What is Shelltrap and what does it protect?

Shelltrap is a real-time webshell and exploit guard for CyberPanel servers. It watches the document roots of the accounts on your host, scans files as they change, and acts on the result according to a policy you control per domain. One licence covers one server and every domain, child domain and account on it.

What it watches

A kernel file watcher based on fanotify reports file events under the configured customer roots (/home by default). The event mask is deliberately wider than "a file was written":

• CLOSE_WRITE — a write finished, the usual moment to scan
• MOVED_TO / MOVED_FROM — a file was renamed into or out of a watched path
• CREATE / DELETE — a file appeared or disappeared
• ATTRIB — an attribute change, so a later chmod, a setuid bit or an ownership change is an event of its own

If the kernel event queue overflows — a backup restore, a large deploy — the overflow is counted, alarmed and answered with a bounded reconciliation scan. The same reconciliation runs after a reboot, a crash or an upgrade.

What it detects

PHP webshells and loaders, known malware by signature and by hash, and the configuration tricks that keep an attacker on a shared host: handler remapping in .htaccess, auto_prepend_file set from inside a site, PHP dropped into upload directories, image-header polyglots, symlinks pointing out of a home directory, and world-writable or setuid files.

Four engines run inside one sandboxed worker: ClamAV over the local clamd socket (full profile only), YARA 4.5 with rules precompiled per feed generation, SHA-256 hash sets with a known-good allowlist covering WordPress core, widely used plugins and themes, Laravel and Joomla, and explainable heuristics. A heuristic hit needs several independent signals; entropy alone never produces a verdict.

The privilege split

The root broker shelltrapd holds the privileges and contains no parsers: no YARA code, no ClamAV code, no archive, Office or ELF parsing. It opens files safely and passes a read-only descriptor onwards. The scanner worker holds the parsers and no privileges: its own system user shelltrap-scan, its own mount and PID namespace, seccomp, Landlock, rlimits, cgroup limits and no network at all.

What else is in the box

• A synchronous PHP upload gate that can refuse a malicious web upload with HTTP 403 before your application ever sees it.
• Crash-safe quarantine with a full metadata restore and a hash-chained audit trail.
• A CyberPanel plugin with roles for administrators, resellers and customers.
• Signed signature generations with per-rule provenance, corpus gating and automatic rollback.
• E-mail alerts, and health and metrics in Prometheus text format on a local socket.

What it is not

Shelltrap is not a WAF, not a firewall and not a desktop antivirus. It does not claim to catch everything — no scanner does. And it cannot help against an attacker who already has root on the machine, because nothing running on that machine can.

More detail: the product overview and the FAQ.