How to Install / Uninstall ConfigServer eXploit Scanner (cxs)

The CXS is a commercial product, so you need to purchase a license from their website at . Once ConfigServer informed you that your license has been activated, you can install cxs. First  perform the following in a root shell on your server via SSH:

If using an IPv6 license, replace ipv4 with ipv6 below1. installation:# cd /usr/src# wget https://download.configserver.com/cxsinstaller.tgz# tar -xzf cxsinstaller.tgz# perl cxsinstaller.pl ipv4# rm -fv cxsinstaller.*2. Create a directory for quarantining malware files:# cxs –qcreate –quarantine /etc/cxs/quarantine3. Add the following line to the cxswatch.sh file:/usr/sbin/cxs –options -wW –Wstart –allusers –www –smtp –ignore /etc/cxs/cxs.ignore –qoptions Mv –quarantine /etc/cxs/quarantine –log /var/log/cxs.log –Wmaxchild 3 –Wloglevel 0 –Wsleep 3 –filemax 0 –Wrateignore 3004. Add the following line to the cxsftp.sh file:/usr/sbin/cxs –quiet –ftp –quarantine /etc/cxs/quarantine –logfile /var/log/cxs.log –mail [email protected] “$1”5. Add the following line to the cxsdaily.sh file:/usr/sbin/cxs –qclean 7 –quarantine /etc/cxs/quarantine –quiet6. Create a log file for CXS by executing the below commands:# touch /var/log/cxs.log# chmod 630 /var/log/cxs.log7. Enable CallUploadScript function in pure-FTP configuration file at /etc/pure-ftpd.conf:# ln -s /etc/cxs/cxsdaily.sh /etc/cron.daily/8. Create a new Cron job for scanning all the files on a daily basis:0 4 * * * root /usr/sbin/cxs –logfile /var/log/cxs.log –mail [email protected] –exploitscan –virusscan –sversionscan –bayes -I /etc/cxs/cxs.ignore -Q /etc/cxs/quarantine –options mMOLfSGchexdnwZRD –voptions mfuhexT –qoptions Mv -Z –www –summary –html –ssl -C /var/clamd –nofallback -T 5 –ctime 48 –allusers –quiet9. Start CXS service and on check config to automatically start during boot time:# service cxswatch start# chkconfig cxswatch on

Sometimes the initial start-up will take little resources depending on the number of cPanel accounts, once it completes, it uses almost no resources and will work properly in the background.

Uninstall CXS:# cd /etc/cxs# sh uninstall.sh# cd /rootif you need any further information, please reach our support department.