shelltrap.com
en de

CXS successor · CyberPanel · cPanel (beta) · OpenLiteSpeed

The file that should not be there, caught the moment it lands

Shelltrap watches every write into your customers' document roots, scans it in an isolated worker, and tells you exactly why it decided what it decided.

  • Real-time detection through fanotify — not a cron job that finds the shell on Thursday.
  • A synchronous gate in front of PHP: an upload is judged before your application ever sees it.
  • Your files never leave the machine. Only a licence check and signed rule downloads talk to Germany.
  • Built for CyberPanel and cPanel: the panel plugin with reseller and customer roles on CyberPanel, CLI and API on cPanel/WHM, per-domain policies on both.

14 days without a payment method — 30 days with one on file.

One server, unlimited domains: €14.90 per server / month · incl. 19 % VAT

A stream of files entering the trap, one of them held and marked maliciousFiles written into customer document roots move along three lanes into a lit column. Two of them pass through and are labelled clean. One is held inside the column, tilted and marked with a warning badge, and is labelled malicious.cleanmaliciouscleanfanotify · CLOSE_WRITE · MOVED_TOSCANverdict/home/<account>/public_htmlquarantine · audit
write → scan → verdict · every file, every path, every time

01 / The gap

A stock CyberPanel host has no malware scanner of its own

That is not an opinion about CyberPanel; it is what its own documentation says. The three roads out of that gap each have a toll, and one of them just closed — the same road that closed for cPanel operators.

The supported route costs twice

CyberPanel’s knowledge base documents Imunify360 as the malware option and states plainly that you must convert the operating system to CloudLinux OS before you can use it. That is a second commercial licence and a disruptive migration for anyone running stock AlmaLinux or Ubuntu.

CyberPanel knowledge base, checked 4 September 2026

The cheap route has been discontinued

ConfigServer eXploit Scanner filled exactly this gap for budget-conscious operators for years. Its vendor, Way to the Web, has discontinued sales. An unmaintained scanner keeps running — that is the problem, not the relief. Its signature feed does not keep up with what is being uploaded this month. On cPanel hosts, where cxs was the standard answer for years, the same question is open.

The free route stops at the panel

ClamAV and maldet are genuinely useful and genuinely free. On a stock CyberPanel host they are also a manual install with no on-write scanning, no panel integration, no per-domain policy and nobody to call. Somebody has to own that gap on a production box.

02 / The pipeline

Four moves between a write and a verdict

Every design decision here is about one thing: keeping the part of the system that parses hostile bytes as far away from root as it can possibly be.

  1. Watch

    fanotify marks each customer mount and reports writes, moves, creations, deletions and attribute changes. Attribute changes matter: a later chmod or setuid flag is an event too. Queue overflow is counted, alarmed and answered with a bounded reconciliation scan — never silently swallowed.

  2. Hand over

    The root broker opens the file safely with openat2 and RESOLVE_NO_SYMLINKS, then passes a read-only descriptor to a worker over SCM_RIGHTS. The broker itself contains no YARA, no ClamAV and no archive, Office or ELF parsing. It cannot be attacked through a file it never opens for reading.

  3. Scan

    The worker runs as its own user, in its own mount and PID namespace, with seccomp, Landlock, rlimits and cgroup limits, and no network at all. Inside it: ClamAV over the clamd socket, YARA 4.5 precompiled for the active rule generation, hash sets with a known-good allowlist, and heuristics that must find several independent signals before they say anything.

  4. Decide

    The verdict, the score and every signal that contributed are recorded together with the rule generation and the policy generation that produced them. What happens next — report, quarantine or nothing — is a policy you set per domain, not a decision the scanner makes for you.

Shelltrap architecture: event sources, root broker, isolated worker, verdict and responseFour event sources feed the parser-free root broker. The broker hands a read-only file descriptor to an unprivileged worker running ClamAV, YARA, hash sets and heuristics. The worker returns one of five verdicts, which drives the response. The control plane, signed feeds and telemetry attach to the broker on the right.01 · EVENT SOURCESWeb uploadlsphp · auto_prepend_filesynchronous, 2 sfanotifytier A–D · CLOSE_WRITEreal timeFTPpure-uploadscriptpost-uploadSchedulebaseline · incrementalI/O budget02 · ROOT BROKERshelltrapd — runs as root, contains no parseropenat2 · RESOLVE_NO_SYMLINKSjob journal in SQLite (WAL)opaque object IDs onlyno YARA, no ClamAV codeSCM_RIGHTS · read-only fd03 · SCANNER WORKERown user · namespaces · seccomp · Landlock · no networkClamAVclamd socket · full profileYARA 4.5precompiled per generationHash setsplus known-good allowlistHeuristicsseveral signals requiredper-tenant limits: file size, scan time, archive depth, expanded bytes, temp storage04 · VERDICTcleansuspiciousmaliciousunscanneddegraded“not scanned” and “degraded” are states of their own and are never shown as cleanCONTROL PLANECyberPanel plugin · CLI/run/shelltrap/api.sockSO_PEERCRED · rolesno free-form pathsSignature feedsEd25519 · generationsprovenance per rulecorpus gate · canarycircuit breaker · rollbackLicenceEd25519 token, checked offlinefingerprint per serverno licence, no feedsResponsequarantine as a transactionrestore with metadatamail · webhook · digestpolicy per domainHealth · metrics · auditPrometheus text formathash-chained audit trail
The broker holds the privileges and no parser. The worker holds the parsers and no privileges.

03 / What you get

Built by people who have had to clean a shared host at two in the morning

Nothing here is a checkbox. Each of these exists because the alternative goes wrong on a real server with real customers on it.

01

Upload gate in front of PHP

A thin adapter loaded through auto_prepend_file inspects non-empty $_FILES before your application runs. Malicious means HTTP 403 and a deleted temp file. The default on a gate error is fail-open, configurable per domain.

02

Per-domain policy

Global, account and domain layers with visible inheritance. Actions for signature, hash and heuristic hits, upload behaviour, scan windows, exclusions and retention — all settable for one site without touching the others.

03

Quarantine you can undo

A crash-safe transaction: descriptor copy, hash comparison, fsync, atomic publish, manifest and database commit, and only then the unlink. Restore puts back owner, mode, times, ACLs, xattrs and the SELinux context, and never overwrites an existing file.

04

Explainable findings

Every finding carries its signals, each with engine, name, score and — where the rule came from a third party — author, source and licence. You can argue with a verdict because you can read it.

05

Signed rule generations

Every rule set is an Ed25519-signed generation with per-rule provenance and an expiry date. It has to pass a known-good and known-bad corpus gate before activation, and a quarantine storm across several accounts rolls it back automatically.

06

CyberPanel plugin

Dashboard, findings with their signals, quarantine and restore, policies per domain, ignore lists, feed state and audit — inside the panel, with the roles your resellers and customers already have. If the panel breaks, the scanner keeps running. On a cPanel host the CLI and the local API do the same work; a WHM plugin is on the roadmap.

07

cPanel and WHM, in beta

Since 0.3.0 the daemon recognises a cPanel host by itself, builds its site index from the cPanel userdata — main domain, addon, sub and parked domains — and then runs the same watcher, the same engines, the same quarantine and the same per-domain policies as on CyberPanel. Implemented against the cPanel data format and tested against fixtures; not yet proven by long-running operation on live cPanel hosts. That is what the word beta means here. What works today .

08

Report-only mode

Start by recording everything and moving nothing. That is how we run it ourselves on production hosts before an action policy is switched on, and it is how you should meet a new scanner on a machine with paying customers on it.

09

Packages, not scripts

Signed .deb and .rpm for Ubuntu 20.04/22.04/24.04, AlmaLinux, RockyLinux and RHEL 8/9/10, CloudLinux 8 and CentOS 9. Idempotent maintainer scripts, a conffile that survives upgrades, and a purge that will not delete your quarantine without an explicit gate.

10

Health you can alert on

Queue age, overflows, unscanned objects, feed age, clamd state, reconciliation backlog and worker restarts, in Prometheus text format on a local socket. A degraded scanner reports degraded — it never reports clean.

04 / The verdict model

Five answers, because two would be a lie

Most scanners can say “clean” or “infected”. The interesting cases are the three in between, and pretending they do not exist is how a host gets a false sense of coverage.

clean

Scanned by every engine the profile provides, nothing found. Invalidated automatically when a new rule generation arrives.

suspicious

Several independent signals, below the action threshold. Reported and visible. Whether that ever becomes an action is your policy, per domain.

malicious

A signature or hash match, or a heuristic score above the threshold. The default action for signature and hash hits is quarantine.

unscanned

A limit was hit — size, time, archive depth, expansion ratio. Recorded with the reason. Never quietly counted as clean.

degraded

The scanner itself was impaired: clamd gone, a worker dead, a rule set missing. Also never counted as clean.

05 / Where your data is

Files never leave the server. That is architecture, not a promise

Shelltrap scans locally because the scanner runs locally. There is no upload of samples, no cloud analysis queue and no telemetry unless you switch it on.

  • Two outbound connections exist: the licence check and the download of signed rule generations. Both go to Panomity servers in Germany.
  • The licence check sends the key prefix (never the key), a hash of /etc/machine-id, the hostname, the version and the operating system.
  • Quarantined content, findings, paths, hashes and the audit chain stay in /var/lib/shelltrap on your machine.
  • The daemon’s systemd unit restricts address families to AF_UNIX. Network for mail or webhooks is a drop-in you install deliberately.
What stays on your server and what leaves itFiles, scans, verdicts, quarantine, audit and logs stay entirely on the customer's server. Only two outbound connections reach Panomity in Germany: the licence check carrying key prefix, fingerprint hash, hostname, version and operating system, and the download of signed signature generations. No file, no sample and no telemetry without an explicit opt-in.YOUR SERVERcustomer files and uploadsscan results and signalsquarantine with original metadataaudit chain and logsfindings and policiesPrometheus metricsPANOMITY · GERMANYlicense.shelltrap.comkey prefix (never the key)fingerprint from /etc/machine-idhostname, version, operating systemdaily, with one hour of jitterSignature feedsdownload of signed generationsbearer token from the licenceHTTPS, same-origin enforcedservers in Germany, no third countrylicence checkfetch rulesfiles, samples, telemetry
Everything on the left stays on the left. The two arrows on the right are the whole of the outside world.

06 / Getting it running

Two commands, then a capability probe that tells you the truth

The installer does not trust a kernel version number. It probes fanotify, file handles, mount topology, LSM state and available memory on the actual host, and prints what it found before it decides anything.

root@web1 — /root
$ apt-get install shelltrap shelltrap-cyberpanel
Reading package lists... done
Setting up shelltrap (1.0.0) ...
shelltrap: kernel=6.8.0-generic CAP_SYS_ADMIN=present provisional_tier=unknown (requires shelltrapd --check)
shelltrap: SELinux=disabled AppArmor=enabled LSWS=OLS
shelltrap: mount_probe=/home mount_target=/home mount_fs=xfs mount_options=rw,relatime
shelltrap: profile=full (clamd socket reachable as shelltrap-scan, 4.1 GiB MemAvailable after reload reserve)
Created symlink /etc/systemd/system/multi-user.target.wants/shelltrapd.service
$ shelltrapd --config /etc/shelltrap/shelltrap.toml --check
{"tier":"A","diagnostic":{"tier":"A","mounts":[{"target":"/home","fs":"xfs","capabilities":{"fid":true,"filesystem_mark":true}}]}}
tier A — real time on every configured customer root

Ready when you are

One licence per server. Every domain on it covered.

Order in the shop, activate with one command, and start in report-only until you trust it.

€14.90 per server / month · €149.00 per server / year · incl. 19 % VAT