ConfigServer Services Blog

New cxs v2.62

Changes:
– Removed extraneous / in the cgi email notification for the “Web upload script URL”
– Added cxs Watch logging for Inotify IN_Q_OVERFLOW events with a recommendation to increase /proc/sys/fs/inotify/max_queued_events if this occurs
– Added file check before invoking Inotify to confirm it exists to avoid spurious errors on VPS servers
– Allow files as well as directories in –Wadd [file]
– Exploit regex definitions database additions
– Exploit fingerprint definitions database additions

New ClamAV v0.97.5

A new version was released, but no notification on their blog or mailing list seems to have been posted. MailScanner version has been updated for upgrade.

New csf v5.56

Changes:
– Improvements to ST_MYSQL password detection in /root/.my.cnf where the password is quoted
– Improvements to the SMTP AUTH regex to cope with differing settings in exim log_selector
– Removed debugging code in SMTP AUTH regex detection

New csf v5.55

Changes:
– Update Fedora version check now that v17 has been released
– Added MySQL Connection and Thread statistics to ST_MYSQL/ST_SYSTEM
– Modified Server Check Report for cPanel servers see whether mod_ruid2 has been enabled making the Apache suEXEC check moot
– Improvements to the SMTP AUTH regex to cope with differing settings in exim log_selector

New csf v5.53

Changes:
– Added Email Usage to the ST_SYSTEM System Statistics feature when RT_* options are enabled
– Fixed incorrect Min/Max calculations in System Statistics
– Improvements to Disk Usage stats in System Statistics for some virtual environments
– Added CPU Temperature to the ST_SYSTEM System Statistics feature when lm-sensors/coretemp installed and enabled (highest core temp recorded)
– Added MySQL graphs to the ST_SYSTEM System Statistics feature when ST_MYSQL is installed and enabled – requires DBI and DBD::mysql perl modules. Authentication is via new ST_MYSQL* options. The option is enabled on cPanel servers by default, disabled on others
– Modified stats collection routine to append data to the stats file on each minute interval and to clean up only on lfd startup. This is to help minimise the risk of the stats file being incomplete due to process termination
– Added new options LF_DISTSMTP, LF_DISTSMTP_UNIQ and LF_DISTSMTP_PERM. This option will keep track of successful SMTP logins. If the number of successful logins to an individual account is at least LF_DISTSMTP in LF_INTERVAL from at least LF_DISTSMTP_UNIQ IP addresses, then all of the IP addresses will be blocked. This option can help mitigate the common SMTP account compromise attacks that use a distributed network of zombies to send spam (exim MTA only). Not enabled by default
– Modified Server Check Report for cPanel servers see whether mod_ruid2 has been enabled making the PHP Handler check moot
– Modified the ModSecurity regex to cater for the paid Atomic rules Apache error log non-standard format
– Modified non-cPanel new installs to disable ST_SYSTEM by default

New csf v5.52

Changes:
– Alternative kill and status methods employed for lfd init process on Debian/Ubuntu
– Added new feature: System Statistics. This option will gather basic system statstics. Through the UI it displays various graphs for disk, cpu, memory, network, etc usage. The feature requires the perl module GD::Graph. It is enabled by default with the ST_SYSTEM option

New cmm v1.18

Changes:
– For cPanel v11.32+ run /scripts/updateuserdomains instead of /scripts/update_email_limits
– Added Javascript confirmation to “Empty Directory” button

New cxs v2.61

Changes:
– Improvements to hidden script file detection
– Added formatting to cgi and ftp email reports
– Added new fields to the cgi email report
– Change POD Examples section to use full command line options
– Improvements to ignoring any files based on md5sum (including those identified as exectuables, viruses, etc)
– Remove extraneous spaces from ignore and xtra md5sum entries
– Improvements to –MD5 so that all reported files displays the md5sum
– Changed the way md5sum values are displayed if –MD5 is used
– Improvements to the main decoder regex
– Exploit fingerprint definitions database additions