can see that http uploads are getting blocked, but we never get the email copy. We can't see the SMTP connection in exim_mainlog and there is nothing in exim_reject or exim_panic logs.

Any thoughts on debugging this?

Thanks in advance.

I started getting this FAILED ⛔: cxswatch email last night and has been sending non stop for the last 5 hours.

I looked into upgrading CXS from cxs: v9.15 to v9.16 but when I try through WHM, I am getting Modification of non-creatable array value attempted, subscript -1 at /usr/sbin/cxs line 233.

Any assistance will be much appreciated. Thanks!

Hi, I have installed the script in my WHM Linux Server.

How do I scan malware and virus inside a specific /home/user using WHM interface? I can´t find it

Thanks,
Francisco

I have a server with lots of Joomla installs on it. Most of those installs have a backup program installed named Akeeba. The scanner returns false positives in the scan log like this one:

'/home/xyz/public_html/senzex/new/administrator/components/com_akeeba/restore.php'
# Regular expression match =

I need to tell cxs to ignore these files regardless of whose account they appear in and in some...

Hello,

50% of all servers in the world work with Linux. The recognized antivirus test organization AV-Test tested in 2015 the existing av solutions for Linux:
A total of eight out of 16 products detected between 99.7 and 99.9% of the 12,000 Windows attackers used in the test: Avast, F-Secure, Bitdefender, ESET, eScan, G Data, Kaspersky Lab (server version) and Sophos. Only the security...

Options prenice and pionice not found.
Using Cloudlinux 7.4 / cPanel v68.0.38 / CXS v9.10
Am I doing something wrong?
I add this options in CXS Wizard and restarted CXS, but the priority not have changed:

# ionice -p 1386490
unknown: prio 0

My cxswatch.conf file:

smtp=1
cutcgimail=0
exploitscan=1
virusscan=1
sversionscan=0
bayes=0
unofficial=0
dbreport=0
ignore=/etc/cxs/cxs.ignore...

Hi, I'm not sure what the CXS_ALL firewall rule (filter) is doing but it appears for blocked IP's in CSF/LFD and when I attempt to unblock, it unblocks the IP in LFD but the CXS_ALL filter remains.

The only way to override the rule is to white-list the IP.

1) What is this filter?
2) Is there any easy way unblock IP's in this list?

Thanks,

Ian

Hello,

I need a weekly scan with notification to my email, but not email notifications for cPanel users. For this I am using this cron and this template:

cat /etc/cron.weekly/cxs_complete_weekly

/usr/sbin/cxs --nosversionscan --bayes --breport high --options -wW \
--Wmaxchild 3 --Wloglevel 0 --Wsleep 3 --filemax 0 --Wrateignore 300 \
-Q /home/quarantine -I /etc/cxs/cxs.ignore --xtra...

Hello,
In the previous versions there is the option to automatically change the permissions 777 to 755, could you put that option back?

hi all
the lasted update CXS installed in cpanel
Anti shller can not identify it either

for expamle

This shell can be easily uploaded to the host with the extension sh
Antishler can not identify it either

Is it possible to run on this cpanel host?
Thanks

I had some scans before
Have the option to make suspicious files Quarantine
But the report after the scan didn't know why it wasn't sent to my mailbox.
Because it is a series of scanning activities
Don't know where to find the previous scan report?

Hello,

In my daily scan I use the following crontab:

/usr/sbin/cxs -mail ###@#####.## --exp --novir -o mMOSGchdnD -Z --sum -T 5 -all --ignore /etc/cxs/cxs.ignore

for some reason in more than a dozen servers I received today about 50-200 hits per server with the following reason:

# Regular expression match = :
'/home/USERNAME/public_html/cp2/libraries/pear/archive_tar/Archive_Tar.php'

I...

just wondering after the corrupt sig issue the other day what the correct way to empty the quarantine of all the files and the database for them so we can start fresh?

Hello,

Each time I disable the Email configuration via your WHM command wizard UI (for watch and daily/weekly cron), the setting is saved but upon returning to the wizard the option is checked again which would result in the option being enabled when reconfiguring the command.

Generated command/config showing email is disabled:

Wizard, after returning to it when previously disabling the email...

Hello,

I wanted to know if there is a way to not send CXS's results via mail. Even when I don't use --mail reports are sent anyways.

I am scanning lots of accounts and I don't need to receive an email for each one of them. I only need those report stored in a file, so I can read it when if I need to.

Thanks.-

As of today I am getting hundreds of Hit emails out of the blue regarding the Wordpress plugin file:

'/wp-content/uploads/sucuri/sucuri-settings.php'

(quarantined to /home/quarantine/cxsuser/ /sucuri-settings.php.1521654621_1) Known exploit =

The quarantined file contains the following file contents:

{ sucuriscan_lastlogin_redirection : enabled , sucuriscan_revproxy : disabled }

Perhaps...

Hi,
I had an issue with the firewall blocking a client who's password was changed and her phone kept trying to login triggering the bad login attempts. Since the firewall on the server changed, it took me a while to figure out that is what was happening.

If I enable IP Reputation, I have 3 concerns/questions.

1) If a client starts getting blocked and the cause is something like the situation...