New cxs v6.30

Changes:

  • Added a new Universal decoder. This attempts brute-force against PHP scripts containing base64 data and can greatly improve decoding performance over other included decoders
  • Improved recent advanced decoder
  • Perl module Compress::Zlib added to requirements (should be installed by default with perl)

New cxs v6.28

Changes:

  • Correct POD documentation regarding –Wmaxchild
  • Ensure that original self-contained inline PHP zip file is quarantined rather than zip file member

New csf v9.29

Changes:

  • Fixed issue that was breaking LF_DISTSMTP
  • Fixed issue in UI lfd Stats. Note: The lfd stats data file has been renamed from /var/lib/csf/stats/lfdmain to /var/lib/csf/stats/lfdstats Additionally, the stats for 2016-12-31 will reset to 0 due to this bug
  • Corrected text in readme.txt
  • Added new csf CLI cluster option: -ctd, –ctempdeny ip ttl [-p port] [-d direction] [comment]
    This sends a temporary deny request to the cluster
  • Added new csf CLI cluster option: -cta, –ctempallow ip ttl [-p port] [-d direction] [comment]
    This sends a temporary allow request to the cluster
  • Added new csf CLI cluster option: -cg, –cgrep ip
    This requests the –grep output for [ip] from each cluster member
  • Modified cluster requests to respond with an acknowledgment to the sender
  • Modified –cdeny [ip] and –callow [ip] to include optional comment
  • Added separate tab for Cluster options in UI if enabled and added new cluster temp allow/deny commands to UI
  • Modified Port Scan Tracking. UDP packets destined for the network broadcast address(es) will now be ignored in Port Scan Tracking unless BRD is added to PS_PORTS. The broadcast address(es) include the those listed in IP or IFCONFIG plus the default (255.255.255.255) unless one of the servers IPs
  • Added new feature: PT_USERRSS. This User Process Tracking option sends an alert if any user process exceeds the RSS memory limit set – RAM used, not virtual. PT_USERRSS is set to 256 (MB) and PT_USERMEM is now set to 512 (MB) by default on new installations. On existing installs PT_USERRSS is set to the same value as PT_USERMEM