How do I install Shelltrap on Ubuntu 22.04 or 24.04?

Two packages go on every host, both from the same version: shelltrap (the scanner: broker, worker, CLI, systemd units, PHP upload adapter and signature machinery) and shelltrap-cyberpanel (the panel integration). The scanner runs without the second package; the plugin is optional.

1. Download the packages

There are no unauthenticated package links. Packages are served by the licence service against a valid key. Open the download page and enter your key, or fetch the files from the client area, where the key and the current checksums are shown.

2. Verify what you downloaded

Every release directory contains a SHA256SUMS file next to the packages. Compare before you install:

sha256sum -c --ignore-missing SHA256SUMS
dpkg-deb --info shelltrap_0.2.3_amd64.deb

3. Install

Install the core package first, then the CyberPanel plugin package:

sudo apt-get install ./shelltrap_0.2.3_amd64.deb ./shelltrap-cyberpanel_0.2.3_all.deb

Package installation starts the service immediately. On a host that already has paying customers on it, read "Should I start in report-only mode?" first — it takes two minutes and it is the difference between a quiet first day and a loud one.

4. Activate and check

sudo shelltrap license activate STL-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
sudo shelltrapd --config /etc/shelltrap/shelltrap.toml --check
sudo shelltrap health

--check returns JSON with tier and diagnostic.tier. Read both: when a backend is configured explicitly, the top-level value only reflects that choice, while diagnostic.tier is the real capability statement.

Supported Ubuntu releases

Ubuntu 20.04, 22.04 and 24.04. Debian is only third-party supported by CyberPanel itself, so we do not promise it either.

Full or Lite profile

The installer measures before it decides. Full requires a running or installable clamd, a socket genuinely reachable by the shelltrap-scan user (/run/clamav/clamd.ctl by default), and at least 1.5 GiB of MemAvailable remaining after the measured reload reserve. Otherwise Lite is chosen, scanner.enable_clamd is set to false, and ClamAV findings cannot be promised. A clamd started later does not silently upgrade the host. Check the decision:

grep -n 'enable_clamd' /etc/shelltrap/shelltrap.toml

If something is wrong

An unexpected tier is almost never a kernel version problem. Look at the diagnosis first:

shelltrapd --config /etc/shelltrap/shelltrap.toml --check
grep '^CapEff:' /proc/self/status

The usual causes are a missing CAP_SYS_ADMIN, an overlay or network filesystem under the customer root, or non-exportable file handles. Full detail is in the installation guide.