Malware scanning and file integrity

#Overview

Server Admin runs on port 2087 (/admin), the User panel on port 2083. Resellers only see their own accounts on these pages; settings and the rule set can only be changed by the server administrator. The Community edition is limited to 3 hosting accounts; see Pricing for the edition differences.

#Virus scanning with ClamAV

ClamAV is installed as a component, either from Server Admin → Virus Scanner or from the Components page. On Debian and Ubuntu it installs clamav-daemon and clamav-freshclam; on AlmaLinux, Rocky Linux and RHEL it installs clamd and clamav-freshclam from EPEL. The signature database is downloaded and the installation is verified with the EICAR test signature. If SELinux is enabled, the required booleans are turned on and SELinux stays in enforcing mode.

clamd uses about 1.5 GB of memory with its signature database. On servers with less than 2 GB of total memory, the component is only installed after the administrator explicitly accepts the low-memory warning in the panel.

ClamAV is used in two places:

• Home directory scans: users scan their own home directory; administrators scan single accounts or all of them. The panel opens the files itself and passes them to clamd, and symbolic links are never followed. A weekly scan of all accounts is on by default (Sunday, hour 03), and accounts with infected files are notified.
• Mail scanning: if Rspamd is installed, incoming and outgoing mail is scanned with ClamAV; an infected message is rejected or quarantined according to the server default or the per-domain setting. See Email for details.

ClamAV is not installed on container installations. The Virus Scanner page in the User panel still opens, but only shows a notice and past records.

#Heuristic scanning

The heuristic scanner does not use signatures. It applies rules to web files (PHP, JavaScript, HTML and SVG, .htaccess, .user.ini, php.ini and images) to find web shells, backdoors, obfuscation and suspicious configuration. The rules ship with the panel and are refreshed by panel updates; the server administrator can disable individual rules.

#Scoring

Every rule has a severity: critical, high, medium or low. A file only becomes a finding when the combined score of its matching rules reaches a threshold, so a single weak signal such as high entropy is not enough on its own, while several signals together are. Each finding lists the matching rules with their descriptions, the line number and a safely escaped excerpt. Findings also get a confidence level; automatic quarantine only acts on high-confidence findings.

#Community vs Pro

• Community: users scan their own home directory and administrators scan individual accounts whenever they want. There is a cooldown between full scans that a user starts personally; a single finding can be checked right away with Rescan.
• Pro: one-off and scheduled scans of all accounts, real-time monitoring and automatic quarantine.

#Pro settings

Real-time monitoring only runs on server installations with the inotify-tools component installed. Web files that are created, finish being written or are moved in are queued for scanning; if events are dropped under heavy load, the affected accounts are rescanned afterwards. New findings reach the account owner and the administrator as summary notifications.

Base settings in every edition: the largest text file scanned (default 2048 KB), the "recently modified" window (default 7 days) and notifications to account owners (default on).

#Quarantine and finding actions

Each finding offers quarantine, restore, delete, ignore and rescan. A quarantined file is moved into a root-owned quarantine directory together with its metadata; on restore it is written back owned by the account user and without setuid/setgid bits. The heuristic scanner and ClamAV share the same quarantine, so quarantined heuristic findings also appear on the Virus Scanner page.

Before quarantining or deleting, the file's SHA-256 hash is compared with the one recorded in the finding. If the file has changed in the meantime, nothing happens and you are asked to rescan it first. Ignore adds the file's hash to an allowlist: users can ignore files for their own account, and the server administrator can ignore a file for the whole server.

#File integrity (Pro)

#Site files

For every monitored domain, bipanel takes a baseline of the document root: path, size, timestamps, permissions, owner and SHA-256 hash. Comparisons run hourly or daily (default daily at hour 03) and list added, changed and deleted files. Accepting a change updates the baseline; a changed or deleted file can be restored from the account's backups when a copy matching the baseline hash exists.

Changes to PHP and other scripts, .htaccess and JavaScript files made outside the maintenance windows are reported to the account owner, and optionally to the server administrator. The change time is taken from the file's ctime, which users cannot set back. Administrators can make monitoring mandatory for all accounts, in which case users cannot turn it off. Frequently changing paths such as caches and upload directories are excluded by default.

#Lock mode

Selected directories are made immutable (chattr +i): no process, including the web server, PHP, the account user and root, can add, change or delete files in them. For updates, a lock can be lifted for a limited time (at most 24 hours by default) and is reapplied when the time runs out. The whole home directory and directories the panel must write to cannot be locked. Lock mode is not available on container installations. Locks can also be listed and removed from the command line:

$ bipanel integrity locks
$ bipanel integrity unlock acme public_html/wp-includes

#System integrity and package verification

This is for the server administrator on server installations only. A daily check (default hour 04) compares these groups with their baseline: panel configuration (/etc/bipanel), panel files, sshd configuration and root's authorized keys, sudoers, cron, authentication files (/etc/ld.so.preload, PAM, nsswitch) and any paths you add. Account crontabs are optional.

Panel files are verified against the release package: if the package contains a SHA-256 list, that list is the reference; otherwise the hashes taken on the first start of a package whose signature the updater verified are used. When the version changes, this baseline is renewed automatically.

Package verification compares the files of installed packages with the package checksums: debsums on Debian and Ubuntu, rpm -V on AlmaLinux, Rocky Linux and RHEL. It runs weekly by default, and the package of a modified file can be reinstalled from the panel.

While the Pro license is not valid, scheduled checks stop; relocking expired locks keeps working regardless of the license. When a server moves to the Community edition, remaining locks are removed.

#File safety

File safety is part of the Community edition too. File Manager operations are protected against symbolic link races, zip-slip and compression bombs are blocked when extracting archives, and blocked attempts are logged (kept for 90 days). Archive extraction limits are set on Server Admin → File Safety:

On server installations, a component permanently enables the kernel fs.protected_* settings against link attacks in shared directories. For the File Manager itself see Files, FTP and terminal; for other protections see Security tools.