{"id":525,"date":"2012-07-21T16:19:46","date_gmt":"2012-07-21T16:19:46","guid":{"rendered":"http:\/\/pheonixsolutions.com\/?p=525"},"modified":"2026-09-10T12:06:53","modified_gmt":"2026-09-10T06:36:53","slug":"script-to-scan-the-server-using-cxs","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/script-to-scan-the-server-using-cxs\/","title":{"rendered":"Script to scan the server using CXS"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CXS (ConfigServer eXploit Scanner) is a paid malware and exploit scanner that is widely used with cPanel servers. It can scan user accounts and identify potentially malicious or suspicious files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we will explain how to create a simple Bash script to scan all cPanel user accounts using CXS and automatically send the scan report to an email address.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before proceeding, make sure you have:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Root access to the cPanel server.<\/li>\n\n\n\n<li>CXS installed and configured on the server.<\/li>\n\n\n\n<li>A valid email address to receive the scan report.<\/li>\n\n\n\n<li>The <code>mail<\/code> command configured and working on the server.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Implementation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Create a Bash script on the cPanel server:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">#!\/bin\/bash\n\nDATE=$(date +%F_%H:%M)\nREPORT=\"\/root\/cxs-${DATE}.txt\"\nHOST=$(hostname)\nCXS=$(which cxs)\nEMAIL_ID=\"youremail@domain.tld\"\n\n$CXS --allusers --generate --report \"$REPORT\"\n\nif [ -s \"$REPORT\" ]; then\n    cat \"$REPORT\" | mail -s \"CXS Monthly Scan Report - $HOST\" \"$EMAIL_ID\"\nfi<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Save the script, for example, as:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/root\/cxs-scan.sh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Make the script executable:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">chmod +x \/root\/cxs-scan.sh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can then run the script manually to verify that the scan and email notification are working:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/root\/cxs-scan.sh<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Configure Cron<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You can schedule the script using cron according to your requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, to run the scan once a month at 2:00 AM:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">0 2 1 * * \/root\/cxs-scan.sh<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">CXS scans can consume significant server resources, especially when scanning a large number of files and user accounts. Therefore, it is recommended to schedule scans during off-peak hours and preferably on a weekly or monthly basis, depending on the server workload.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Conclusion<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CXS provides an effective way to scan cPanel user accounts for potentially malicious files. By combining CXS with a Bash script and cron, administrators can automate regular scans and receive the generated reports directly by email.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Scheduling the scans during off-peak hours can help reduce the impact on server performance.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">FAQs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. What is CXS?<\/strong><br>CXS (ConfigServer eXploit Scanner) is a security scanner designed to detect potentially malicious and suspicious files on servers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Is CXS free to use?<\/strong><br>No. CXS is a paid security scanning solution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Can CXS scan all cPanel user accounts?<\/strong><br>Yes. The <code>--allusers<\/code> option can be used to scan files belonging to all cPanel users.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Talk to our experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Have a technology challenge or looking for the right solution for your business? Our team can help you with <strong>cloud, DevOps, development, infrastructure, design, and more<\/strong>. Feel free to reach out to our experts <a href=\"https:\/\/pheonixsolutions.com\/contact\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction CXS (ConfigServer eXploit Scanner) is a paid malware and exploit scanner that is widely used with cPanel servers. It [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1020],"tags":[256,253,254,210],"class_list":["post-525","post","type-post","status-publish","format-standard","hentry","category-containers-kubernetes","tag-cron","tag-cxs","tag-scan","tag-script","psol-cat-containers-kubernetes"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-8t","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=525"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/525\/revisions"}],"predecessor-version":[{"id":11617,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/525\/revisions\/11617"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}