Introduction

ConfigServer eXploit Scanner (CXS) is a commercial malware and exploit scanning tool commonly used on cPanel/WHM servers. It helps identify malicious files, suspicious scripts, and potential security threats within hosting accounts.

This article explains how to create a simple shell script that performs a CXS scan of all cPanel accounts and emails the generated report to an administrator for review.

Prerequisites

Before proceeding, ensure the following requirements are met:

  • Root or sudo access to the server.
  • CXS (ConfigServer eXploit Scanner) installed and licensed.
  • A functioning mail service on the server.
  • Basic knowledge of Linux shell scripting and cron jobs.

Verify that CXS is installed:

$ which cxs

Expected output:

/usr/sbin/cxs

Implementation

Step 1: Create the Scan Script

Create a new script file:

$ vi /root/cxs_scan.sh

Add the following content:

#!/bin/bash

DATE=$(date +%F_%H-%M)
REPORT=/root/cxs-${DATE}.txt
HOST=$(hostname)
CXS=$(which cxs)

EMAIL_ID="youremail@domain.tld"

$CXS --allusers --generate --report $REPORT

if [ -s "$REPORT" ]; then
    cat "$REPORT" | mail -s "CXS Scan Report - $HOST" "$EMAIL_ID"
fi

Step 2: Save and Set Permissions

Make the script executable:

$ chmod +x /root/cxs_scan.sh

Step 3: Test the Script

Run the script manually:

$ /root/cxs_scan.sh

Verify that:

  • The scan completes successfully.
  • A report file is created under /root/.
  • The report is delivered to the configured email address.

Step 4: Schedule the Scan Using Cron

Edit the root user’s crontab:

$ crontab -e

Example: Run the scan on the first day of every month at 2:00 AM:

0 2 1 * * /root/cxs_scan.sh >/dev/null 2>&1

Example: Run the scan every Sunday at 3:00 AM:

0 3 * * 0 /root/cxs_scan.sh >/dev/null 2>&1

Step 5: Verify Cron Execution

Check the cron logs:

$ grep CRON /var/log/cron

Or verify that report files are being generated:

$ ls -lh /root/cxs-*.txt

Conclusion

Using a scheduled CXS scan helps administrators proactively identify malware, suspicious scripts, and security threats across hosting accounts. By automating the scan through a shell script and cron job, you can receive regular security reports directly via email and take prompt action when threats are detected.

Since CXS scans can consume significant server resources, it is recommended to schedule them during off-peak hours and run them weekly or monthly based on the server workload and security requirements.

Post Views: 225

Leave a Reply