ConfigServer Community Forum

I noticed today on the top of my CXS it now says the following.

Running in Restricted Mode - remove /etc/cxs/cxs.restricted to enable full access to this User Interface
The nature of this User Interface allows direct and indirect access to the root shell on the server, therefore any user access to this interface could allow abritrary commands to be run as root and system files to be overwritten....

This may be a bug...

Noticed over the past week that several viruses that are detected by ClamAV as being
PHP Shell Exploits are NOT getting quarantined...

Here is my default cxs config.

/usr/sbin/cxs --allusers --clamdsock /var/clamd --doptions Mv --exploitscan --filemax 10000 --ignore /etc/cxs/cxs.ignore --logfile /var/log/cxs.log --mail root@server.tld --MD5 --options mMOLfSGchexdnwZDR...

Howdy,

I am Zaphod from SpambotSecurity . com (broken to avoid linking by zaphod). I have been distributing a GNU/GPL V2 security suite for PHP websites since 2008 named ZB Block.

As of June 1st, you had an update to either this script, or another, which began misidentifying the signatures.inc file of my script, as a known exploit. Since my script, and this file especially only works off...

hello,

how i make restore all files and of the all account users in one time?

thanks

Can you tell me how to automatically quarantine these types of files

----------- SCAN REPORT -----------
(/usr/sbin/cxs --allusers --clamdsock /tmp/clamd --deep --doptions Mv --exploitscan --filemax 0 --ignore /etc/cxs/cxs.ignore --logfile /var/log/cxs.log --mail --options mMOLfSGchexdnwZDRu --qoptions Mv --quarantine /home/quarantine --quiet --report /var/log/cxs.scan --sizemax 500000 --smtp...

hello,

i just installed cxs and scan my server

after i did this, i received several emails like this

cxswatch failed @ Fri Mar 8 19:43:15 2013. A restart was attempted automagically.
Service Check Method:
Number of Restart Attempts: 4

i rebooted my server and i still receive this

any ideas ?

Hi,

My iteration of CXS used to work, and all of a sudden ceased working. I am getting this error when attempting to launch it.

ConfigServer eXploit Scanner - cxs version failed at /usr/local/cpanel/whostmgr/docroot/cgi/addon_cxs.cgi line 19.

I searched the error and didn't find anything useful. Is this a known issue? Is there an easy solution?

thanks
dan

In each log scanner report I receive each hour there are references to

/var/log/cxswatch.log: (example follows)

Apr 4 15:34:07 buxton cxswatch : WARNING: '/home/waimeanu/public_html/silverstripe-cache/cache/zend_cache---internal-metadatas---i18nZend_Translate_RailsYaml_Options' scanned 6 times in the last 30 seconds, you might want to ignore this resource
Apr 4 15:34:07 buxton cxswatch :...

Hi,

i receive a report(Email) form CXS when someone upload php-shell script.
i want to get upload-er IP in report.

First I contact cPanel support, investigating it they found that the
CallUploadScript yes causing the problem.

All that immediately after today's update.

Is there a fix / walkthrough,? it's a bug ? I should remove from all server the
CallUploadScript parameter at least temporary ?

Hi,

How do i add some custom rule?

I found out some file with name dvmessages.php causing ddos on joomla site and i want cxs clean it every cron is running. Any idea how to do it?

dvmessages.php file contains:

defined( '_JEXEC' ) or die(@eval(base64_decode($_REQUEST )));
jimport( 'joomla.plugin.plugin' );

Updating to cPanel 11.36 I see in every module
(cxs / modsec / csf) this error:

Can't use string ( _defheader.tmpl ) as a HASH ref while strict refs in use at /usr/lib64/perl5/site_perl/5.8.8/x86_64-linux-thread-multi/Template/Context.pm line 809.

Hello,

CXS 'seems' to have identified this, but for some reason it's not getting quarantined. We've looked over the settings and we must just be missing it. Why isn't this getting quarantined?

Scanning FTP file...
Time : Tue Jan 15 07:07:35 2013 -0600
FTP user : #####
FTP file : /home/#####/public_html/cgi-bin/dm/dm.cgi
FTP owner : ##### (931)
Remote IP : ##.##.##.## (##.##.##.##)
Blocked : No...

Good morning,

This file has been flagged repeatedly but it appears that it may be legit. Can someone confirm?

cxswatch Scanning /home/terrysco/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap:
# (compressed file: plupload.silverlight.dll) MS Windows Binary/Executable :
'/home/homedir/public_html/wordpress/wp-includes/js/plupload/plupload.silverlight.xap'

thanks,
dean

What cron is cxs supposed to be going to when I use the submit cron feature from the WHM interface? I don't see it in root cron. I also noticed that cxs did not run automatically after setting it up. Obviously I can manually place the cron job in root cron, I just wanted to make sure. Thanks.

15226 root 18 0 40652 34m 1412 D 14.4 0.6 0:13.98 cxswatch starting...

I see the cxswatch starting... process continuously running on a few of our servers. On one inparticular it seems to produce a significant load:

We do need this daemon to run.

Here are the results of:

ps -ef | grep cxs

root 15226 1 6 04:22 ? 00:00:26 cxswatch starting...
root 15228 15226 0 04:22 ? 00:00:00 cxswatch -...

hi
Once installed cxs
in whm >>>>cxs plugin
ConfigServer eXploit Scanner - cxs version failed at /usr/local/cpanel/whostmgr/docroot/cgi/addon_cxs.cgi line 19.
and not start cxs watch

Some sites with Wordpress and the plugin Better WP Security result in :
Known exploit = [Exploited .htaccess ]:

¿Is an exploit or a false positive?

.htacces contet:

# BEGIN Better WP Security
Options -Indexes

Order allow,deny
Allow from all
Deny from 81.114.75.174

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny
Deny from all

Order allow,deny...