ConfigServer Community Forum

how about cluster feature?

All my server using cxs.. it painful to configure it.

I would really like to see this available on directadmin also, whats the possibility? Only thing i've found similar is one called upload guardian and it doesnt do a good enough job and not up to date like cxs is, and is way too expensive. What will it take for a DA version? I think it would be popular..

Hi,

Can you please add hidden iframes on Regular expression match ?

I found this:

and was not detected in any way by cxs.

Thank you.

Hello,

I have situation where I need quarantine several Regular expression match files, but if I enable (m) regex pattern match , cxs will quarantine all Regular expression match files, and that is not acceptable option because there are over few thousand false-positive detections.

I can add md5sum to the cxs.xtra, but hacker can easily change (and that's happening very often) one or few...

The CXS report emails do put the time and date but left off the GMT offset or the TZ of the report. I'm asking this to be added.

Hello,

I would like to have option to include variety of information from request headers, such as user browser agent, cookies if present etc etc.. most of our users connect from proxies so it will be hopeful if we can get this information as well. i don't see any harm if you can include it as optional future.

Thank you.

Hello,

I think that great option would also be to live scan/watch just particular user/users. Our servers are high load servers and during the working hours it is difficult or impossible to do a live scan. Usually after cxs scan does its job you know which accounts are risk hazard. By my experience on one server there are usually just few accounts that are risk hazard till they are updated or...

Hello,

A nice feature would be to block the IP that uploaded the malicious file, like pure-uploadscript or mod_security rules. This might be done with a similar logic to this (I think):

1) cxswatch sees a virus or fingerprint
2) Check /var/log/messages (last X lines) to see if the same filename was uploaded via FTP
3) Check /usr/local/apache/domlogs/username/* (last X lines) to see which IP...

I use the contents of the email report from upload scripts to file abuse reports. It currently does not report the destination IP or the time the violation occurred. This information is useful in abuse reports.

Scanning web upload script file...
Web upload script user: nobody (99)
Web upload script owner: ()
Web upload script: /home/xxxxxx/public_html/catalog/admin/banner_manager.php
Remote...

Hello

I would like to be able to pipe cxs scan results to a script, so that we can link it to the rest of our system is there a way to do that for example

/etc/cxs/cxs --reportinfacted --pipe /home/reporter.php

it will report if there is a match found, so we can take more steps

Hi,

Can you tell me if cxs will be available for webmin too? Like csf?

If yes, when?

Thank you!

Hi, this may be my first post on this forum so a quick hello will do!

Anyway, I think this could be an important feature of CXS. So, I use CXS Watch which is great, however, if someone uploads a file called example.php and it turns out the file has no malicious intent, to restore it I have to add it to the CXS.ignore file, which is all fine. I add the entry example.php and I know that this file...

Hi folks,
I've just started observing a relatively new format for the gzinflate/base64 hacks, now starting with:

Here is a picture snippet of a hack I observed this past week, which CXS does not pick up as a hack (when it should have).
It's a pretty egregious web orb / filesman type hack which CXS should have caught:

You folks need anything...

I bought cxs because I was so impressed with csf

While cxs does a lot behind the scenes, the UI is inferior to csf

Why not try to detect if the cxs Watch daemon is running and alert that everything is okay (or not) - similar to what csf does?

Why not do a one-click activation to install the cxs Watch daemon for startup?

Please make cxs have a checklist like csf has to indicate what should be...

Hi Jonathan,
I was setting my CXS crons to check an amount of users every day as having them all is to much.

So, I configured the crons like this:

(/usr/sbin/cxs --www --options mMOLfSGcChexdnwWZDR --jumpfrom mistery1 --jumpto r+ --filemax 10000 --ignore /etc/cxs/cxs.ignore --sizemax 400000 --xtra /etc/cxs/cxs.xtra --summary --quarantine /backup/quarantine --mail root --MD5 --quiet --qoptions...

Hello, when cxs detects files uploaded via web scripts and emails an alert it sends as user 'nobody'. Is there any way to have it send as root, or maybe configured smtp credentials so that I can dis-allow server wide, sending email as 'nobody'?

Thanks
Leighton

Please add this feature:
CHMOD public_html from 755 to 711

if sellect (T) script file from whm interface it will delete all scripts example php, Future cxs develop if seperate script type will be good for us ,

i dont want to upload any of users .pl .cgi or pyton or any of scripting languages without php because others control of uploads not supporting cxs now, may be they upload any of virus or suspicious files without scan

www.turkiyespot.com
Best...

Hi Jonathan,
If you don't mind, I will like to ask for a new suggestion on CXS, there is a button that says QUARANTINE that when is clicked it brings you to another page that shows another link to VIEW QUARANTINE, I think is better to only have one button, so, why not change the QUARANTINE button at the top of the UI to go straight to VIEW QUARANTINE?

This will save us one step to see the...

Hi Chirpy,
thank you for the new Quarantine option on the UI, it helps a lot to clean accounts that have been compromised. It is really useful to use this new option on one account basis as using it on a cron check could give a lot of false positives.

But on the other hand, it will be great to have another option to automatically quarantine files reported containing a virus on an automatic cron...