CXS successor · CyberPanel · cPanel (beta) · OpenLiteSpeed
The file that should not be there, caught the moment it lands
Shelltrap watches every write into your customers' document roots, scans it in an isolated worker, and tells you exactly why it decided what it decided.
- Real-time detection through fanotify — not a cron job that finds the shell on Thursday.
- A synchronous gate in front of PHP: an upload is judged before your application ever sees it.
- Your files never leave the machine. Only a licence check and signed rule downloads talk to Germany.
- Built for CyberPanel and cPanel: the panel plugin with reseller and customer roles on CyberPanel, CLI and API on cPanel/WHM, per-domain policies on both.
14 days without a payment method — 30 days with one on file.
One server, unlimited domains: €14.90 per server / month · incl. 19 % VAT
01 / The gap
A stock CyberPanel host has no malware scanner of its own
That is not an opinion about CyberPanel; it is what its own documentation says. The three roads out of that gap each have a toll, and one of them just closed — the same road that closed for cPanel operators.
The supported route costs twice
CyberPanel’s knowledge base documents Imunify360 as the malware option and states plainly that you must convert the operating system to CloudLinux OS before you can use it. That is a second commercial licence and a disruptive migration for anyone running stock AlmaLinux or Ubuntu.
The cheap route has been discontinued
ConfigServer eXploit Scanner filled exactly this gap for budget-conscious operators for years. Its vendor, Way to the Web, has discontinued sales. An unmaintained scanner keeps running — that is the problem, not the relief. Its signature feed does not keep up with what is being uploaded this month. On cPanel hosts, where cxs was the standard answer for years, the same question is open.
The free route stops at the panel
ClamAV and maldet are genuinely useful and genuinely free. On a stock CyberPanel host they are also a manual install with no on-write scanning, no panel integration, no per-domain policy and nobody to call. Somebody has to own that gap on a production box.
02 / The pipeline
Four moves between a write and a verdict
Every design decision here is about one thing: keeping the part of the system that parses hostile bytes as far away from root as it can possibly be.
Watch
fanotify marks each customer mount and reports writes, moves, creations, deletions and attribute changes. Attribute changes matter: a later
chmodor setuid flag is an event too. Queue overflow is counted, alarmed and answered with a bounded reconciliation scan — never silently swallowed.Hand over
The root broker opens the file safely with
openat2andRESOLVE_NO_SYMLINKS, then passes a read-only descriptor to a worker overSCM_RIGHTS. The broker itself contains no YARA, no ClamAV and no archive, Office or ELF parsing. It cannot be attacked through a file it never opens for reading.Scan
The worker runs as its own user, in its own mount and PID namespace, with seccomp, Landlock, rlimits and cgroup limits, and no network at all. Inside it: ClamAV over the clamd socket, YARA 4.5 precompiled for the active rule generation, hash sets with a known-good allowlist, and heuristics that must find several independent signals before they say anything.
Decide
The verdict, the score and every signal that contributed are recorded together with the rule generation and the policy generation that produced them. What happens next — report, quarantine or nothing — is a policy you set per domain, not a decision the scanner makes for you.
03 / What you get
Built by people who have had to clean a shared host at two in the morning
Nothing here is a checkbox. Each of these exists because the alternative goes wrong on a real server with real customers on it.
Upload gate in front of PHP
A thin adapter loaded through auto_prepend_file inspects non-empty $_FILES before your application runs. Malicious means HTTP 403 and a deleted temp file. The default on a gate error is fail-open, configurable per domain.
Per-domain policy
Global, account and domain layers with visible inheritance. Actions for signature, hash and heuristic hits, upload behaviour, scan windows, exclusions and retention — all settable for one site without touching the others.
Quarantine you can undo
A crash-safe transaction: descriptor copy, hash comparison, fsync, atomic publish, manifest and database commit, and only then the unlink. Restore puts back owner, mode, times, ACLs, xattrs and the SELinux context, and never overwrites an existing file.
Explainable findings
Every finding carries its signals, each with engine, name, score and — where the rule came from a third party — author, source and licence. You can argue with a verdict because you can read it.
Signed rule generations
Every rule set is an Ed25519-signed generation with per-rule provenance and an expiry date. It has to pass a known-good and known-bad corpus gate before activation, and a quarantine storm across several accounts rolls it back automatically.
CyberPanel plugin
Dashboard, findings with their signals, quarantine and restore, policies per domain, ignore lists, feed state and audit — inside the panel, with the roles your resellers and customers already have. If the panel breaks, the scanner keeps running. On a cPanel host the CLI and the local API do the same work; a WHM plugin is on the roadmap.
cPanel and WHM, in beta
Since 0.3.0 the daemon recognises a cPanel host by itself, builds its site index from the cPanel userdata — main domain, addon, sub and parked domains — and then runs the same watcher, the same engines, the same quarantine and the same per-domain policies as on CyberPanel. Implemented against the cPanel data format and tested against fixtures; not yet proven by long-running operation on live cPanel hosts. That is what the word beta means here. What works today .
Report-only mode
Start by recording everything and moving nothing. That is how we run it ourselves on production hosts before an action policy is switched on, and it is how you should meet a new scanner on a machine with paying customers on it.
Packages, not scripts
Signed .deb and .rpm for Ubuntu 20.04/22.04/24.04, AlmaLinux, RockyLinux and RHEL 8/9/10, CloudLinux 8 and CentOS 9. Idempotent maintainer scripts, a conffile that survives upgrades, and a purge that will not delete your quarantine without an explicit gate.
Health you can alert on
Queue age, overflows, unscanned objects, feed age, clamd state, reconciliation backlog and worker restarts, in Prometheus text format on a local socket. A degraded scanner reports degraded — it never reports clean.
04 / The verdict model
Five answers, because two would be a lie
Most scanners can say “clean” or “infected”. The interesting cases are the three in between, and pretending they do not exist is how a host gets a false sense of coverage.
clean
Scanned by every engine the profile provides, nothing found. Invalidated automatically when a new rule generation arrives.
suspicious
Several independent signals, below the action threshold. Reported and visible. Whether that ever becomes an action is your policy, per domain.
malicious
A signature or hash match, or a heuristic score above the threshold. The default action for signature and hash hits is quarantine.
unscanned
A limit was hit — size, time, archive depth, expansion ratio. Recorded with the reason. Never quietly counted as clean.
degraded
The scanner itself was impaired: clamd gone, a worker dead, a rule set missing. Also never counted as clean.
05 / Where your data is
Files never leave the server. That is architecture, not a promise
Shelltrap scans locally because the scanner runs locally. There is no upload of samples, no cloud analysis queue and no telemetry unless you switch it on.
- Two outbound connections exist: the licence check and the download of signed rule generations. Both go to Panomity servers in Germany.
- The licence check sends the key prefix (never the key), a hash of
/etc/machine-id, the hostname, the version and the operating system. - Quarantined content, findings, paths, hashes and the audit chain stay in
/var/lib/shelltrapon your machine. - The daemon’s systemd unit restricts address families to
AF_UNIX. Network for mail or webhooks is a drop-in you install deliberately.
06 / Getting it running
Two commands, then a capability probe that tells you the truth
The installer does not trust a kernel version number. It probes fanotify, file handles, mount topology, LSM state and available memory on the actual host, and prints what it found before it decides anything.
$ apt-get install shelltrap shelltrap-cyberpanel
Reading package lists... done
Setting up shelltrap (1.0.0) ...
shelltrap: kernel=6.8.0-generic CAP_SYS_ADMIN=present provisional_tier=unknown (requires shelltrapd --check)
shelltrap: SELinux=disabled AppArmor=enabled LSWS=OLS
shelltrap: mount_probe=/home mount_target=/home mount_fs=xfs mount_options=rw,relatime
shelltrap: profile=full (clamd socket reachable as shelltrap-scan, 4.1 GiB MemAvailable after reload reserve)
Created symlink /etc/systemd/system/multi-user.target.wants/shelltrapd.service
$ shelltrapd --config /etc/shelltrap/shelltrap.toml --check
{"tier":"A","diagnostic":{"tier":"A","mounts":[{"target":"/home","fs":"xfs","capabilities":{"fid":true,"filesystem_mark":true}}]}}
tier A — real time on every configured customer root
07 / Have a look for yourself
Three things you can poke at right now
No sign-up, no demo call, no sales engineer on the line.
Webshell Signal Explorer
Six things a scanner meets on a real host — including the false positive that must not happen — with the reasoning behind each verdict.
Open the explorer →
CXS migration calculator
Shelltrap is licensed per server, not per domain. Work out what your fleet costs before you talk to anybody.
Run the numbers →
The documentation
Installation, configuration, the CyberPanel plugin, signature feeds and licensing — the same material our own operators work from.
Read the docs →
Shelltrap on cPanel
What the beta covers on a cPanel/WHM host, what it deliberately does not, and the five steps from package to first scan.
Read the cPanel page →
Ready when you are
One licence per server. Every domain on it covered.
Order in the shop, activate with one command, and start in report-only until you trust it.
€14.90 per server / month · €149.00 per server / year · incl. 19 % VAT