It would be good to have the option to chmod and chattr a file as an alternative to quarantine. So remove all execution properties and make it uneditable

chmod 0
chattr +i

Just a suggestion :)

Great work by the way!

cxs seems to be missing some basic functionality: some way of telling it to scan more than one specific files in a single run. You can try, there's currently no way of doing it, the support HelpDesk told me so. They also told me to post a feature request for that here, so here it is.

Briefly stated, it's the ability to scan more than one specific resource (file or directory), either by...

Id like to see a module worked up to send the cxs reports into a database table in WHMCS so that clients can login and look at the reports and also to fire off individual account scans without the need for them to login to WHM

We have a lot of managed server clients who we dont give root access to, both on physical and vps servers, and we have also had a number of resellers request this sort...

Hello,

With recently launch of ClamAV 0.99 with support for fanotify , I started some search about it.

The fanotify ( ) is another monitoring filesystem events API like the inotify but with some advantages:

It can recursively monitor the entire mount tree without having to mark each file/directory.
It can make access permission decisions, and the possibility to read or modify files...

is there any way to submit new /undetected scripts etc to configserver from quarantine
I have my server set to use medium bayes that quarantines suspicious files
These files never actually get onto the server so wttw doesn't work ( as far as I know CXS will not scan quarantine)
I get lots of new revslider / WP exploits from having medium bayes set

can we have a submit to configserver button...

At present, we have a certain folder in our ignore file since we don't want the entries quarantined (lots of false positives for said folder).

We'd like to have said folder still be scanned and alert if there is a potential false positive, just not have the matched files quarantined. With the current options, as best we can see, there is no way to ignore a folder for just quarantining.

We'd...

scan report can mail to upload script owner's (victims's) email
so user can take a look into it.

Feature Request:

Provide some mechanism to differentiate between a clean scan and a dirty scan.

Further details below.

I get ~500+ server related emails a day. Most tidily being directed conditionally to proper Info or Problem email boxes. ConfigServer specific examples would be:

System Integrity checking detected
Excessive processes running
FAILED:

I can't think of any...

Could CXS please stop reporting any file named social.png as a Suspected exploit file if the file is just a png image?

Hi,

firstly I Love cxs so much with cpanel. but what about cxs plesk ? is there any plan cxs for plesk ?
You have to do because there isn't any other plugin like cxs . So save us :) )

Thanks.

Hi Jhonathan,
I want to quarantine all the files with extension .PL on my server, what I need to accomplish this in CSX.XTRA file?

I am trying:
file:.pl
that will be enough?

Regards,

Sergio

Hi,

I'd like to make 2 suggestions if i may.

1) To help performance - internal rate limiting for often changed files. Instead of the 'x file scanned x times in last 30 seconds' - CXS could internally keep a record of files already scanned in the last 30 seconds, ignore the 'between changes' and queue a scan for 30 seconds time. This way CXS will always scan the end result of the file...

This is a feature request to be able to include additional configuration files in the cxs.ignore file.

The reason for this is so that we can manage 'cxs.ignore' with Puppet for example, but then include a file such as 'cxs.ignore.custom' for a per server customisable configuration.

You have this feature in CSF for csf.allow which is very useful there, I think it would add value to cxswatch...

Hi there,

There is a similar product out there called LMD ( ) which also provides exploit scanning capabilities and relatively frequent signature updates.

It would be great if cxs could use the signature database associated with LMD, or perhaps invoke LMD as an additional option when scanning to provide an additional layer of protection. From a brief look at the signatures, it seems they...