Imunify360

https://docs.imunify360.com/
Admin
Imunify360 is a multi-layer security solution for Linux web servers using machine learning...
Tokens:68,883
Snippets:1,029
Trust Score:10
Update:2 months ago
Show doc for...
Tokens:
Raw
### View Installation Options

Source: https://docs.imunify360.com/imunifyav

Command to display help and available options for the installation script.

```bash
bash imav-deploy.sh -h
```

--------------------------------

### Show Help for Start Command

Source: https://docs.imunify360.com/imunifyav/cli

Displays help information specifically for the start command.

```bash
imunify-antivirus start [-h]
```

--------------------------------

### Install ImunifyAV Beta

Source: https://docs.imunify360.com/imunifyav

Command to install the beta version of ImunifyAV.

```bash
bash imav-deploy.sh --beta
```

--------------------------------

### Install ImunifyAV

Source: https://docs.imunify360.com/imunifyav

Standard installation commands for ImunifyAV on a server with root privileges.

```bash
wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh -O imav-deploy.sh
bash imav-deploy.sh
```

--------------------------------

### Install Imunify360 via CLI

Source: https://docs.imunify360.com/control_panel_integration

Commands to download the deployment script and execute the installation with a license key.

```bash
wget https://repo.imunify360.cloudlinux.com/defence360/i360deploy.sh -O i360deploy.sh
```

```bash
bash i360deploy.sh --key YOUR_KEY
```

--------------------------------

### Install SELinux Utilities

Source: https://docs.imunify360.com/installation

Install the necessary policy utilities if the checkmodule command is missing.

```bash
yum install policycoreutils-python-utils
```

--------------------------------

### Generate authentication token

Source: https://docs.imunify360.com/imunifyav/cli

Example of generating an authentication token for a specific user using the login get command.

```bash
imunify-antivirus login get --username my-user1
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2MDAyNDQwMTAuMDk5MzE5LCJ1c2VyX3R5cGUiOiJjbGllbnQiLCJ1c2VybmFtZSI6ImNsdGVzdCJ9.V_Q03hYw4dNLX5cewEb_h46hOw96KWBWP0E0ChbP3dA
```

--------------------------------

### Install jq dependency

Source: https://docs.imunify360.com/command_line_interface

Install the required JSON processor tool if it is not already present on the system.

```bash
# yum install jq -y 
```

--------------------------------

### Start Imunify Service

Source: https://docs.imunify360.com/imunifyav/faq_and_known_issues

Command to start the Imunify service.

```bash
# service imunify-antivirus start
```

--------------------------------

### Install Imunify360 with Deployment Script

Source: https://docs.imunify360.com/installation

Use the deployment script to install Imunify360 using a license key, beta flag, or IP-based license.

```bash
wget https://repo.imunify360.cloudlinux.com/defence360/i360deploy.sh -O i360deploy.sh
bash i360deploy.sh --key YOUR_KEY
```

```bash
bash i360deploy.sh --key YOUR_KEY --beta
```

```bash
bash i360deploy.sh
```

```bash
bash i360deploy.sh -h
```

--------------------------------

### List existing event hooks

Source: https://docs.imunify360.com/imunifyav/cli

Example command to display all configured event handlers.

```bash
imunify-antivirus hook list --event all
Event: malware-detected, Path: /root/directory/IMAVscannereventhooks/malware_detected.py
```

--------------------------------

### Initialize Acronis Backend

Source: https://docs.imunify360.com/ids_integration

Initialize the Acronis backup backend with optional provisioning and force installation flags.

```python
from restore_infected import backup_backends
acronis = backup_backends.backend('acronis')
acronis.init(name, password, provision=True, force=True, tmp_dir=None)
```

--------------------------------

### Resulting merged configuration example

Source: https://docs.imunify360.com/imunifyav/config_file_description

An example of the final configuration state after merging base, common, and local configuration files.

```yaml
FIREWALL:
  TCP_IN_IPv4:
  - '20'
  - '22'
  - '12345'
  port_blocking_mode: DENY
```

--------------------------------

### Setup Integration Configuration Directory

Source: https://docs.imunify360.com/control_panel_integration

Commands to create the vendor configuration directory and symlink the integration file.

```bash
mkdir -p /opt/cpvendor/etc/
```

```bash
ln -s /etc/sysconfig/imunify360/integration.conf /opt/cpvendor/etc/integration.ini
```

--------------------------------

### Unsupported Wildcard Path Examples

Source: https://docs.imunify360.com/dashboard

Examples of path formats that are not supported by the Ignore List functionality.

```text
/home/*/mail/
/home/user/*.html
/home/*
```

--------------------------------

### Authenticate via PAM

Source: https://docs.imunify360.com/command_line_interface

Example of using PAM to authenticate a user with a password.

```bash
imunify360-agent login pam --username my-user1 --password ********
```

--------------------------------

### Install ImunifyAV with License Key

Source: https://docs.imunify360.com/imunifyav

Commands to install ImunifyAV using a specific license key or an IP-based license (IPL).

```bash
wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh -O imav-deploy.sh
bash imav-deploy.sh --key YOUR_KEY
```

```bash
wget https://repo.imunify360.cloudlinux.com/defence360/imav-deploy.sh -O imav-deploy.sh
bash imav-deploy.sh --key IPL
```

--------------------------------

### Enable and Start WebShield

Source: https://docs.imunify360.com/control_panel_integration

CLI commands to update the Imunify360 configuration and manage the WebShield system service.

```bash
imunify360-agent config update '{"WEBSHIELD": {"enable": true, "known_proxies_support": true}}'
```

```bash
systemctl enable imunify360-webshield
```

```bash
systemctl restart imunify360-webshield
```

--------------------------------

### List Backups

Source: https://docs.imunify360.com/ids_integration

Syntax and example for listing available backups, optionally filtered by date.

```bash
list [--until]
```

```bash
restore_infected acronis list --until "01 Aug 2017"
2017-08-06T10:22:00
2017-08-05T06:00:00
2017-08-03T12:32:00
```

--------------------------------

### Configuration file naming and order

Source: https://docs.imunify360.com/features

Example of correct lexicographical ordering for configuration files to ensure proper override behavior.

```text
100-host_custom.config # custom config that would not override the main one due to the lexicographic naming
101-xmlrpc.config # custom config that contains settings that also will not override the config 90-local* and so on
90-local.config -> ../imunify360.config # contains settings configured via the UI/CLI
95-host-TCPPORTS.config # will override 90-local*
96-host-UDPPORTS.config # will override the above loaded
```

--------------------------------

### Backup list output

Source: https://docs.imunify360.com/ids_integration

Example output showing the list of backup files returned by the backend.

```text
/var/lib/psa/dumps/clients/u3/domains/u3.pl7.cloudlinux.com/backup_info_1708080701_1708090501.xml
/var/lib/psa/dumps/clients/u1/domains/u1.pl7.cloudlinux.com/backup_info_1708090500.xml
<...>
/var/lib/psa/dumps/clients/u1/domains/u1.pl7.cloudlinux.com/backup_info_1707070347_1707070353.xml
/var/lib/psa/dumps/clients/u1/domains/u1.pl7.cloudlinux.com/backup_info_1707070347.xml
```

--------------------------------

### Install SELinux Dependencies

Source: https://docs.imunify360.com/imunifyav

Commands to install checkpolicy and related utilities based on the operating system version.

```bash
yum install checkpolicy
```

```bash
yum install policycoreutils-python-utils
```

```bash
dnf install checkpolicy
```

--------------------------------

### Install Imunify360 ruleset in Plesk

Source: https://docs.imunify360.com/ids_integration

Execute these commands to install the Imunify360 ruleset if it is not currently detected.

```bash
# imunify360-agent install-vendors
OK
# plesk bin server_pref --show-web-app-firewall | grep "\[waf-rule-set\]" -A2
[waf-rule-set]
custom
```

--------------------------------

### View Imunify360 log examples

Source: https://docs.imunify360.com/faq_and_known_issues

Example log entries showing IP blocking, unblocking, and Anti-bot Challenge events.

```text
INFO [2017-04-15 18:30:00,889]
defence360agent.plugins.protector.lazy_init: IP 103.86.52.175 is BLOCKED
with 300 sec (expiration: 1492281300) (due to SensorAlert)
INFO [2017-04-15 18:30:00,889]
defence360agent.plugins.protector.lazy_init: Unblocking 103.86.52.175 in
CSF as it is already in our graylist
INFO [2017-04-15 18:30:01,663] defence360agent.internals.the_sink:
SensorAlert:
{'rule_id': 'LF_SMTPAUTH', 'timestamp': 1492281000.8720655, 'attackers_ip': '103.86.52.175', 'plugin_id': 'lfd', 'method': 'ALERT', 'ttl': '1'}
When user unblocks himself by Anti-bot Challenge, logs look like this:
INFO [2017-04-17 00:51:26,956] defence360agent.internals.the_sink:
CaptchaEvent:
{'timestamp': 1492404686.9496775, 'errors': [], 'user_agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36', 'accept_language': 'ru-RU,ru;q=0.8,en-US;q=0.6,en;q=0.4', 'event': 'PASSED', 'method': 'CAPTCHA', 'attackers_ip': '10.101.1.18'}
INFO [2017-04-17 00:51:26,967]
defence360agent.plugins.protector.lazy_init: IP 10.101.1.18 is UNBLOCKED
(due to ClientUnblock)
```

--------------------------------

### Notifications configuration JSON structure

Source: https://docs.imunify360.com/imunifyav/cli

Example of the JSON structure returned by the show command.

```json
{
  "eula": null,
  "items": {
    "rules": {
      "CUSTOM_SCAN_FINISHED": {
        "SCRIPT": {
          "enabled": false,
          "scripts": [
            "/home/myhook"
          ]
        }
      },
      "CUSTOM_SCAN_MALWARE_FOUND": {
        "SCRIPT": {
          "enabled": true,
          "scripts": [
            "/home/myhook"
          ]
        }
      },
      "CUSTOM_SCAN_STARTED": {
        "SCRIPT": {
          "enabled": false,
          "scripts": []
        }
      },
      "USER_SCAN_FINISHED": {
        "SCRIPT": {
          "enabled": false,
          "scripts": []
        }
      },
      "USER_SCAN_MALWARE_FOUND": {
        "SCRIPT": {
          "enabled": true,
          "scripts": [
            "/home/myhook"
          ]
        }
      },
      "USER_SCAN_STARTED": {
        "SCRIPT": {
          "enabled": false,
          "scripts": []
        }
      }
    }
  },
```

--------------------------------

### Install ModSecurity Ruleset

Source: https://docs.imunify360.com/ids_integration

Execute this command to add the Imunify360 ModSecurity ruleset if ModSecurity was installed after the Imunify360 agent.

```bash
imunify360-agent install-vendors
```

--------------------------------

### Default List Command Behavior

Source: https://docs.imunify360.com/command_line_interface

Examples showing the default limit behavior for listing IP addresses.

```bash
imunify360-agent ip-list local list --purpose captcha --limit 100
```

```bash
imunify360-agent ip-list local list --purpose splashscreen –limit 100
```

--------------------------------

### Configure UI Path

Source: https://docs.imunify360.com/imunifyav/stand_alone_mode

Defines the web server directory where ImunifyAV is installed. This must be set before installation.

```ini
[paths]
ui_path = /var/www/vhosts/imunifyAV/imunifyAV.hosting.example.com/html/imav
```

--------------------------------

### Check version

Source: https://docs.imunify360.com/imunifyav/cli

Displays the currently installed version of ImunifyAV.

```bash
imunify-antivirus version [--optional arguments]
5.1.2-1
```

--------------------------------

### Restore Files

Source: https://docs.imunify360.com/ids_integration

Syntax and example for restoring specific files from backups.

```bash
restore files [--until]
```

```bash
restore_infected acronis restore "/root/file1" "/root/file2" --until "01 Aug 2017"
```

--------------------------------

### REALTIME_MALWARE_FOUND Event Configuration

Source: https://docs.imunify360.com/command_line_interface

Example configuration block for the REALTIME_MALWARE_FOUND event.

```json
   "REALTIME_MALWARE_FOUND": {
      "SCRIPT": {
         "scripts": [], 
         "period": 1,
         "enabled": False
      },
      "ADMIN": {
         "period": 1,
         "admin_emails": [],
         "enabled": False
      }
```

--------------------------------

### View rule list output

Source: https://docs.imunify360.com/features/under_attack_mode

Example output showing the structure of the rule list command.

```text
imunify360-wsctl uam list
ID  ACTIVE  DOMAIN            COOKIE_TTL  LABEL
7   true    shop.example.com  1h          Black Friday
```

--------------------------------

### Configure SELinux Policy

Source: https://docs.imunify360.com/installation

Manually compile and install the SELinux policy module if the package was installed directly.

```bash
checkmodule -M -m -o /var/imunify360/imunify360.mod /opt/imunify360/venv/share/imunify360/imunify360.te
semodule_package -o /var/imunify360/imunify360.pp -m /var/imunify360/imunify360.mod
semodule -i /var/imunify360/imunify360.pp
```

--------------------------------

### Apply SELinux Policy Module

Source: https://docs.imunify360.com/imunifyav

Commands to compile and install the ImunifyAV SELinux policy module.

```bash
checkmodule -M -m -o /var/imunify360/imunify-antivirus.mod /var/imunify360/imunify-antivirus.te
semodule_package -o /var/imunify360/imunify-antivirus.pp -m /var/imunify360/imunify-antivirus.mod
semodule -i /var/imunify360/imunify-antivirus.pp
```

--------------------------------

### Execute Initial Acronis Backup

Source: https://docs.imunify360.com/ids_integration

Trigger the initial backup process after agent installation, with optional tracing.

```python
 from restore_infected import backup_backends
 acronis = backup_backends.backend('acronis')
 acronis.make_initial_backup(trace=False)
```

--------------------------------

### Restore infected files implementation

Source: https://docs.imunify360.com/ids_integration

Example demonstrating how to initialize a backend and call the restore_infected function with a custom scan function.

```python
from restore_infected import backup_backends
from restore_infected.restore import restore_infected
from restore_infected.helpers import DateTime
 
plesk = backup_backends.backend('plesk')
 
def my_scan(files):
  infected = []
  # scan files here
  return infected
 
restore_infected(
plesk,
"/var/www/vhosts/u1.pl7.cloudlinux.com/httpdocs/index.php",
until=DateTime("9 Aug 2017"),
scan_func=my_scan)
```

--------------------------------

### Enable malware cleanup for a user

Source: https://docs.imunify360.com/imunifyav/cli

Example command to enable the malware cleanup feature for a specific user.

```bash
imunify-antivirus feature-management enable --feature av --users user1
failed: []
succeeded:
- user1
```

--------------------------------

### Register Activation Key

Source: https://docs.imunify360.com/imunifyav

Command to register an activation key or IPL after the initial installation.

```bash
imunify-antivirus register YOUR_KEY
```

--------------------------------

### Incorrect configuration loading order

Source: https://docs.imunify360.com/features

Example of an incorrect configuration file naming scheme that fails to achieve the desired override priority.

```text
90-local.config -> ../imunify360.config
95-host-TCPPORTS.config
96-host-UDPPORTS.config
100-host_custom.config
101-xmlrpc.config
```

--------------------------------

### Display matched rule details

Source: https://docs.imunify360.com/features/under_attack_mode

Example output when a URL matches an active Under Attack Mode rule.

```bash
imunify360-wsctl uam test shop.example.com/checkout
[
  {
    "id": 7,
    "owner": "admin",
    "active": true,
    "label": "Black Friday",
    "domain": "shop.example.com",
    "cookie_ttl": "1h",
    "paths": {
      "mode": "include",
      "matchers": [
        {
          "value": "/checkout",
          "condition": "prefix"
        }
      ]
    }
  }
]
```

--------------------------------

### Configure Imunify360 settings

Source: https://docs.imunify360.com/config_file_description

Example configuration structure for Imunify360 settings including auto-whitelist, DoS, firewall, and logging parameters.

```yaml
AUTO_WHITELIST:  
---
  
timeout: 1440| # set in minutes how long to keep automatically whitelisted IP  
after_unblock_timeout: 1440|  # set in minutes for how long IP will be added to the White List after it passes Imunify360 Anti-bot challenge  
DOS:  
enabled: True| # allows to enable (True, the default value) or disable (False) DOS detection  
interval: 30| # interval in seconds between DoS detection system activation  
default_limit: 250| # maximum default limit of connections from remote IP to local port before DoS protection will be triggered. Cannot be set lower than 100  
port_limits:| # allows to set limits per local port  
80: 150 | # limit on port 80 is set to 150 connections  
ENHANCED_DOS:  
enabled: True| # allows to enable or disable (False) the Enhanced DOS protection  
time_frame: 60| # the default timeframe in seconds between the Enhanced DoS detection system activation  
default_limit: 500| # the threshold of requests (their number) from remote IP to local port before the Enhanced DoS protection will be triggered.  
port_limits:| # allows to set requests limits for different ports  
80: 300 | # limit on port 80 is set to 300 connections  
FIREWALL:  
port_blocking_mode: ALLOW| # allows to set firewall port blocking mode.  
INCIDENT_LOGGING:  
min_log_level: 4| # minimum severity level for incidents displayed in UI. Please find the levels description here  
num_days: 100| # incidents older than _num_days_ are automatically deleted  
limit: 100000| # how many incidents should be stored in Imunify360 log file  
ui_autorefresh_timeout: 10| # set auto refresh time for incidents in user interface  
LOGGER:  
max_log_file_size: 62914560| # defines the maximum size of the log file in bytes (default is 60 MB)  
backup_count: 5| # defines how many log files to store. If 5, it will store _app.log_ , _app.log.1_ , and up to _app.log.5_.  
syscall_monitor: False| Collect and report the source of suspicious actions using Syscall Monitor (True). Supported operating systems: 
```

--------------------------------

### Malware scanning started event JSON payload

Source: https://docs.imunify360.com/imunifyav

Example JSON structure for the malware-scanning started event parameters.

```json
{
"scan_id":"dc3c6061c572410a83be19d153809df1",
"home":"/home/a/abdhf/",
"user":"abdhf",
"type":"background",
"scan_params": {"file_mask":"*", "follow_symlinks":"true", "ignore_mask":"", "intensity":"low"}
}
```

--------------------------------

### Start Imunify360 Service

Source: https://docs.imunify360.com/faq_and_known_issues

Command to start the Imunify360 service if it is found to be inactive.

```bash
# service imunify360 start
```

--------------------------------

### acronis.init(name, password, provision, force, tmp_dir)

Source: https://docs.imunify360.com/ids_integration

Initializes the Acronis backup backend agent.

```APIDOC
## acronis.init(name, password, provision=False, force=False, tmp_dir=None)

### Description
Installs or initializes the Acronis backup backend agent.

### Parameters
- **name** (string) - Required - Username for authentication.
- **password** (string) - Required - Password for authentication.
- **provision** (boolean) - Optional - Whether to provision the agent (default: False).
- **force** (boolean) - Optional - Force reinstallation if agent is present (default: False).
- **tmp_dir** (string) - Optional - Temporary directory for installation.
```

--------------------------------

### Format Global Ignore List Hashes

Source: https://docs.imunify360.com/features

Example of the file format requiring one SHA256 hash per line with optional comments.

```text
# PHP file managers, added 1/10/2024
f157c3ede78333087829cdd211c55822e635d6c419606c3675bc8201b556bc9f
8f6b0462e1ee9c498fe6ae055419eb79b5ef0e8cb359a6d991dbeffa0589ce9b

# Adminer, added 14/09/2024
dcfd0433dc46bd82ec5aa7c9998b4ae7087731a45d3a443e3724da7aabe1e4c5
```

--------------------------------

### Initialize Backup Backend

Source: https://docs.imunify360.com/ids_integration

Syntax for initializing a backup plugin, typically used to save credentials.

```bash
init arg0 arg1 ...
```

```bash
restore_infected acronis init
usage: restore_infected [-h] BACKEND {init,list,restore,cleanup} ...
restore_infected: error: init arguments required: username password
```

--------------------------------

### acronis.make_initial_backup(trace)

Source: https://docs.imunify360.com/ids_integration

Initiates the initial backup process.

```APIDOC
## acronis.make_initial_backup(trace=False)

### Description
Starts the initial backup after agent installation.

### Parameters
- **trace** (boolean) - Optional - If True, logs completion percentage to the log file (default: False).

### Returns
- **boolean** - Returns True if successful, False otherwise.
```

--------------------------------

### Download and prepare submission script

Source: https://docs.imunify360.com/command_line_interface

Download the submission script and set execution permissions. Must be run with root privileges.

```bash
# curl -o fpfn-submission.sh https://files.imunify360.com/static/cm/fpfn-submission.sh 
# chmod 700 fpfn-submission.sh 
```

--------------------------------

### Manage EULA via CLI

Source: https://docs.imunify360.com/command_line_interface

Commands for displaying or accepting the end-user license agreement.

```bash
imunify360-agent eula [command]
```

```bash
imunify360-agent eula show
```

--------------------------------

### Dovecot Error Log Examples

Source: https://docs.imunify360.com/features

Examples of log messages generated by Dovecot when PAM-based protection encounters unsupported password values.

```text
Jun 9 14:45:04 Hostl6 dovecot: auth-worker(31382): Error: pam(user@example.org,<IP>,<SESSION>): Multiple password values not supported
```

```text
Jun 9 14:45:10 Hostl6 dovecot: pop3-login: Disconnected (auth failed, 1 attempts in 6 secs): user=<user@example.org>, method=PLAIN, rip=<IP>, lip=<IP>, TLS, session=<SESSION>
```

--------------------------------

### Execute Migration Script

Source: https://docs.imunify360.com/ids_integration

Navigate to the migration directory and execute the main script to begin the migration process.

```bash
cd /opt/imunify360/venv/share/imunify360/scripts/migrate_csf
```

```bash
./main.py # executable, no python prefix needed
```

--------------------------------

### Block Port IP Example

Source: https://docs.imunify360.com/command_line_interface

Example command to block a specific TCP port for all IPs except the provided one with an associated comment.

```bash
imunify360-agent blocked-port-ip add 5555:tcp --ips 12.34.56.78 --comment 'Some comment'
OK
```

--------------------------------

### Check default configuration

Source: https://docs.imunify360.com/imunifyav/config_file_description

View the default configuration settings before they are merged with local overrides.

```bash
imunify-antivirus config show defaults
```

--------------------------------

### Check Imunify360 Version

Source: https://docs.imunify360.com/command_line_interface

Displays the currently installed version of Imunify360.

```bash
imunify360-agent version [--json]
4.9.5-3
```

--------------------------------

### Manage backup systems

Source: https://docs.imunify360.com/command_line_interface

Commands for listing, initializing, and checking the status of integrated backup systems.

```bash
imunify360-agent backup-systems [command] <value>
```

```bash
imunify360-agent backup-systems list 
cpanel
```

```bash
imunify360-agent backup-systems init cpanel
Backup initialization process is in progress
```

```bash
imunify360-agent backup-systems status
{'backup_system': 'cpanel', 'enabled': True}
```

--------------------------------

### backup_backends.backend(name)

Source: https://docs.imunify360.com/ids_integration

Initializes and returns a backup backend plugin instance by name.

```APIDOC
## backup_backends.backend(name)

### Description
Loads a specific backup backend plugin (e.g., 'plesk').

### Parameters
- **name** (string) - Required - The name of the backend plugin to load.
```

--------------------------------

### Database Error Messages

Source: https://docs.imunify360.com/imunifyav/faq_and_known_issues

Examples of database-related error messages found in logs.

```text
"Imunify360 database is corrupt. Application cannot run with corrupt database."
```

```text
"sqlite3.DatabaseError"
```

--------------------------------

### Start On-Demand Malware Scan

Source: https://docs.imunify360.com/imunifyav/cli

Initiates a malware scan for a specific directory path.

```bash
imunify-antivirus malware on-demand start --path /home/<username>/public_html/
```

--------------------------------

### Filter backups by date

Source: https://docs.imunify360.com/ids_integration

Use the until parameter to filter backups starting from a specific date.

```python
from restore_infected import backup_backends
plesk = backup_backends.backend('plesk')
from restore_infected.helpers import DateTime
for backup in plesk.backups(DateTime("9 Aug 2017")):
       print(backup)
```

--------------------------------

### Add a Blocked Port

Source: https://docs.imunify360.com/command_line_interface

Example of blocking a specific port and protocol with an optional comment.

```bash
imunify360-agent blocked-port add 5555:tcp --comment "Some comment"
```

--------------------------------

### SMTP Blocking Configuration File Format

Source: https://docs.imunify360.com/dashboard

Example structure of the SMTP_BLOCKING configuration section.

```yaml
SMTP_BLOCKING:
 allow_groups:
 - mailacc
 allow_local: true
 allow_users: []
 enable: true
 ports:
 - 25
 - 587
 - 465
 redirect: true
```

--------------------------------

### WebShield Configuration File Paths

Source: https://docs.imunify360.com/faq_and_known_issues

List of configuration files for the WebShield component.

```text
/etc/imunify360-webshield/ports.conf
/etc/imunify360-webshield/ssl_ports.conf
/etc/imunify360-webshield/webshield.conf
```

--------------------------------

### Asynchronous Restore Integration

Source: https://docs.imunify360.com/ids_integration

Example of using the async_restore_infected routine with a custom scan function.

```python
import logging
from restore_infected import backup_backends
from restore_infected.restore import async_restore_infected
from defence360agent.malscan.scanner import MalwareScanner
 
async def _custom_scan_function(files):
    if not files:
        return []
    still_infected = []
    scanner = MalwareScanner().scan_filelist()
    scanner.start(files)
    result = await scanner.async_wait()
    if result['results']:
        still_infected = list(result['results'].keys())
    return still_infected
 
class DummyDumper:
    @classmethod
    async def do_restore(cls, files):
        backend = backup_backends.backend('cpanel')
        return await async_restore_infected(
            backend, files, scan_func=_custom_scan_function
```

--------------------------------

### Test Plugin via CLI

Source: https://docs.imunify360.com/ids_integration

Command to verify that the custom plugin is correctly registered and functional.

```bash
restore_infected <your_backend_name> list
```

--------------------------------

### Basic CLI Usage Syntax

Source: https://docs.imunify360.com/imunifyav/cli

General structure for executing commands with optional flags.

```bash
imunify-antivirus [command] [--option1] [--option2]... 
```

--------------------------------

### Malware Cleanup Started Event

Source: https://docs.imunify360.com/features

JSON payload generated when a malware cleanup process begins.

```json
{
    "cleanup_id": "dc3c6061c572410a83be19d153809df1",
    "started": 1587365282,
    "total_files": 873535,
    "tmp_filename": "/var/imunify/tmp/hooks/tmp_02q648234692834698456728439587245.json",
}
```

--------------------------------

### Register ImunifyAV

Source: https://docs.imunify360.com/imunifyav/cli

Registers and activates the ImunifyAV installation using an activation key or IP-based license.

```bash
imunify-antivirus register [--optional arguments] [KEY]
```

```bash
imunify-antivirus register IMAV250jjRRjowbjk56dGN
OK
```

```bash
imunify-antivirus register IPL
OK
```

--------------------------------

### Example output for disabled rules

Source: https://docs.imunify360.com/command_line_interface

Shows the JSON-like format returned when listing disabled rules.

```text
{'plugin': 'modsec', 'id': '214920', 'domains': ['captchatest.com'], 'name': 'Imported from config'}

{'plugin': 'modsec', 'id': '42', 'domains': None, 'name': 'Rule name'}

{'plugin': 'ossec', 'id': '1003', 'domains': None, 'name': 'Imported from config'}

{'plugin': 'ossec', 'id': '2502', 'domains': None, 'name': 'User missed the password more than one time'}
```

--------------------------------

### Force Full Database Recreation

Source: https://docs.imunify360.com/faq_and_known_issues

Back up all primary database files and restart the service to force a complete recreation of the databases.

```bash
# systemctl stop imunify360-agent imunify360
# mv /var/imunify360/imunify360.db /var/imunify360/imunify360.db_backup
# mv /var/imunify360/imunify360-resident.db /var/imunify360/imunify360-resident.db_backup
# mv /var/imunify360/imunify360-ipsetlists.db /var/imunify360/imunify360-ipsetlists.db_backup
# systemctl start imunify360 imunify360-agent
```

--------------------------------

### Add Remote Proxy Subnet

Source: https://docs.imunify360.com/command_line_interface

Example command to add a proxy subnet with a specific name.

```bash
imunify360-agent remote-proxy add 1.1.2.0/24 --name "my_own_proxy"
OK
```

--------------------------------

### Manage per-user configuration

Source: https://docs.imunify360.com/command_line_interface

View or update configuration settings for a specific system user.

```bash
# Show effective configuration for a user
imunify360-agent config show --user <username> --json

# Set per-user background malware scan schedule: weekly at 03:00 on Monday
imunify360-agent config update '{"MALWARE_SCAN_SCHEDULE": {"interval": "week", "hour": 3, "day_of_week": 1}}' --user <username>

# Disable scheduled background scans for a user
imunify360-agent config update '{"MALWARE_SCAN_SCHEDULE": {"interval": "none"}}' --user <username>
```

--------------------------------

### Malware Cleanup Event JSON

Source: https://docs.imunify360.com/imunifyav

Example JSON payload for a finished malware cleanup event.

```json
{
"scan_id":"dc3c6061c572410a83be19d153809df1",
"started":1587365282,
"total_files":873535,
"total_cleaned":872835,
"tmp_filename":’/var/imunify/tmp/hooks/tmp_02q648234692834698456728439587245.json’,
"errors":[],
"status":"ok"
}
```

--------------------------------

### Define Watched Patterns

Source: https://docs.imunify360.com/faq_and_known_issues

Examples of absolute and relative glob patterns for the watched.txt configuration file.

```text
/another/folder

```

```text
+*/www

```

--------------------------------

### Example UAM counters output

Source: https://docs.imunify360.com/features/under_attack_mode

Displays the format of the output columns when running the counters command.

```text
imunify360-wsctl uam counters
ID  ACTIVE  DOMAIN            HITS  LABEL
7   true    shop.example.com  1523  Black Friday
```

--------------------------------

### Retrieve Acronis Login URL

Source: https://docs.imunify360.com/ids_integration

Get the URL required to log in to the Acronis web interface.

```python
from restore_infected import backup_backends
 acronis = backup_backends.backend('acronis')
 token = acronis.login_url()
```

--------------------------------

### Retrieve Command Help

Source: https://docs.imunify360.com/command_line_interface

Displays help information for a specific command.

```bash
imunify360-agent 3rdparty -h
```

--------------------------------

### Configure Malware Scanner Directories

Source: https://docs.imunify360.com/control_panel_integration

Set the base directory and regex pattern for the realtime malware scanner in integration.conf.

```ini
[malware]
basedir = /home
pattern_to_watch = ^/home/.+?/(public_html|public_ftp|private_html)(/.*)?$
```

--------------------------------

### Download Deployment Script

Source: https://docs.imunify360.com/uninstall

Command to retrieve the deployment script if it has been deleted.

```bash
wget https://repo.imunify360.cloudlinux.com/defence360/i360deploy.sh
```

--------------------------------

### Submission verdict JSON structure

Source: https://docs.imunify360.com/command_line_interface

Example of the JSON response structure returned when fetching submission results.

```json
   { 
      "date": "2022-11-11 20:14:40", 
      "verdict": "malicious", 
      "comment": "Added after scan with build 9231" 
   }
```

--------------------------------

### Configure Web Server Integration

Source: https://docs.imunify360.com/control_panel_integration

Define paths and scripts for web server management in integration.conf.

```ini
[web_server]
server_type = apache
graceful_restart_script = /usr/sbin/apachectl restart
config_test_script = /usr/sbin/apachectl -t
modsec_audit_log = /var/log/httpd/modsec_audit.log
modsec_audit_logdir = /var/log/modsec_audit
```

--------------------------------

### Malware Scan Result JSON Structure

Source: https://docs.imunify360.com/imunifyav

Example of the JSON output format for malware scan results.

```json
{

"scan_id":"dc3c6061c572410a83be19d153809df1",
"path":"/home/a/abdhf/",
"username":["imunify"],
"started":1587365282,
"total_files":873535,
"total_malicious":345,
"errors":[],
"files":[
{
  "username":"imunify",
  "hash":"17c1dd3659578126a32701bb5eaccecc2a6d8307d8e392f5381b7273bfb8a89d",
  "size":"182",
  "cleaned_at":1553762878.6882641,
  "extra_data":{


  },
  "malicious":true,
  "id":32,
  "status":"cleanup_removed",
  "file":"/home/imunify/public_html/01102018_2.php",
  "type":"SMW-INJ-04174-bkdr",
  "scan_type":"on-demand",
  "Created":1553002672
},
{
  "username":"imunify",
  "hash":"04425f71ae6c3cd04f8a7f156aee57096dd658ce6321c92619a07e122d33bd32",
  "size":"12523",
  "cleaned_at":1553762878.6882641,
  "extra_data":{


  },
  "malicious":true,
  "id":33,
  "status":"cleanup_done",
  "file":"/home/imunify/public_html/22.js",
  "type":"SMW-INJ-04346-js.inj",
  "scan_type":"on-demand",
  "Created":1553002672
},
...

]}
```

--------------------------------

### Configure panel_info in integration.conf

Source: https://docs.imunify360.com/control_panel_integration

Specify the path to the panel information script within the integration.conf file.

```ini
[integration_scripts]
panel_info = /etc/sysconfig/imunify360/get-panel-info.sh
```

--------------------------------

### Define Ignored Patterns

Source: https://docs.imunify360.com/faq_and_known_issues

Examples of absolute and relative regular expression patterns for the ignored.txt configuration file.

```text
/another/folder

```

```text
+[^/]+/www/\.cache

```

--------------------------------

### List backups from a backend

Source: https://docs.imunify360.com/ids_integration

Iterate through and print available backups from a specific backend plugin.

```python
from restore_infected import backup_backends
plesk = backup_backends.backend('plesk')
for backup in plesk.backups():
       print(backup)
```

--------------------------------

### Cleanup Temporary Files

Source: https://docs.imunify360.com/ids_integration

Example of invoking the cleanup action to remove temporary files created by a plugin.

```bash
restore_infected plesk cleanup
```

--------------------------------

### Enable Native Features Management

Source: https://docs.imunify360.com/command_line_interface

Enables WHM/cPanel package extensions for feature management.

```bash
imunify360-agent feature-management native enable
OK
```

--------------------------------

### Configure PHP Discovery Script

Source: https://docs.imunify360.com/control_panel_integration

Define the path to the PHP discovery script in the integration configuration file.

```ini
[integration_scripts]
...
php = /scripts/php
```

--------------------------------

### Get file difference

Source: https://docs.imunify360.com/imunifyav/cli

Retrieves the difference between an infected file and its cleaned version using the file ID.

```bash
imunify-antivirus malware malicious diff --id=1 --json | jq .diff -r | base64 --decode
```

--------------------------------

### Get Acronis Backend Information

Source: https://docs.imunify360.com/ids_integration

Retrieve region, schedule, and storage usage statistics in JSON format.

```python
 from restore_infected import backup_backends
 acronis = backup_backends.backend('acronis')
 info = acronis.info()
 {'schedule': {...}, 'usage': 17890969600, 'region': 'eu2'}
```

--------------------------------

### Check server configuration states

Source: https://docs.imunify360.com/features

CLI command to inspect configuration components including mutable, local, and immutable states.

```bash
imunify360-agent config show defaults
```

--------------------------------

### Test real-time malware scanner

Source: https://docs.imunify360.com/faq_and_known_issues

Upload a malware sample to verify that the real-time scanner detects it.

```bash
wget https://secure.eicar.org/eicar.com.txt -O /tmp/eicar.com.txt
scp /tmp/eicar.com.txt  mycooluser@X.Y.Z.A:/var/www/mycooluser/mycoolwebsite_docroot
```

```bash
cd /var/www/mycooluser/mycoolwebsite_docroot
sudo su mycooluser -s /bin/bash -c "curl -o eicar.com.txt https://secure.eicar.org/eicar.com.txt"
```
Tokens:
Raw