Is anyone here able to set up modsecurity so it scans file uploads in real time and rejects malicious ones.

[Bsugar7]

Hi people,

I am not sure if this would be the appropriate place to ask. Should I be asking up here or should I approach a server side web developer.

I have a lot of these type emails saying:


TimeStamp: Thu, 24 Sep 2020 04:13:17 -0400

(/usr/sbin/cxs --nobayes --cgi --clamdsock /var/clamd --defapache nobody --doptions Mv --exploitscan --nofallback --filemax 10000 --noforce --html --ignore /etc/cxs/cxs.ignore --logfile /var/log/cxs.log --mail root --options mMOLfSGchexdnwWETDZ --qoptions Mv --quarantine /home/quarantine --quiet --sizemax 1000000 --ssl --summary --sversionscan --timemax 30 --nounofficial --virusscan --vmrssmax 959312 --voptions mfhexT /tmp/20200924-041317-X2xVHWHAd7Jgtb5YhzUtfQAAABU-file-TrcKat)

Much appreciated

 

[ffeingol]

Can you explain what you are looking for in a bit more detail? That message comes from CXS (ConfigServer eXploit Scanner / ConfigServer eXploit Scanner (cxs) ) and that's exactly what it does (using mod_security, FTP and/or a file system watcher).