ConfigServer Community Forum

Hi there,

I don't want to clog up support too much, so will try here first, hopefully someone can give me some advice and/or confirm whether I'm doing it right.

I've created a cxs.ignore file and started cxs with the --ignore option, so far so good.

Now what I would like to do is ignore some regex matches that are being detected via --options , in particular too many false positives with...

Hi:

I running cxs on debian server with command:

and it throw this error:

Unescaped left brace in regex is deprecated, passed through in regex; marked by <-- HERE in m/��� Unescaped left brace in regex is deprecated, passed through in regex; marked by <-- HERE in m/��� Unescaped...

Hi, just wondering if there was an update applied early this morning on CXS?

Time: Wed Apr 3 03:40:11 2019 -0400

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/cxs: FAILED
/sbin/cxs: FAILED...

Hi,

It's some time that I receive lfd scanner mails with this kind of errors from cxswatch:

Mar 4 01:02:18 srvcp01 cxswatch : Child 1: (Scan Error while processing) '/home/fateitalia/public_html/error_log'

What's the problem there?

Thanks,

when I click on the link on WHM-->Plugins--->ConfigServer eXploit Scanner
I get a Internal Server Error 500 Page:

No response from subprocess (/usr/local/cpanel/whostmgr/docroot/cgi/configserver/cxs.cgi):

how to fix this?

How do I change the email address attached to my CXS license ?​

got a bayes medium detection today that is definitely an exploit but cannot submit via the CXS interface because it is in a zip
compressed file: revslider/V5rev.php ) Bayes exploit probability score
Original File md5sum d6365dfd71f0d2704f76330ab3b84765

Extracted PHP
MD5 827622aa39b891cb8d9c43f090efceae
SHA-1 91357d31683ce4c9a04ad86c8611cdbe0c6fd0b2

Error: File is not a script.You can only...

Hello, for the past weeks my server loads have been high and my datacenter tells me clamav is very active and it's called by cxs .

I have CLOUDLINUX 6.9 x86_64 standard, WHM 62.0 (build 21), CXS v6.35, and my loads are 4.99 5.93 5.45 for example.

I don't know what happened but clamav process is consuming very very cpu and memory.

Pid 492707
Owner root
Priority 0
CPU % 122.92
Memory % 1.76...

I am getting over 800 emails a day about how CXSWATCH is failing to start.

If I stop the service, will the scans I am getting emailed about stop?

And will it make CXS useless?

Thank you.

Aloha,

I recently purchased the ConfigServer cPanel setup package, and have now noted a ClamAV Logwatch error regarding it being outdated.

I've followed the instructions listed within the body of the email, and the update process states the package is not installed.

# yum update clamav
Loaded plugins: fastestmirror, rhnplugin, universal-hooks
This system is receiving updates from CLN....

I started getting this FAILED ⛔: cxswatch email last night and has been sending non stop for the last 5 hours.

I looked into upgrading CXS from cxs: v9.15 to v9.16 but when I try through WHM, I am getting Modification of non-creatable array value attempted, subscript -1 at /usr/sbin/cxs line 233.

Any assistance will be much appreciated. Thanks!

Hi, I have installed the script in my WHM Linux Server.

How do I scan malware and virus inside a specific /home/user using WHM interface? I can´t find it

Thanks,
Francisco

Hi, I'm not sure what the CXS_ALL firewall rule (filter) is doing but it appears for blocked IP's in CSF/LFD and when I attempt to unblock, it unblocks the IP in LFD but the CXS_ALL filter remains.

The only way to override the rule is to white-list the IP.

1) What is this filter?
2) Is there any easy way unblock IP's in this list?

Thanks,

Ian

Hello,

I need a weekly scan with notification to my email, but not email notifications for cPanel users. For this I am using this cron and this template:

cat /etc/cron.weekly/cxs_complete_weekly

/usr/sbin/cxs --nosversionscan --bayes --breport high --options -wW \
--Wmaxchild 3 --Wloglevel 0 --Wsleep 3 --filemax 0 --Wrateignore 300 \
-Q /home/quarantine -I /etc/cxs/cxs.ignore --xtra...

Hello,
In the previous versions there is the option to automatically change the permissions 777 to 755, could you put that option back?

Hello,

In my daily scan I use the following crontab:

/usr/sbin/cxs -mail ###@#####.## --exp --novir -o mMOSGchdnD -Z --sum -T 5 -all --ignore /etc/cxs/cxs.ignore

for some reason in more than a dozen servers I received today about 50-200 hits per server with the following reason:

# Regular expression match = :
'/home/USERNAME/public_html/cp2/libraries/pear/archive_tar/Archive_Tar.php'

I...

Hello,

Each time I disable the Email configuration via your WHM command wizard UI (for watch and daily/weekly cron), the setting is saved but upon returning to the wizard the option is checked again which would result in the option being enabled when reconfiguring the command.

Generated command/config showing email is disabled:

Wizard, after returning to it when previously disabling the email...

Hello,

I wanted to know if there is a way to not send CXS's results via mail. Even when I don't use --mail reports are sent anyways.

I am scanning lots of accounts and I don't need to receive an email for each one of them. I only need those report stored in a file, so I can read it when if I need to.

Thanks.-

As of today I am getting hundreds of Hit emails out of the blue regarding the Wordpress plugin file:

'/wp-content/uploads/sucuri/sucuri-settings.php'

(quarantined to /home/quarantine/cxsuser/ /sucuri-settings.php.1521654621_1) Known exploit =

The quarantined file contains the following file contents:

{ sucuriscan_lastlogin_redirection : enabled , sucuriscan_revproxy : disabled }

Perhaps...

So my issue is the following:

In CXS 8 the very first option is:

What to scan:
If scanning a user, only scan within in the web root (e.g. ~user/public_html/)

Now, WHM Teak Settings has:

Restrict document roots to public_html which we have set to Disabled on all 25 production servers.

Which means that Addon Domains are created in /home/user/wordpress2 instead of...