Tag Archives: Open Source

OpenXS: an open-source exploit scanner for my servers

On 2025 Way to the Web Ltd shut down, and with it went support for cxs (ConfigServer eXploit Scanner) – a tool I’d been using for years on the servers I manage. cxs combined heuristic exploit detection, ClamAV-backed virus scanning, and a CSF firewall hook that auto-banned IPs behind malicious uploads. It was proprietary and obfuscated, and now even its own licensing server is offline.

Instead of looking for a commercial replacement, I decided to build my own, open-source. That’s how OpenXS started.

What it is

OpenXS’s core idea isn’t to build yet another scanner from scratch, but to act as a harness around existing, actively-maintained open-source projects – YARA (via a fork of php-malware-finder), ClamAV, maldet, CSF – giving them a common UX, unified reporting, quarantine and management, instead of each living separately with its own interface. A Python daemon keeps the YARA ruleset compiled in memory and answers scan requests over a Unix socket, so an upload doesn’t pay the cost of recompiling the ruleset on every single request.

What it does

  • YARA-based detection of obfuscated PHP, webshells and known exploit patterns
  • ClamAV and maldet (Linux Malware Detect) as additional, independent detectors
  • version checks (WordPress core, Composer packages, pending apt security updates)
  • file integrity monitoring with a SHA-256 baseline of a configurable list of important files
  • “unknown core file” detection – a file under wp-admin/wp-includes that isn’t part of the installed WordPress version’s own official distribution at all, telling apart a simple leftover from an incomplete upgrade from something genuinely unexpected
  • a “repair” action that replaces a modified, known file (WordPress core/plugin, Composer package, Drupal core) with its official pristine content, backed up to quarantine first
  • database content scan – scans the database’s own content (WordPress, Joomla/Mambo, Drupal 7) with the same YARA ruleset, for compromises that live entirely inside the database without ever touching a file
  • real-time upload blocking via a mod_security hook, before the web server even accepts the file
  • automatic CSF ban on IPs behind confirmed malicious uploads
  • a Webmin module for the dashboard, scan history, quarantine management, and one-click installers

Where it stands now

The project is still early-stage, but it’s already running in production on several of the servers I manage. The code is MIT licensed and public on GitHub:

https://github.com/mrpc/OpenXS

If you also manage Linux web hosting servers and were looking for a cxs replacement (or you’re just curious), take a look – issues, feedback and pull requests are always welcome.

NetBeans Day Athens 2016

This month in Athens, Netbeans users and developers in general will have a chance to attend to a free event about Netbeans.

NetBeans is a fantastic IDE, first designed for Java, but later it became one of the best choices for Web Developers in general. It is a great tool to develop in PHP, Javascript, html5 etc. It supports all the latest libraries and it has a very strong plugin ecosystem to support all kinds of external tools (version control systems, bug trackers, continuous integration servers, vagrant, etc). And of course it’s open source.

I will be there. It’s also an opportunity to meet people that we talk the last years through the community (the last years I am always a member of the NetCat team, that does all the testing for NetBeans).

Here is the announcement. For more information, please click here.

NetBeans Days is an international event that takes places in various countries around the world, since JavaOne 2014, where the idea was conceived. It is about the NetBeans IDE and Rich Client Platform as well as up to date information of the Java programming language (and also other languages that are supported by NetBeans).

The NetBeans Community, in collaboration with the Hub of Innovation & Entrepreneurship of Technopolis City of Athens is proud to invite you to a free event, on Friday 26 August, regarding the NetBeans IDE and Rich Client Platform. Take the opportunity to learn about the latest tips and tricks of the NetBeans IDE and the NetBeans platform by experts on the subject.

Agenda:

9:00-9:30: Registration, coffee

9:30-10:00: Welcome and NetBeans roadmap (Geertjan Wielenga: NetBeans Product Manager, Oracle)

10:00-11:30: Oracle JET – workshop (Geertjan Wielenga: NetBeans Product Manager, Oracle)

11:30-12:00: NetBeans and Java 9 support (Geertjan Wielenga)

12:00-13:00: Lunch Break

13:00-14:30: Developing mixed Java/Groovy projects with Gradle using Netbeans – workshop (Kostas Saidis: Niovity)

14:30-15:15: WildFly and Openshift plugins for NetBeans – workshop (Emmanuel Hugonnet: RedHat)

15:15-15:30: Coffee Break

15:30-16:15: Othelo game using NetBeans, Swing and Artificial Intelligence (Dimitrios Mendrinos)

16:15-16:45: Converting a Swing application to JavaFX and Dukescript – workshop (Ioannis Kostaras)

16:45-17:30: NetBeans for PHP developers; real world examples (Alexius Diakogiannis)

Multiple PHP versions in the same server

php1I have a dedicated server that runs PHP 5.2, for compatibility with some legacy apps. This version is too old to run, so I was looking for a way to have multiple versions of PHP in the same server – and select what I need per website.

Cpanel/whm has very nice tools to auto-install the version you want, but allows only for one version. However, in many hosting companies, clients have the option to choose PHP version with simple .htaccess commands. How this happens?

After doing some research, I found that you can run as many versions as you want if you run them through suPHP, CGI or FastCGI.  My server runs php in suPHP mode, so the rest is not hard.

The main idea is that every PHP version is installed on it’s own directory, and then for each cPanel account we define what version we want it to run – or if we don’t it runs the default cPanel version.

So, in my case, I had PHP 5.2 installed as default. I wanted to install 5.5.3 to run as well. I logged in through ssh as root and did:

# cd /usr/src
# wget http://gr2.php.net/distributions/php-5.5.3.tar.gz
# tar xfz php-5.5.3.tar.gz
# cd php-5.5.3

In other words, I downloaded the release I wanted in /usr/src directory and uncompressed. All files passed to /usr/src/php-5.5.3

Next step:

# ./configure \
 --enable-bcmath \
 --enable-calendar \
 --enable-exif \
 --enable-ftp \
 --enable-gd-native-ttf \
 --enable-libxml \
 --enable-mbstring \
 --enable-pdo=shared \
 --enable-soap \
 --enable-sockets \
 --prefix=/opt/php55 \
 --with-bz2 \
 --with-config-file-path=/opt/php55/lib \
 --with-config-file-scan-dir=/opt/php55/lib/php.ini.d \
 --with-curl=/opt/curlssl/ \
 --with-freetype-dir=/usr \
 --with-gd \
 --with-gettext \
 --with-imap=/opt/php_with_imap_client/ \
 --with-imap-ssl=/usr \
 --with-jpeg-dir=/usr \
 --with-kerberos \
 --with-libxml-dir=/opt/xml2 \
 --with-libxml-dir=/opt/xml2/ \
 --with-mcrypt=/opt/libmcrypt/ \
 --with-mysql=/usr/ --with-libdir=lib64 \
 --with-mysql-sock=/var/lib/mysql/mysql.sock \
 --with-mysqli=/usr/bin/mysql_config \
 --with-openssl=/usr \
 --with-openssl-dir=/usr \
 --with-pcre-regex=/opt/pcre \
 --with-pdo-mysql=shared \
 --with-pdo-sqlite=shared \
 --with-png-dir=/usr \
 --with-pspell \
 --with-xpm-dir=/usr \
 --with-zlib \
 --with-zlib-dir=/usr

That sets the configuration for php setup. If you follow this step, you should customise it to your needs. One of the options is that php should be installed in  /opt/php55.

When that finishes, assuming that everything is OK, we run the make command:

# make

and then

# make install

And PHP 5.5 is installed in /opt/php55.

Now we have to set our options in php.ini. A quick configuration:

# cp php.ini-production /opt/php55/lib/php.ini

It coppied the default settings. We should do some changes here and there:

# vi /opt/php55/lib/php.ini

For the next step, we have to add php5.5 handelr to suPHP and to apache.

# vi /opt/suphp/etc/suphp.conf

Before the end there will be something like:

application/x-httpd-php5="php:/usr/bin/php"

We add after that:

application/x-httpd-php55="php:/opt/php55/bin/php-cgi"

We save the file and go to change apache configuration as well

# vi /etc/httpd/conf/php.conf

Again, somewhere before the endo of file, there should be something like: suPHP_AddHandler application/x-httpd-php5.  After that, we add:

suPHP_AddHandler application/x-httpd-php55

We restart the apache service (in centos the command should be  # service httpd restart).

Now, to any website we want to use the newer version of php, we edit .htaccess and add this line on top of the file:

AddHandler application/x-httpd-php55 .php

and our website runs on PHP 5.5.

The next step is to change the default version of php to be 5.5 instead of 5.2, but that’s enough information for today.