Script to scan the server using CXS

Introduction

CXS (ConfigServer eXploit Scanner) is a paid malware and exploit scanner that is widely used with cPanel servers. It can scan user accounts and identify potentially malicious or suspicious files.

In this article, we will explain how to create a simple Bash script to scan all cPanel user accounts using CXS and automatically send the scan report to an email address.

Prerequisites

Before proceeding, make sure you have:

1. Root access to the cPanel server.
2. CXS installed and configured on the server.
3. A valid email address to receive the scan report.
4. The mail command configured and working on the server.

Implementation

Create a Bash script on the cPanel server:

#!/bin/bash

DATE=$(date +%F_%H:%M)
REPORT="/root/cxs-${DATE}.txt"
HOST=$(hostname)
CXS=$(which cxs)
EMAIL_ID="youremail@domain.tld"

$CXS --allusers --generate --report "$REPORT"

if [ -s "$REPORT" ]; then
    cat "$REPORT" | mail -s "CXS Monthly Scan Report - $HOST" "$EMAIL_ID"
fi

Save the script, for example, as:

/root/cxs-scan.sh

Make the script executable:

chmod +x /root/cxs-scan.sh

You can then run the script manually to verify that the scan and email notification are working:

/root/cxs-scan.sh

Configure Cron

You can schedule the script using cron according to your requirements.

For example, to run the scan once a month at 2:00 AM:

0 2 1 * * /root/cxs-scan.sh

CXS scans can consume significant server resources, especially when scanning a large number of files and user accounts. Therefore, it is recommended to schedule scans during off-peak hours and preferably on a weekly or monthly basis, depending on the server workload.

Conclusion

CXS provides an effective way to scan cPanel user accounts for potentially malicious files. By combining CXS with a Bash script and cron, administrators can automate regular scans and receive the generated reports directly by email.

Scheduling the scans during off-peak hours can help reduce the impact on server performance.

FAQs

1. What is CXS?
CXS (ConfigServer eXploit Scanner) is a security scanner designed to detect potentially malicious and suspicious files on servers.

2. Is CXS free to use?
No. CXS is a paid security scanning solution.

3. Can CXS scan all cPanel user accounts?
Yes. The --allusers option can be used to scan files belonging to all cPanel users.

Talk to our experts

Have a technology challenge or looking for the right solution for your business? Our team can help you with cloud, DevOps, development, infrastructure, design, and more. Feel free to reach out to our experts here.