How to Install / Uninstall ConfigServer eXploit Scanner (cxs)

The CXS is a commercial product, so you need to purchase a license from their website at Configserver. Once ConfigServer informed you that your license has been activated, you can install cxs. First  perform the following in a root shell on your server via SSH:

If using an IPv6 license, replace ipv4 with ipv6 below

1. installation:

# cd /usr/src

# wget https://download.configserver.com/cxsinstaller.tgz

# tar -xzf cxsinstaller.tgz

# perl cxsinstaller.pl ipv4

# rm -fv cxsinstaller.*

2. Create a directory for quarantining malware files:

# cxs –qcreate –quarantine /etc/cxs/quarantine

3. Add the following line to the cxswatch.sh file:

/usr/sbin/cxs –options -wW –Wstart –allusers –www –smtp –ignore /etc/cxs/cxs.ignore –qoptions Mv –quarantine /etc/cxs/quarantine –log /var/log/cxs.log –Wmaxchild 3 –Wloglevel 0 –Wsleep 3 –filemax 0 –Wrateignore 300

4. Add the following line to the cxsftp.sh file:

/usr/sbin/cxs –quiet –ftp –quarantine /etc/cxs/quarantine –logfile /var/log/cxs.log –mail [email protected] “$1”

5. Add the following line to the cxsdaily.sh file:

/usr/sbin/cxs –qclean 7 –quarantine /etc/cxs/quarantine –quiet

6. Create a log file for CXS by executing the below commands:

# touch /var/log/cxs.log

# chmod 630 /var/log/cxs.log

7. Enable CallUploadScript function in pure-FTP configuration file at /etc/pure-ftpd.conf:

# ln -s /etc/cxs/cxsdaily.sh /etc/cron.daily/

8. Create a new Cron job for scanning all the files on a daily basis:

0   4   *   *   *   root  /usr/sbin/cxs –logfile /var/log/cxs.log –mail [email protected] –exploitscan –virusscan –sversionscan –bayes -I /etc/cxs/cxs.ignore -Q /etc/cxs/quarantine –options mMOLfSGchexdnwZRD –voptions mfuhexT –qoptions Mv -Z –www –summary –html –ssl -C /var/clamd –nofallback -T 5 –ctime 48 –allusers –quiet

9. Start CXS service and on check config to automatically start during boot time:

# service cxswatch start

# chkconfig cxswatch on

Sometimes the initial start-up will take little resources depending on the number of cPanel accounts, once it completes, it uses almost no resources and will work properly in the background.

Uninstall CXS:

# cd /etc/cxs

# sh uninstall.sh

# cd /root

if you need any further information, please reach our support department.