ConfigServer Community Forum

Hello and welcome to the ConfigServer Scripts Community Forum.

These forums are for the discussion of our ConfigServer Scripts . Please remember, that we offer limited support for our free scripts as and when we can. The primary purpose of these forums is for the community that use these scripts to offer support to each other. We will stop by from time to time, but we do not offer a continuous...

From:
Fixed a SECURITY BUG in Quarantine file restore which could result in root privilege escalation. The destination restore file must not now exist before restoring will work. Our thanks to Jeff Petersen for reporting this issue

All cxs users should upgrade to this release immediately

From:
Further SECURITY improvements to Quarantine functionality

All cxs users should upgrade to this...

If you have one particular IP address that is either dropped or accepted through the firewall that you think should not be, then you can use the new WATCH_MODE in csf.

Before enabling this option and using the CLI command to watch an IP address, check whether it is explicitly listed first using:

csf --grep 11.22.33.44

Where 11.22.33.44 is the IP address you're tracking. If that comes back...

To enable file upload scanning for web scripts, ModSecurity needs to have the option SecRequestBodyAccess enabled (as explained in the install document).

This option configures whether request bodies will be buffered and processed by ModSecurity.

You will need to ensure that other any ModSecurity rules that you have have been correctly written to deal with POST_PAYLOADS. If they have not, then...

There are two files that you need to modify to allow blocking:

For FTP: /etc/cxs/cxsftp.sh

For Web Scripts: /etc/cxs/cxscgi.sh

1. If you simply want to delete suspicious uploads, add the --delete switch to cxsftp.sh and/or cxscgi.sh

2. If you want to quarantine files, then you need to pre-create the quarantine directory, e.g.:

mkdir /home/quarantine
chmod 1777 /home/quarantine

Then you...

When you run cxs you will invariably encounter false-positives that trigger one or more of the scanning options.

We do not recommend that you simply stop using the option that triggers, rather it would be better to simply ignore the false-positive files using an ignore file as per the documentation.

The best way to generate the ignore file is to create it first, e.g.:
touch...

So long as you use the default configuration and only change the TESTING parameter in csf.conf then csf should work.

If it doesn't, it suggests a problem with the server environment (kernel, iptables or in the case of a VPS, the host node configuration of the VPS).

If the issue appears to be broken iptables connection tracking in the kernel (e.g. blocking allowed ports such as port 80 for...

1. If you're seeing legitimate spamd processes on cPanel being reported and want to ignore them, the following can be added to /etc/csf/csf.pignore:

cmd:spamd child

Then restart lfd.

2. If you're seeing legitimate awstats processes on cPanel being reported and want to ignore them, the following can be added to /etc/csf/csf.pignore:

pcmd:/usr/local/cpanel/3rdparty/bin/awstats\.pl.*...

Welcome to the ConfigServer MailScanner Front-End Forum. Please note that this thread is for general questions about the MailScanner Front-End script. If you need urgent assistance and have had us perform the MailScanner service on your server in the past, you should log a support ticket on our helpdesk at .

Welcome to the ConfigServer MailScanner Forum. Please note that this thread is for general questions about MailScanner, SpamAssassin, and ClamAV. If you need urgent assistance and have had us perform the MailScanner service on your server in the past, you should log a support ticket on our helpdesk at .