I need a weekly scan with notification to my email, but not email notifications for cPanel users. For this I am using this cron and this template:

cat /etc/cron.weekly/cxs_complete_weekly

/usr/sbin/cxs --nosversionscan --bayes --breport high --options -wW \
--Wmaxchild 3 --Wloglevel 0 --Wsleep 3 --filemax 0 --Wrateignore 300 \
-Q /home/quarantine -I /etc/cxs/cxs.ignore --xtra...

for next CXS UI Revision we would like to critize the layout and efficiency needed when looking up in the CXS Control since CXS have very limited multi-tab detection without restarting from beginning.

In the CXS Control quarantined list, there is an icon like medical car beside the number list, we wanted that changed like old days to a + sign so that when it's clicked, it would show dropdown...

Hi there,

Rather than using inotify watchers (which are expensive to setup) , if cxswatch is installed on cloudlinux version 7 then use their fchange kernel method

this will reduce server load setting up watchers, and enable cxswatch to start immediately without any of the 'hackery' that currently exists.

I think it would also be valuable if it were possible to delete instead of quarantine for upload attempts to URL'S that don't exist, but quarantine CXS hits for upload attempts to URL'S that do exist.

I would like to see an intermediate option between receiving all ModSecurity alerts for upload attempts to URL'S that don't exist (Recommended by CXS), and no alerts for those events under the reduced email option. CXS recommends receiving all emails because if emails are reduced a direct attack on the server may not send any alert. Since the URL doesn't exist, the kind of attack being referenced...

So I have CXS installed on a VPS. I tested using the IP Reputation feature on select lists. It caused the firewall to have problems, so I disabled IP Reputation. Disabling it does not remove the rules that it added to the IP tables, so I still have memory allocation problems. I'll get it resolved but it seems the GUI disable button should remove the rules added.

This should have been in the CSF suggestion forum.

Hi Jonathan,
as always thanks for this great script that seems to be like the wine on time, every time is getting better, :D

Jonathan, could it be possible to have a CLEAN button that could repair a hacked file?

The CLEAN button could be associated with a file called CXS.CLEAN or with a form box where we could write the exact match of a particular code that we want to clean on one or more...

Currently you can ignore a directory/file which means CXS wont react to said directory/file. I want to be able to have the same functionality for notifications of CXS.
That is to say, I want CXS to scan and clean /tmp/ but I dont want to receive notifications for it.

This I can imagine is a very common issue for providers as /tmp/ is the default upload directory so tons of...

It would be good to have the option to chmod and chattr a file as an alternative to quarantine. So remove all execution properties and make it uneditable

chmod 0
chattr +i

Just a suggestion :)

Great work by the way!

cxs seems to be missing some basic functionality: some way of telling it to scan more than one specific files in a single run. You can try, there's currently no way of doing it, the support HelpDesk told me so. They also told me to post a feature request for that here, so here it is.

Briefly stated, it's the ability to scan more than one specific resource (file or directory), either by...

Id like to see a module worked up to send the cxs reports into a database table in WHMCS so that clients can login and look at the reports and also to fire off individual account scans without the need for them to login to WHM

We have a lot of managed server clients who we dont give root access to, both on physical and vps servers, and we have also had a number of resellers request this sort...

Hello,

With recently launch of ClamAV 0.99 with support for fanotify , I started some search about it.

The fanotify ( ) is another monitoring filesystem events API like the inotify but with some advantages:

It can recursively monitor the entire mount tree without having to mark each file/directory.
It can make access permission decisions, and the possibility to read or modify files...

is there any way to submit new /undetected scripts etc to configserver from quarantine
I have my server set to use medium bayes that quarantines suspicious files
These files never actually get onto the server so wttw doesn't work ( as far as I know CXS will not scan quarantine)
I get lots of new revslider / WP exploits from having medium bayes set

can we have a submit to configserver button...

At present, we have a certain folder in our ignore file since we don't want the entries quarantined (lots of false positives for said folder).

We'd like to have said folder still be scanned and alert if there is a potential false positive, just not have the matched files quarantined. With the current options, as best we can see, there is no way to ignore a folder for just quarantining.

We'd...

scan report can mail to upload script owner's (victims's) email
so user can take a look into it.

Feature Request:

Provide some mechanism to differentiate between a clean scan and a dirty scan.

Further details below.

I get ~500+ server related emails a day. Most tidily being directed conditionally to proper Info or Problem email boxes. ConfigServer specific examples would be:

System Integrity checking detected
Excessive processes running
FAILED:

I can't think of any...

Could CXS please stop reporting any file named social.png as a Suspected exploit file if the file is just a png image?

Hi,

firstly I Love cxs so much with cpanel. but what about cxs plesk ? is there any plan cxs for plesk ?
You have to do because there isn't any other plugin like cxs . So save us :) )

Thanks.

Hi Jhonathan,
I want to quarantine all the files with extension .PL on my server, what I need to accomplish this in CSX.XTRA file?

I am trying:
file:.pl
that will be enough?

Regards,

Sergio