ConfigServer Community Forum

Hello, 2 days ago the CXS started to send me more than 9000 messages/day from this user. Almost every minute I got a new message.

cxswatch Scanning /home/deangelispedro/public_html/eventoscris/wp-includes/css/wp-config.php:

'/home/deangelispedro/public_html/eventoscris/wp-includes/css/wp-config.php'
(quarantined to /home/quarantine/cxsuser/deangelispedro/wp-config.php.1591704356_1) Known...

Hi Guys,

Several of my fleet of VPS's has been performing weirdly lately. They're spread geographically and between different providers. All of my issues have gone away and server load has reduced as soon as CXSwatch and CXS were stopped. and they begin again after it is re-enabled.

I'm talking going from average 25% of 8 CPU cores and 8GB of ram to 98% for long periods of time across multiple...

Hi there, Folks

I'm new here so please treat me gently! :D

I have just recently had CXS installed on one of my cPanel servers - the idea being to test it and then if it works well, to purchase it for the other servers in our rack. However, the first problem I have come across is the inability of the transfer tool to work in cPanel. I have tried to copy an account from another of our cPanel...

The cXs Installer does not check for ClamAV before continuing. I think that the installer should check for ClamAV installation first, before continuing and then exit if it is not present with a warning to the user that it can't install until ClamAV has been installed first.

Hi,

I am looking for some added protection to make sure that if someone uploads a PDF it really is a PDF and that it is safe. PDF is one example, it could be one of many common file types. I am thinking that CXS could provide an added layer of protection by scanning a file as soon as it has been uploaded to the server from a form in a web application. It could then quarantine anything...

Hi,

Is it possible to exclude to scan any file extension? For example, my server has tons of pictures .png, .jpg,etc and that takes TBs of space and the things that get hacked are mostly .php and .ico files, can I exclude some extensions so the process take quite less time?

Hi,

I am getting too many of the following alerts:

Nov 14 12:10:08 srvurb01 cxswatch : Modified '/xxx/yyy/wp-content/temp-write-test-5dcd3610705490-77004072'
Nov 14 12:10:08 srvurb01 cxswatch : Deleted: '/xxx/yyy/wp-content/temp-write-test-5dcd3610705490-77004072'

And I can't get cxs.ignore to work them out.

would it be:
pfile:temp-write-test-.*

or others?

Thank you very much,

hi,
how to install ConfigServer exploit scanner on CentOS Web Panel,

Is there a different installation method, I get the following error when doing the installation?

Checking Perl modules...
Can't locate Linux/Inotify2.pm in @INC (@INC contains: /etc/cxs /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 .)...

Hello,

I am a newbie in CXS, and i've just bought CXS several days ago for my web server.
i got this log messages

Feb 9 18:44:08 ovan cxswatch : WARNING: '/home/online/public_html/mobile_version/error_log' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Feb 9 18:44:08 ovan cxswatch : Ignoring file for the next 300 seconds:...

I keep getting this error page when I try to Enable | Start the cxs Watch ...
Software error:

open3: exec of /usr/sbin/service cxswatch start failed: No such file or directory at /etc/cxs/ConfigServer/cxsServices.pm line 351.

For help, please send mail to this site's webmaster, giving this error message and the time and date of the error.

looks like something to do with the perl module...

I am seeing this on one of our installs:

Web upload script path : /home/csf/public_html/wp-content
Web upload script URL :
Remote IP : 111.111.111.111
Deleted : No
Quarantined : Yes

NOTE: does not exist on this server. However, ModSecurity is still triggering cxs to scan the attempted uploading of potentially malicious data

What is causing csf to populate instead of the username of the...

Hello,

When cxs ModSecurity Scanning enabled on a directadmin server which has got openlitespeed with comodo waf, does cxs work?

Anyone knows that are compatible?

Thanks

On our old servers we only every got a daily csx email if there was something to be alerted about. On our new server we get an email everyday even if there are no issues - a blank /empty email with just the command at the top.

----------- SCAN REPORT -----------
TimeStamp: Fri, 26 Jul 2019 00:00:02 -0400
(/usr/sbin/cxs --allusers --nobayes --clamdsock /var/clamd --ctime 25 --dbreport...

I would like to ignore cache files in WordPress. For example:

'/home/username/public_html/wp-content/cache/wp-cache-46468fced3eda21852947cfe41900145.php'
Regular expression match =

I have this in the /etc/cxs/cxs.ignore file and have confirmed that I have --ignore /etc/cxs/cxs.ignore enabled on cxscgi.sh, cxsftp.sh and cxswatch.sh

Is this the right way to do it?...

Hello.
We uploaded several shells for testing in the hosts which, fortunately, was a good result and was sent to us from the server as soon as the file was uploaded.

But there is a problem here when entering the plugins in whm and going to cxs control, the shell quarantine record is not automatically recorded, although the settings are refreshed and adjusted, but you must be sure to bring the...

When CSF runs the following
Subject: Cron /usr/sbin/cxs --report /var/log/cxsreports/scanweekly.log --mail root --smtp --quiet --nosummary --www --virusscan --voptions fmMhexT --all --smtp --mail root --options mMOLfuSGchexdnwZRrD

I get this output by email (hundreds of lines):
Use of uninitialized value in numeric lt (<) at...

Hi there,

I don't want to clog up support too much, so will try here first, hopefully someone can give me some advice and/or confirm whether I'm doing it right.

I've created a cxs.ignore file and started cxs with the --ignore option, so far so good.

Now what I would like to do is ignore some regex matches that are being detected via --options , in particular too many false positives with...

Hi:

I running cxs on debian server with command:

and it throw this error:

Unescaped left brace in regex is deprecated, passed through in regex; marked by <-- HERE in m/��� Unescaped left brace in regex is deprecated, passed through in regex; marked by <-- HERE in m/��� Unescaped...

Hi, just wondering if there was an update applied early this morning on CXS?

Time: Wed Apr 3 03:40:11 2019 -0400

The following list of files have FAILED the md5sum comparison test. This means that the file has been changed in some way. This could be a result of an OS update or application upgrade. If the change is unexpected it should be investigated:

/usr/sbin/cxs: FAILED
/sbin/cxs: FAILED...

Hi,

It's some time that I receive lfd scanner mails with this kind of errors from cxswatch:

Mar 4 01:02:18 srvcp01 cxswatch : Child 1: (Scan Error while processing) '/home/fateitalia/public_html/error_log'

What's the problem there?

Thanks,