### Manual Scanner Installation (Linux amd64) Source: https://sansec.io/guides/usage Manually install the eComscan binary for Linux amd64 systems by downloading, saving to ~/bin, and making it executable. ```bash mkdir -p ~/bin curl https://ecomscan.com/downloads/linux-amd64/ecomscan -o ~/bin/ecomscan chmod 755 ~/bin/ecomscan ``` -------------------------------- ### Install eComscan Binary Source: https://sansec.io/guides/adobe-commerce-cloud Installs the eComscan binary to a writable partition on the Adobe Commerce Cloud server. Ensure the directory exists and the script has execute permissions. ```bash mkdir -p /mnt/shared/$LOGNAME/sansec curl https://sansec.io/downloads/linux-amd64/ecomscan -o /mnt/shared/$LOGNAME/sansec/ecomscan chmod 755 /mnt/shared/$LOGNAME/sansec/ecomscan ``` -------------------------------- ### Start a Single Store Scan Source: https://sansec.io/guides/usage Execute a single scan of your store's root folder, specifying a report email and the store path. ```bash ~/bin/ecomscan --report=your@email /path/to/store/root/folder ``` -------------------------------- ### Scan with License Key and Report Email Source: https://sansec.io/guides/usage Perform a scan using a provided license key and specify an email address for detailed reporting. This example uses a Magento store path. ```bash ~/bin/ecomscan --key=n8sFtfpWzz --report=admin@yourstore.com /var/www/magento ``` -------------------------------- ### Example Output for eComscan Permissions and User ID Source: https://sansec.io/guides/how-ecomscan-works-behind-the-scenes This is an example of the expected output when checking eComscan program permissions and the user ID. It shows the file permissions and the user/group details. ```bash $ ls -la `which ecomscan` -rwxr-xr-x 1 app app /data/web/bin/ecomscan $ id uid=1000(app) gid=1000(app) groups=1000(app) ``` -------------------------------- ### Install and Configure Sansec Shield Source: https://sansec.io/guides/sansec-shield Install the Shield composer module, configure Magento, and sync protection rules. Ensure you have a Sansec Advanced or Enterprise license key. ```bash # Install Shield module composer require sansec/magento2-module-shield # Configure Magento bin/magento setup:upgrade bin/magento config:set sansec_shield/general/license_key YOURKEY bin/magento cache:clean # Sync protection rules bin/magento sansec:shield:sync-rules ``` -------------------------------- ### Inspect Process Information Source: https://sansec.io/guides/how-to-inspect-deleted-process-file Use these commands to gather details about a process, such as its start time, command line, and open sockets. Replace `` with the actual process ID. ```bash # Start-time of process ps -o pid,lstart,cmd # All open sockets of process lsof -np # Generic checks on process cat /proc//environ cat /proc//cmdline strings /proc//exe ``` -------------------------------- ### Webscale Stratus Cronjob Command Source: https://sansec.io/guides/usage Example cronjob command for Webscale Stratus hosting, which requires using their specific panel for cronjob entries. ```bash /srv/bin/ecomscan --key --monitor /srv/public_html ``` -------------------------------- ### Schedule Daily Self-Update Source: https://sansec.io/guides/troubleshooting A cron job example to schedule a daily self-update for eComscan, intended to be run by root for system-wide installations. ```cron 1 1 * * * root /path/to/ecomscan --self-update ``` -------------------------------- ### Sample CSP Header Source: https://sansec.io/guides/csp-sri A Content Security Policy header example that restricts resource loading to self, Google Analytics scripts, and Google fonts. ```http Content-Security-Policy: default-src 'self'; script-src https://www.google-analytics.com; font-src fonts.gstatic.com; ``` -------------------------------- ### Example Crontab Entry for PATH Configuration Source: https://sansec.io/guides/troubleshooting Illustrates how to configure the PATH environment variable in a crontab to ensure cron jobs use the correct Composer binary. Ensure the directory with the updated Composer binary precedes any directory with an older version. ```bash PATH=/usr/local/bin:/usr/bin:/bin:/home/user/bin 0 2 * * * ~/bin/ecomscan -k --monitor ``` -------------------------------- ### Run Interactive Scan Source: https://sansec.io/guides/troubleshooting Use this command to verify eComscan installation and functionality. It sends a report to your inbox upon successful completion. ```bash ~/bin/ecomscan -k --report ``` -------------------------------- ### Successful PGP Signature Verification Output Source: https://sansec.io/guides/pgp-key This is an example of the output you should see if the eComscan binary's signature is valid and matches the Sansec PGP key. Pay attention to the 'Good signature' and 'Primary key fingerprint'. ```text gpg: Signature made Mon May 31 12:54:34 2021 UTC using RSA key ID 23AD53F7 gpg: Good signature from "Sansec BV " Primary key fingerprint: 7EB6 04FB 24FB 3A8B 61F1 70EA 9D0D 094C D2C7 E669 Subkey fingerprint: 2C94 7FF1 36A5 DD1C 0DED 57C6 7547 8737 23AD 53F7 ``` -------------------------------- ### Check for Linux iconv RCE Vulnerability (CVE-2024-2961) using C Source: https://sansec.io/guides/iconv-glibc This snippet downloads, compiles, and runs a C proof-of-concept exploit to check for the CVE-2024-2961 vulnerability. Ensure you have `curl` and `gcc` installed. ```bash curl -sO https://sansec.io/downloads/cve-2024-2961.c && gcc cve-2024-2961.c -o poc && ./poc ``` -------------------------------- ### Get File Timestamps with stat Source: https://sansec.io/guides/magento-root-cause-analysis Use the 'stat' command to retrieve detailed file information, including 'Access', 'Modify', and 'Change' timestamps. The 'Change' timestamp is often more reliable than 'Modify' as it cannot be spoofed without administrator access. ```bash $ stat app/webshell.php File: app/webshell.php Size: 29624 Blocks: 27 IO Block: 16384 regular file Device: 1000f6h/1048822d Inode: 437073 Links: 1 Access: (0644/-rw-r--r--) Uid: (11134/webserver) Gid: (11134/webserver) Access: 2019-04-03 05:48:25.991900869 +0000 Modify: 2013-07-04 03:11:18.734417791 +0000 Change: 2019-04-03 05:48:26.531897938 +0000 Birth: - ``` -------------------------------- ### Check System Performance with top Source: https://sansec.io/guides/troubleshooting Use the 'top' command to monitor system resource usage, specifically checking the '(st)eal' column to identify oversold virtual server conditions. ```bash top ``` -------------------------------- ### Set Up Continuous Monitoring via Cronjob Source: https://sansec.io/guides/usage Add a cronjob to run eComscan every 10 minutes for continuous monitoring. Replace placeholders for key, email, and store path. ```bash 10 * * * * ~/bin/ecomscan --key= --monitor= ``` -------------------------------- ### eComscan Command Line Help Source: https://sansec.io/guides/integration View all available command line options for eComscan. This is useful for understanding the full range of configurations. ```bash ecomscan --help ``` -------------------------------- ### Create Backups of Process Files Source: https://sansec.io/guides/how-to-inspect-deleted-process-file Before terminating a suspicious process, create backups of its executable, environment variables, and command line arguments. This is useful even if the original executable has been removed. ```bash cp /proc//exe /tmp/rogue.executable cp /proc//environ /tmp/rogue.environ cp /proc//cmdline /tmp/rogue.cmdline ``` -------------------------------- ### Limit CPU Usage for eComscan Source: https://sansec.io/guides/advanced-scanning Use this command to limit the CPU usage of eComscan to 50%, preventing it from exceeding auto-scaling thresholds. Ensure `cpulimit` is installed and eComscan is in your bin directory. ```bash cpulimit --limit 50 ~/bin/ecomscan [...] ``` -------------------------------- ### eComscan Site License Key via Environment Variable Source: https://sansec.io/guides/integration Provide your eComscan site license key using the ECOMSCAN_KEY environment variable for enhanced security. This is recommended over providing it as a command line option. ```bash --key=KEY ``` -------------------------------- ### Import Configuration and Clear Cache Source: https://sansec.io/guides/magento-csp After updating env.php, import the configuration and clear the cache to apply the changes. This ensures the new CSP settings are active. ```bash bin/magento app:config:import bin/magento cache:clean config ``` -------------------------------- ### Log Scans to File and Email Alerts Source: https://sansec.io/guides/integration Configure a cron job to log eComscan results to a file and send email alerts for new findings. Requires `moreutils` for `ifne`. ```bash ecomscan --newonly --key --format=csv \ tee -a /var/log/ecomscan.log | ifne mail -s "eComscan Alert" tech@your.com ``` -------------------------------- ### Scan Multiple Folders with eComscan Source: https://sansec.io/guides/faq When using providers that set up different root folders per storefront via symlinks, scan the parent folder (e.g., your home directory) to include all storefronts. Refer to advanced scanning instructions for cluster environments. ```bash ecomscan --deep ``` -------------------------------- ### Set SSH Permissions Source: https://sansec.io/guides/grant-store-access Ensure correct permissions are set for the .ssh directory and the authorized_keys file for secure SSH access. ```bash chmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys ``` -------------------------------- ### Configure eComscan for Multiple Email Reports Source: https://sansec.io/guides/faq Set up eComscan to send reports to multiple email addresses by listing them after the `--report` or `--monitor` flag, separated only by commas. Ensure there are no spaces between the email addresses. ```bash ecomscan --monitor mike@you.com,joe@you.com,it@you.com ``` -------------------------------- ### Submit File for Analysis Source: https://sansec.io/guides/submit-samples Use this command to submit a suspicious file or a false positive to Sansec for analysis. Replace PATH_TO_FILE with the actual path to the file you want to submit. ```bash ecomscan submit PATH_TO_FILE ``` -------------------------------- ### Import Sansec PGP Public Key Source: https://sansec.io/guides/pgp-key Use this command to import the Sansec public PGP key into your GnuPG keyring. This is the first step to verifying eComscan releases. ```bash curl https://sansec.io/downloads/sansec.pubkey.txt | gpg --import ``` -------------------------------- ### Access eComscan Key from File Source: https://sansec.io/guides/adobe-commerce-cloud Safely stores the eComscan license key in a file and accesses it using command substitution. This prevents the key from being stored directly in the source repository. ```bash /mnt/shared/$LOGNAME/sansec/ecomscan -k $(cat /mnt/shared/$LOGNAME/sansec/license.txt) /app/$LOGNAME ``` -------------------------------- ### Run eComscan with Slack Integration Source: https://sansec.io/guides/slack-integration Execute eComscan to send new malware alerts to a specified Slack channel. Ensure you replace placeholders with your actual webhook URL, API key, and scan path. ```bash ecomscan --newonly --slack --key ``` -------------------------------- ### Run eComscan with Verbose Flag Source: https://sansec.io/guides/faq Use the `--verbose` flag when running eComscan manually for the first time to verify interactions with Fastly. This can help diagnose potential issues if Fastly's WAF is blocking requests. ```bash ecomscan --verbose ``` -------------------------------- ### Block DirtyFrag Kernel Modules Source: https://sansec.io/guides/dirty-frag Use this command to create a configuration file that prevents the vulnerable modules from loading. It also attempts to unload them if they are currently active. Only blacklist IPsec ESP modules if your server does not use IPsec VPNs. ```bash cat > /etc/modprobe.d/dirtyfrag.conf </dev/null || true ``` -------------------------------- ### Check eComscan Program Permissions and User ID Source: https://sansec.io/guides/how-ecomscan-works-behind-the-scenes Run these commands to verify the permissions of the eComscan program and the user ID running it, which is important for the self-update feature. ```bash ls -la `which ecomscan` id ``` -------------------------------- ### Post Alerts to Generic Webhook Source: https://sansec.io/guides/integration Use this script to send eComscan alerts to a custom webhook. Ensure the webhook URL is correctly configured. ```bash ecomscan --format=json --newonly --key= | ifne curl -X -H 'Content-Type: application/json' -d@- ``` -------------------------------- ### Configure CSP Report-Only Mode in env.php Source: https://sansec.io/guides/magento-csp Set CSP to report-only mode for storefront checkout and admin routes, and enable inline scripts. This configuration helps identify violations without blocking functionality. ```php [ 'default' => [ 'csp' => [ 'mode' => [ 'storefront_checkout_index_index' => [ 'report_only' => '1' ], 'admin_sales_order_create_index' => [ 'report_only' => '1' ] ], 'policies' => [ 'storefront_checkout_index_index' => [ 'scripts' => [ 'inline' => '1' ] ], 'admin_sales_order_create_index' => [ 'scripts' => [ 'inline' => '1' ] ] ] ] ] ] ]; ``` -------------------------------- ### Redeploy Magento Cloud Environment Source: https://sansec.io/guides/grant-store-access After adding Sansec's account to your Magento Cloud project, redeploy the production environment to activate the SSH key. ```bash magento-cloud environment:redeploy production ``` -------------------------------- ### Add SSH Public Key for Sansec Access Source: https://sansec.io/guides/grant-store-access Add Sansec's SSH public key to your authorized_keys file to enable secure access. Ensure the key is on a single line. ```bash ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDSlrgyDEhQYmP1gihXTY/KlrDi6vUM+XlzEMlGSFglHhYRzmcB4l/LZgXDvfwXmvg+cr2wFRJJsq4G9H44qXkyVcn8h+f+rlWaMQNPlfqvdvQaFz/gJai/9hIf2WfmI5/zIF5uAzimTtz/ch9ur/23Qcic7dUeC4r6GASFFqR0Rt4zhCdOIdw2YU+5Jc2Xi7eWS3DD+Vko0j593CyMdn2iaQ1Vs2wivYvL57fd+lfNt+z2jOUOmkkOzcO4sVBZlVwVLrSYZIjHD6OcURA9j0ypwsneYAjNVBI+sjtnce/ZIncwyPSZ1oNTbImolwe1uK2zjjQSv1Gz4Z9lue1kS4LE4qba0+gnsGozbBPzAQ8v0aPr/uXDq96HCVUp8tPg/Evss3mA/AKvIKAduwVX+2Ia4h6W0jpQ103dncNF1ZdSBkbIi8NzIB+H3/nHkOfXa1jDXcudkmkXLwV1oClG4If6ZF6xet3Ao4KSgNsp6766rJPU3l9DZt86irTIMCjIRA0= sansec-gpg ``` -------------------------------- ### Automatic Store Scan Source: https://sansec.io/guides/usage Run this command via SSH to automatically download and execute the eComscan script for an immediate store scan. ```bash curl https://ecomscan.com | sh ``` -------------------------------- ### Override Database Connection with DSN Source: https://sansec.io/guides/advanced-scanning Use the --force-dsn command line option to specify a custom database connection string (DSN). This is useful for dynamic database configurations or when enforcing a specific connection. ```bash ecomscan --key=YOURKEY --force-dsn=$(wp-dsn /path/to/dynamic/wp-config.php) /path/to/wordpress ``` -------------------------------- ### Check for Linux iconv RCE Vulnerability (CVE-2024-2961) using Precompiled Binary Source: https://sansec.io/guides/iconv-glibc This snippet downloads and executes a precompiled binary to check for the CVE-2024-2961 vulnerability. This is an alternative if `gcc` is not available on your production servers. ```bash curl -sO https://sansec.io/downloads/linux-amd64/cve-2024-2961 && chmod 700 cve-2024-2961 && ./cve-2024-2961 ``` -------------------------------- ### Perform Self-Update Source: https://sansec.io/guides/integration Execute this command to check for and apply newer eComscan binary releases. Recommended for performance and detection logic improvements. ```bash /path/to/ecomscan --self-update 2>&1 >/dev/null ```