shelltrap.com
en de

Changelog

Changelog

Shelltrap is in its internal test stage on Panomity production hosts. This is what that stage has found so far — the unflattering entries included, because those are the ones worth reading.

Version numbers follow MAJOR.MINOR.PATCH. Everything below 1.0.0 is an internal test build: it runs on our own hosts under production load, it is not downloadable, and it is not covered by any customer promise. It is published here because a scanner that has never been wrong on a real machine has simply never been on one.

Release 1.0 carries the full scope: all platform tiers, the panel UI with roles, the FTP enqueuer, Full and Lite profiles with measurement, the complete CyberPanel platform matrix in CI, GDPR retention, and the repair path after a panel upgrade.

0.3.1 released

Free trial, low-impact defaults

  • added
    Free trial: 14 days report-only with a customer account and confirmed e-mail; 30 days with full scope except automatic quarantine once a payment method is on file. One trial per server and per customer, renewed online daily; after the trial scanning and feeds stop and findings stay visible.
  • changed
    Low-impact defaults: bounded reconciliation (20 files/s, 16 MiB/s) that resumes from the last healthy timestamp after a restart instead of re-scanning everything, scan cache for unchanged clean files, two scan workers by default, CPU quota 100% and memory limits in the service unit, session and log files excluded from realtime scanning. A full inventory runs only on the first start or on request (shelltrap scan –all).
  • fixed
    Feed generations are built root-owned; the reference host no longer re-scans its full inventory after every restart.
0.3.0 released

cPanel/WHM support (beta), automated false-positive review, allowlist precedence

  • added
    cPanel/WHM hosts (beta): platform auto-detection, site index from cPanel userdata (main, addon, sub and parked domains, suspended accounts), generic mode with static sites, optional EasyApache 4 PHP-FPM upload gate (shelltrap uploadgate install –platform cpanel, off by default). No WHM plugin yet; CLI, API, alerts and signed feeds are identical to CyberPanel.
  • added
    Automated false-positive review: reports from registered customers to falsepositive@shelltrap.com are re-scanned, analysed by a model on Panomity GPU hardware and, when confirmed, allowlisted by SHA-256 in the next signed feed generation; replies come from sentinel@shelltrap.com .
  • changed
    Hash allow entries (vendor-verified files such as WordPress core) now take precedence over YARA rule hits; ClamAV signatures and malicious hash entries still win. Previously an allow entry only dampened the heuristics.
  • changed
    Notification sender is sentinel@shelltrap.com ; finding e-mails link to shelltrap.com rule pages.
0.2.5 internal test stage

Feed self-heal and CyberPanel plugin on Django 4

  • fixed
    Feed update and health no longer fail with ‘store: not found’ when the active generation has no store row; the row is rebuilt from the verified manifest.
  • fixed
    CyberPanel plugin package on current panels (Django 4): the integration check accepts the path() route and the menu-item sidebar block, the repair retries the lscpd restart and records why an integration was rolled back.
0.2.4 internal test stage

Feed updates without deadlock, realtime excludes, notification hygiene, finding dedupe

  • fixed
    A feed activation no longer blocks running scans or the health endpoint: reload quiesces each worker separately with a 55-second bound, POST /v1/feeds/update answers asynchronously (202/409), feeds status and feeds update –wait follow the phases.
  • added
    Realtime excludes: [watch] exclude (default /home/vmail/**, /Maildir/, /.cache/) and scan.exclude per domain, account and globally take effect without a restart; mailboxes are no longer treated as customer files.
  • changed
    Notification mails carry no indicator strings; at most one mail per site and file hash per hour and 30 single mails per hour overall, the rest goes into the digest. Repeated findings of the same file are merged (occurrences, last seen), never into resolved findings.
  • changed
    Feed build gate requires PHP file context and at least two indicators for every Panomity rule; the backtick rule no longer matches documentation comments.
0.2.3 released

First licensed release: licence gate, signed feeds, WordPress core allowlists

  • added
    Licence activation with offline-verifiable Ed25519 tokens (shelltrap license activate); without a licence the daemon does not scan and receives no signature feeds.
  • added
    Signed vendor feed with 163 YARA rules (Panomity, MIT; curated Neo23x0 rules, DRL-1.1) and SHA-256 allowlists for WordPress core 5.8 to 6.9.
  • changed
    Allowlist hits override heuristics; documented library files stay below suspicious; scheduler aging prevents reconcile starvation after restarts.
  • changed
    Health names every degraded cause; stripped release binaries; activation corpus shipped with the package.
  • changed
    Known issue: a feed update under sustained scan load can block the daemon; fixed in the next release.
0.1.10 internal test stage

Packaging: example drop-ins in a canonical location

  • fixed
    Minimised Ubuntu images strip /usr/share/doc/* through a dpkg path-exclude, which also removed the shipped systemd drop-in examples. They are now additionally installed under /usr/share/shelltrap/systemd/.
  • changed
    The platform matrix verifies the canonical drop-in path on every image.
0.1.9 internal test stage

Notification crash and heuristic false positives

  • fixed
    Without a [notify] section a typed nil pointer reached the broker as a non-nil interface, so the first suspicious notification crashed the daemon into a restart loop. cmd/shelltrapd now filters typed nils and the digest notifier is nil-safe.
  • changed
    Entropy or a single long line alone never produces suspicious any more; an image file needs an explicit PHP tag with code before it is scored at all.
0.1.8 internal test stage

Only signed rule generations load

  • security
    The daemon loads a signature generation only when it is signed with a pinned Ed25519 key. Unsigned or unpinned generations are refused fail-closed.
  • added
    tools/feedbuild builds a local generation from sources plus a provenance CSV, so an operator without a vendor feed can still run the full rule pipeline.
0.1.7 internal test stage

systemd unit stops dropping CAP_SETUID

  • fixed
    An explicit User=root together with NoNewPrivileges=yes made systemd remove CAP_SETUID from the effective set, so worker start failed with operation not permitted. The unit no longer sets User=/Group=, and a packaging test enforces that.
0.1.6 internal test stage

Second observation build on the reference host

  • known issue
    Worker start could fail in a restart loop on hosts whose unit combined User=root with NoNewPrivileges=yes. Fixed in 0.1.7.
0.1.1 – 0.1.4 internal test stage

Everything the first production-load host exposed

  • fixed
    Stale fanotify handles scheduled reconciliation scans of the filesystem root.
  • fixed
    JPEGs were scored as scripts because of <? bytes plus entropy.
  • fixed
    degraded results and limit-driven unscanned results produced one finding per file and blew through the per-account finding cap.
  • fixed
    The audit chains in the JSONL log and in the store could diverge and block startup.
  • fixed
    SQLite found no temporary directory under ProtectSystem=strict.
  • fixed
    clamd refused descriptors handed over with FILDES from the systemd mount sandbox (AppArmor); the worker now falls back to INSTREAM automatically.
0.1.0 internal test stage

First internal test build

  • added
    Parser-free root broker, tier-A fanotify watcher with reconciliation, scanner worker with ClamAV, YARA 4 and hash sets, explainable heuristics, crash-safe quarantine transaction with restore, ignore lists, scheduler, JSON-capable CLI, mail notification, signed feed generations, package lifecycle, health metrics, PHP upload adapter and the per-domain policy model.
  • note
    Report-only by default on the test hosts: no automatic quarantine, no PHP adapter activation, fully reversible.

How to read the test-stage entries

Each of those fixes came out of running the scanner in report-only mode against real customer data on a live CyberPanel host: 328 accounts, 1.1 TB, on Ubuntu 24.04 with OpenLiteSpeed. That is the only environment that produces bugs like “clamd refuses descriptors handed over from a systemd mount sandbox because of an AppArmor profile” or “JPEGs are scored as scripts because they contain the two bytes <?”.

The rule we work to: if a defect was visible to an operator, it belongs in this list.