Merhabalar,
Bugün bilgi bankamıze ekleyeceğimiz makalemiz cxs kurulumu ve yapılandırması üzerine olacaktır.

CXS - ConfigServer eXploit Scanner (CXS) Nedir ?

ConfigServer eXploit Tarayıcı (CXS), bir cPanel sunucusunda kötü amaçlı yazılım algılama ve kaldırma konusunda harika bir araçtır. CXS'in canlı tarama kabiliyeti ve geniş veritabanı, kötü amaçlı yazılımlara karşı %99 oranında kalkan görevi üstlenmektedir. Cxs ömür boyu 60$ lisans ücreti bulunmaktadır.Bu yazıda, CXS'yi cPanel sunucularına nasıl kuracağınızı ve yapılandıracağınızı anlatacağız. 

Lisans alım işlemleri tamamlandıktan sonra kurulum ve yapılandırmalara geçelim

1. Adım

wget https://download.configserver.com/cxsinstaller.tgz

2. Adım

wget https://download.configserver.com/cxsinstaller.tgz

3. Adım

tar -xzf cxsinstaller.tgz

4. Adım

perl cxsinstaller.pl

5. Adım

cxs --qcreate --quarantine /etc/cxs/quarantine

6. Adım cxswatch.sh dosyasını düzenleyelim

#!/bin/sh
###############################################################################
# Copyright 2009-2015, Way to the Web Limited
###############################################################################
# The option --Wstart MUST be used on the cxs command line here
#
# Examples (only use ONE line for cxs scanning):
#/usr/sbin/cxs --Wstart --allusers --mail root
#/usr/sbin/cxs --Wstart --allusers --www --mail root --quarantine /home/safe/ --qoptions Mv --Wadd /etc/cxs/cxs.wadd
#
# We would recommend using --qoptions Mv initially if you use --quarantine
# otherwise you might find cxs quarantining files that you do not want to.
# For example, you probably do NOT want to quarantine all script files (T)!
#

/usr/sbin/cxs --options -wW --Wstart --allusers --www --smtp --ignore /etc/cxs/cxs.ignore --qoptions Mv --quarantine /etc/cxs/quarantine --log /var/log/cxs.log --Wmaxchild 3 --Wloglevel 0 --Wsleep 3 --filemax 0 --Wrateignore 300

7. Adım cxsftp.sh dosyasını düzenleyelim

#!/bin/sh
###############################################################################
# Copyright 2009-2015, Way to the Web Limited
###############################################################################
# The option --ftp MUST be used on the cxs command line here
#
# Examples (only use ONE line for cxs scanning):
#/usr/sbin/cxs --quiet --ftp --mail root "$1"
#/usr/sbin/cxs --quiet --ftp --mail root --quarantine /home/safe/ "$1"
#/usr/sbin/cxs --quiet --ftp --mail root --quarantine /home/safe/ --block "$1"
#/usr/sbin/cxs --quiet --ftp --logfile /var/log/cxs.log "$1"
#
# If you use --logfile, remember to chmod 666 [file] to allow write access

/usr/sbin/cxs --quiet --ftp --quarantine /etc/cxs/quarantine --logfile /var/log/cxs.log --mail yourname@youremail.com "$1"

8. Adım cxsdaily.sh dosyasını düzenleyelim

#!/bin/sh
###############################################################################
# Copyright 2009-2015, Way to the Web Limited
###############################################################################
# Run this script via cron daily

# Daily update of cxs and/or fingerprint definitions
/usr/sbin/cxs --upgrade --quiet

# Daily cleanup of quarantine if used. Modify to specify your quarantine
# directory and duplicate if you use more than one.
#
# Set --qclean to the number of days to retain, e.g. 7 = one week

/usr/sbin/cxs --qclean 7 --quarantine /etc/cxs/quarantine --quiet

9. Adım clamav yükleyelim

/scripts/update_local_rpm_versions --edit target_settings.clamav installed
/scripts/check_cpanel_rpms --fix --targets=clamav

10. Adım cxs için log dosyası oluşturalım

touch /var/log/cxs.log
chmod 630 /var/log/cxs.log

11. Adım pure-ftp dosyasını düzenleyelim

vi /etc/pure-ftpd.conf
find #CallUploadScript and change to CallUploadScript (remove comment)
service pure-ftpd restart
service pure-uploadscript restart

12. Adım mod_security düzenleyelim

/scripts/modsec_vendor add https://download.configserver.com/waf/meta_configserver.yaml
/scripts/modsec_vendor enable configserver
service httpd restart

13. Adım symlink oluşturalım

ln -s /etc/cxs/cxsdaily.sh /etc/cron.daily/

14. Adım

nano -w /etc/cron.d/daily-cxs

15. Adım yukarıda açmış olduğumuz dosyanın içerisine aşağıdaki komutları girelim

0   4   *   *   *   root  /usr/sbin/cxs --logfile /var/log/cxs.log --mail yourname@youremail.com --exploitscan --virusscan --sversionscan --bayes -I /etc/cxs/cxs.ignore -Q /etc/cxs/quarantine --options mMOLfSGchexdnwZRD --voptions mfuhexT --qoptions Mv -Z --www --summary --html --ssl -C /var/clamd --nofallback -T 5 --ctime 48 --allusers --quiet

16. Adım cxs servisini başlatalım

service cxswatch start
chkconfig cxswatch on

Tüm işlemler bu kadar. Güvenli ve bol trafikli günler