Installation
\n============<\/p>\n
1. Product installation:<\/p>\n
wget http:\/\/download.configserver.com\/cxsinstaller.tgz
\ntar -xzf cxsinstaller.tgz
\nperl cxsinstaller.pl
\nrm -fv cxsinstaller.*<\/p>\n
2. You should now read the cxs documentation either through:<\/p>\n
1. The UI
\n2. # perldoc cxs
\n3. # cxs –help<\/p>\n
If you decide to use the cxs Watch daemon you can skip items 3 to 5. Instead,
\nread the documentation under the cxs Watch Daemon section on using this method.
\nTo install the required perl module for the cxs Watch daemon on a cPanel server
\nyou can use:<\/p>\n
\/scripts\/perlinstaller Linux::Inotify2<\/p>\n
3. You will want to modify the following files to suit your requirements after
\nyou have read the cxs documentation and studied the CLI option. These files
\ncan be changed at any time and contain the cxs commands and options you want
\nto use for scanning files as they are uploaded:<\/p>\n
The pure-ftpd upload scanner script that runs cxs:
\n\/etc\/cxs\/cxsftp.sh<\/p>\n
The web script upload scanner script that runs cxs:
\n\/etc\/cxs\/cxscgi.sh<\/p>\n
4. Web script upload scanning is performed via mod_security.<\/p>\n
This can be enabled two ways:<\/p>\n
a. Add the following two lines (be careful of line breaks) to your mod_security
\nrules file (\/usr\/local\/apache\/conf\/modsec2.user.conf on cPanel):<\/p>\n
SecRequestBodyAccess On
\nSecRule FILES_TMPNAMES “@inspectFile \/etc\/cxs\/cxscgi.sh” \\
\n“log,auditlog,deny,severity:2,phase:2,t:none,id:’1010101′”
\nSecUploadKeepFiles RelevantOnly
\nSecTmpDir \/tmp<\/p>\n
If you allow the uploading of very large files, you may need to
\nincrease the default mod_security allowable size of 128MB by using the
\nSecRequestBodyLimit directive after SecRequestBodyAccess:<\/p>\n
SecRequestBodyLimit 134217728<\/p>\n
This value is in bytes (134217728 = 128MB). You might also want to
\ncreate the temporary files in a directory other than \/tmp using:<\/p>\n
SecTmpDir \/path\/to\/dir<\/p>\n
Where \/path\/to\/dir is a directory where the large files can be
\ntemporarily stored and must be writable to by the nobody user<\/p>\n
Then restart httpd<\/p>\n
b. Use the inbuilt cPanel ModSecurity Vendor Rules mechanism by either:<\/p>\n
1. WHM > ModSecurity Vendors > Add Vendor > Vendor Configuration URL<\/p>\n
https:\/\/download.configserver.com\/waf\/meta_configserver.yaml<\/p>\n
Save and then restart httpd<\/p>\n
or<\/p>\n
2. Issue the following commands:<\/p>\n
\/scripts\/modsec_vendor add https:\/\/download.configserver.com\/waf\/meta_configserver.yaml
\n\/scripts\/modsec_vendor enable configserver<\/p>\n
Then restart httpd<\/p>\n
You can have the ConfigServer Vendor enabled along with any other Vendor
\nthat you may already be using.<\/p>\n
5. Pure-ftpd upload scanning requires you to edit the active pure-ftpd.conf
\n(e.g. \/etc\/pure-ftpd.conf) and adding\/modifying the line:<\/p>\n
CallUploadScript yes<\/p>\n
Note: Pure-ftpd must be compiled with –with-uploadscript option (usually
\ndone by default)<\/p>\n
On Linux:
\nThen restart pure-ftpd and pure-uploadscript. The installation process adds
\na new service in \/etc\/init.d\/pure-uploadscript which runs as a daemon and
\npasses ftp uploads to \/etc\/cxs\/cxsftp.sh<\/p>\n
On FreeBSD:
\nThen add the following lines to \/etc\/rc.conf:<\/p>\n
pureftpd_enable=”YES”
\npureftpd_upload_enable=”YES”
\npureftpd_uploadscript=”\/etc\/cxs\/cxsftp.sh”<\/p>\n
Then restart pure-ftpd<\/p>\n
6. ClamAV scanning requires a running clamd daemon. By default cxs will look
\nfor the clamd socket at \/tmp\/clamd and \/var\/clamd, if it is located
\nelsewhere then you must use the –clamdsock option and pass the socket
\nlocation in every cxs call (i.e. in cxsftp.sh, cxscgi.sh and the cxs CLI) or
\nuse a cxs.defaults file.<\/p>\n
7. If you want automatic updates then use the following as an example:<\/p>\n
ln -s \/etc\/cxs\/cxsdaily.sh \/etc\/cron.daily\/<\/p>\n
8. You can test both Perl CGI and PHP upload checks by copying the files
\n\/etc\/cxs\/test.* to an empty test directory within a web site on the server
\n(set the file permissions and ownership correctly).<\/p>\n
First upload a normal file to check the uploads work.<\/p>\n
Then try uploading the exploit file from \/etc\/cxs\/test\/udp.pl which should
\ntrigger whatever settings you have configured in \/etc\/cxs\/cxscgi.sh<\/p>\n
You can also upload \/etc\/cxs\/test\/udp.pl via FTP which should trigger
\nwhatever settings you have configured in \/etc\/cxs\/cxsftp.sh<\/p>\n
NOTE: Remove the test scripts from the web site after testing as the test
\nscripts are NOT secure.<\/p>\n
9. See the RECOMMENDATIONS in the cxs POD documentation<\/p>\n
Webmin Module Installation\/Upgrade (not yet implemented)
\n==================================<\/p>\n
To install or upgrade the cxs webmin module:<\/p>\n
Install cxs as above
\nInstall the cxs webmin module in:
\nWebmin > Webmin Configuration > Webmin Modules >
\nFrom local file > \/etc\/cxs\/cxswebmin.tgz > Install Module<\/p>\n
Uninstallation
\n==============<\/p>\n
Reverse items 4, 5 and 7 above, then:<\/p>\n
cd \/etc\/cxs
\nsh uninstall.sh
\ncd \/root<\/p>\n","protected":false},"excerpt":{"rendered":"
Learn how to install and configure CXS (ConfigServer eXploit Scanner) in cPanel to enhance server security. Step-by-step instructions for FTP and web upload scanning, ModSecurity setup, and ClamAV integration.<\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89],"tags":[508,509,452],"class_list":["post-1024","post","type-post","status-publish","format-standard","hentry","category-cpanel","tag-configserver","tag-cxs-installation","tag-server-security"],"aioseo_notices":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/1024","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/comments?post=1024"}],"version-history":[{"count":1,"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/1024\/revisions"}],"predecessor-version":[{"id":2134,"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/posts\/1024\/revisions\/2134"}],"wp:attachment":[{"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/media?parent=1024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/categories?post=1024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostease.com\/blog\/wp-json\/wp\/v2\/tags?post=1024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}