Download

There are no unauthenticated package links, and there never will be. A download goes through the licence service with your key; the key goes there directly and never through this website.

What a release contains

Four signed packages per version: the scanner itself and the CyberPanel integration, as .deb and .rpm.

Package files in a Shelltrap release
File	Package	Platform	Architecture
`shelltrap_<version>_<arch>.deb`	Scanner	Ubuntu 20.04 / 22.04 / 24.04	amd64, arm64
`shelltrap-cyberpanel_<version>_all.deb`	CyberPanel integration	Ubuntu 20.04 / 22.04 / 24.04	all
`shelltrap-<version>-1.<arch>.rpm`	Scanner	AlmaLinux / RockyLinux / RHEL 8, 9, 10 · CloudLinux 8 · CentOS 9	x86_64, aarch64
`shelltrap-cyberpanel-<version>-1.noarch.rpm`	CyberPanel integration	AlmaLinux / RockyLinux / RHEL 8, 9, 10 · CloudLinux 8 · CentOS 9	noarch

Static fallback list, checked 2026-09-04. The live list is served by the licence service.

Every package ships with the sidecars .sha256, .asc: a SHA-256 checksum and a detached OpenPGP signature. Verify both before you install.

Download with a licence key

There are no unauthenticated package links. Your key goes straight to the licence service; this website never sees or stores it.

Prefer the command line?

The same endpoints work with curl, which is usually what you want on a server without a browser.

curl -fSLO --proto '=https' \
  'https://license.shelltrap.com/v1/downloads/shelltrap_<version>_amd64.deb?key=STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX'
curl -fsSL 'https://license.shelltrap.com/v1/downloads/index.json' | python3 -m json.tool

The licence service logs only the key prefix, never the key itself.

Verify before you install

Every release directory served by the licence service contains a SHA256SUMS file next to the packages. Compare the checksum of what you downloaded with that list before installing; the same checksums are shown in the client area. Detached OpenPGP signatures and an apt/dnf repository are planned for a later release and are deliberately not advertised here until they exist.

sha256sum -c --ignore-missing SHA256SUMS
dpkg-deb --info shelltrap_0.2.3_amd64.deb      # Debian/Ubuntu
rpm -qip shelltrap-0.2.3-1.x86_64.rpm          # AlmaLinux/RHEL

Installing the packages

Install the core package first, then the CyberPanel plugin, and activate the licence:

sudo apt-get install ./shelltrap_0.2.3_amd64.deb ./shelltrap-cyberpanel_0.2.3_all.deb
sudo shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
sudo shelltrap health

sudo dnf install ./shelltrap-0.2.3-1.x86_64.rpm ./shelltrap-cyberpanel-0.2.3-1.noarch.rpm
sudo shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
sudo shelltrap health

Which package do I need?

Two packages per host, both from the same version:

shelltrap — the scanner: broker, worker, CLI, systemd units, the PHP upload adapter and the signature machinery. This is the one that does the work.
shelltrap-cyberpanel — the panel integration: pages, roles and the repair path that puts the integration back after a CyberPanel upgrade. Optional; the scanner runs without it.

Supported: Ubuntu 20.04, 22.04 and 24.04; AlmaLinux, RockyLinux and RHEL 8, 9 and 10; CloudLinux 8; CentOS 9. Debian is only third-party supported by CyberPanel itself, so we do not promise it either.

After installing

shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
shelltrapd --config /etc/shelltrap/shelltrap.toml --check
shelltrap health

Then read the installation guide for the profile decision, the systemd drop-ins and — importantly — how to start in report-only on a host that already has paying customers on it.

No licence yet?

The key is created when you order and appears in the client area, together with the activation command and the list of servers currently using it.

Order Shelltrap — one licence per server, every domain covered
Pricing — what it costs, with VAT and net figures