README
¶
CSM (Continuous Security Monitor)
Local security monitoring and automated response for Linux web servers. First-class coverage for cPanel/WHM shared hosting, with platform-aware checks for Plesk, DirectAdmin, and panel-free hosts.
CSM combines real-time file, authentication, web, mail, and network watchers with scheduled integrity and account scans. It stores state locally, exposes a Web UI and API, and can respond through nftables, quarantine, mail controls, and targeted remediation.
Documentation | Installation | Configuration | CLI | Web UI
Quick start
Install CSM from the signed APT or DNF repository described in the installation guide. Packages include the daemon, Web UI, rules, PAM module, systemd unit, and a csm command in /usr/sbin.
After installation:
sudo vi /etc/csm/csm.yaml
sudo csm validate
sudo systemctl enable --now csm.service
sudo csm baseline
sudo csm doctor
Open https://<server>:9443/login. The package generates an initial admin token in /etc/csm/csm.yaml and a self-signed certificate under the state directory unless explicit TLS paths are configured.
Use /etc/csm/conf.d/*.yaml for automation-owned overrides. Fragments load in lexicographic order; maps merge, scalars replace, and lists append. See Configuration for trust and integrity rules.
What CSM covers
| Problem | Detection and response |
|---|---|
| Mailbox takeover and outbound spam | Exim/Postfix/Dovecot log correlation, account attribution, IP or subnet blocking, optional mail freeze and forward-copy hold |
| WordPress and admin login attacks | Access-log and PAM watchers for login floods, XML-RPC abuse, credential stuffing, and distributed campaigns |
| Webshells, phishing, and injected PHP | fanotify plus scheduled content scans, YARA-X and YAML signatures, quarantine, and bounded cleanup strategies |
| Vulnerability and URL scanners | Per-source probe profiling, claimed-bot verification, ASN crawl detection, challenge routing, and firewall response |
| Compromised CMS databases | WordPress, Joomla, Drupal, Magento, and OpenCart content checks; reversible cleanup for supported rows and database objects |
| WAF and firewall operations | ModSecurity event correlation, nftables management, GeoIP policy, temporary bans, subnet escalation, and rollback-confirmed changes |
| Host compromise indicators | Suspicious processes, account and SSH changes, package integrity, C2 connections, BPF telemetry, and CVE-specific mitigations |
| Fleet observability | HTTPS API, SSE findings, Prometheus metrics, JSONL audit log, RFC 5424 syslog, webhooks, and SIEM backfill |
Detailed coverage is documented under Real-time detection, Critical checks, and Deep checks.
Operating model
- Real-time watchers process filesystem, authentication, access-log, mail, PAM, BPF, and ModSecurity events.
- Critical checks run every 10 minutes; deeper account, CMS, package, and database checks run every 60 minutes by default.
- Platform detection selects the OS, control panel, web server, paths, logs, and applicable checks through
internal/platform. - State is stored in bbolt with optional retention sweeps, automatic compaction, backup/restore, and audit export.
- CSM has no required SaaS dependency. External reputation, GeoIP, reporting, and panel integrations are optional.
Production release binaries include YARA-X and journald/BPF support. YARA-X is statically linked into the executable, while glibc remains dynamically linked with a build floor of glibc 2.28.
Safety defaults
- Auto-response is disabled until explicitly enabled.
- Automatic IP and subnet blocking starts in dry-run unless
auto_response.dry_run: falseis explicit. This is a network-response guard, not a universal simulation mode for file cleanup or process actions. - BPF enforcement and PHP-relay freezing have their own dry-run controls.
- Infrastructure, local, allowed, and verified-bot addresses are protected from automatic blocking.
- Process termination excludes root and recognized system services.
- Quarantine preserves the original path, ownership, permissions, and mtime for restoration.
- Firewall configuration can be applied with a confirmation timer and automatic rollback.
Review Auto-response before enabling actions on a production host.
Platform support
| Platform | Coverage |
|---|---|
| cPanel/WHM on CloudLinux, AlmaLinux, or Rocky with Apache/LiteSpeed | Primary target. Full account, WordPress, Exim, WHM plugin, firewall, and remediation coverage. |
| Plesk or DirectAdmin on a supported Linux distribution | Panel and web-server paths are detected. Generic host/web checks run; cPanel-only integrations skip. |
| AlmaLinux, Rocky, RHEL, or CentOS Stream 8+ | Generic checks with RPM integrity on Apache, Nginx, LiteSpeed, or hosts without a web server. |
| Ubuntu 20.04+ or Debian 11+ | Generic checks with dpkg/debsums integrity on Apache, Nginx, LiteSpeed, or hosts without a web server. |
Packages are published for x86_64 and ARM64. cPanel itself is x86_64-only.
Common commands
csm status [--json] daemon health, findings, watchers, and rollout state
csm doctor [--json] config, daemon, watcher, and store diagnostics
csm check run checks through the daemon without auto-response
csm baseline establish known state after first start or an approved reset
csm scan <user> scan one cPanel account; --full creates an uncapped job
csm firewall ... inspect and manage IP, subnet, port, and rollback state
csm clean <path> clean a supported infected PHP file with backup
csm harden ... audit or apply supported host mitigations
csm validate validate the merged main and conf.d configuration
See the CLI reference for full commands and maintenance requirements.
Development
go build ./... # standard build with YARA stubs
go build -tags yara ./cmd/csm/ # local YARA-X build
go test ./... -count=1 -race
go test -run=Fuzz ./...
make lint
make ci
See CONTRIBUTING.md and the development guide. Public releases land on GitHub; packaging and integration tests run through GitLab CI.
License
CSM is licensed under AGPL-3.0-or-later. Releases through v2.x remain under the MIT License; v3.0.0 and newer use AGPL-3.0-or-later.
See LICENSE, SECURITY.md, and CHANGELOG.md.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
csm
command
|
|
|
internal
|
|
|
atomicio
Package atomicio implements atomic file writes used by state-bearing callers (firewall engine, autoblock tracker, etc.).
|
Package atomicio implements atomic file writes used by state-bearing callers (firewall engine, autoblock tracker, etc.). |
|
blockdigest
Package blockdigest batches CSM auto-block events into a per-country roll-up so operators learn when IPs from their customers' countries get blocked.
|
Package blockdigest batches CSM auto-block events into a per-country roll-up so operators learn when IPs from their customers' countries get blocked. |
|
bpf
Package bpf provides the shared scaffolding that BPF-backed live monitors across the daemon use: a common Backend interface, backend-kind constants for operator config, sentinel errors that distinguish "not built" from "kernel unsupported", and a per-feature backend metric.
|
Package bpf provides the shared scaffolding that BPF-backed live monitors across the daemon use: a common Backend interface, backend-kind constants for operator config, sentinel errors that distinguish "not built" from "kernel unsupported", and a per-feature backend metric. |
|
broadcast
Package broadcast provides a one-to-many publish bus for alert.Finding events.
|
Package broadcast provides a one-to-many publish bus for alert.Finding events. |
|
checks
HTTP abuse detection.
|
HTTP abuse detection. |
|
contenttype
Package contenttype classifies file content shared by the malware scanners.
|
Package contenttype classifies file content shared by the malware scanners. |
|
control
Package control defines the wire protocol between the CSM daemon and its local command-line client.
|
Package control defines the wire protocol between the CSM daemon and its local command-line client. |
|
daemon/af_alg_bpfprog
Package af_alg_bpfprog hosts the BPF C source for the AF_ALG (CVE-2026-31431 "Copy Fail") kernel-side deny program and the generated Go bindings produced by bpf2go.
|
Package af_alg_bpfprog hosts the BPF C source for the AF_ALG (CVE-2026-31431 "Copy Fail") kernel-side deny program and the generated Go bindings produced by bpf2go. |
|
daemon/connection_bpfprog
Package connection_bpfprog hosts the BPF C source for the cgroup/connect outbound-connection tracker and the generated Go bindings produced by bpf2go.
|
Package connection_bpfprog hosts the BPF C source for the cgroup/connect outbound-connection tracker and the generated Go bindings produced by bpf2go. |
|
daemon/exec_bpfprog
Package exec_bpfprog hosts the BPF C source for the sched/sched_process_exec tracepoint live monitor and the generated Go bindings produced by bpf2go.
|
Package exec_bpfprog hosts the BPF C source for the sched/sched_process_exec tracepoint live monitor and the generated Go bindings produced by bpf2go. |
|
daemon/sensitive_file_bpfprog
Package sensitive_file_bpfprog hosts the BPF C source for the lsm/file_permission live monitor and the generated Go bindings produced by bpf2go.
|
Package sensitive_file_bpfprog hosts the BPF C source for the lsm/file_permission live monitor and the generated Go bindings produced by bpf2go. |
|
firewall/rollback
Package rollback implements the firewall settings tentative-apply workflow: a save with a deadline that auto-reverts unless the operator confirms before the timer expires.
|
Package rollback implements the firewall settings tentative-apply workflow: a save with a deadline that auto-reverts unless the operator confirms before the timer expires. |
|
forensic
Package forensic produces evidence archives for incident response.
|
Package forensic produces evidence archives for incident response. |
|
geoip
Package geoip provides IP geolocation via MaxMind GeoLite2 databases and on-demand RDAP lookups for detailed ISP/org information.
|
Package geoip provides IP geolocation via MaxMind GeoLite2 databases and on-demand RDAP lookups for detailed ISP/org information. |
|
incident
Package incident groups related security findings into a single "story" with a timeline.
|
Package incident groups related security findings into a single "story" with a timeline. |
|
integration/webserver
Package webserver auto-installs the CSM challenge webserver glue (Apache / LSWS / Nginx) with a write-validate-reload-or-revert flow.
|
Package webserver auto-installs the CSM challenge webserver glue (Apache / LSWS / Nginx) with a write-validate-reload-or-revert flow. |
|
log
Package log provides a structured-logging wrapper around log/slog.
|
Package log provides a structured-logging wrapper around log/slog. |
|
mailfwd/adapter
Package adapter renders and applies the MTA-native forward-guard rule.
|
Package adapter renders and applies the MTA-native forward-guard rule. |
|
mailfwd/guard
Package guard glues the operator config to the pure forward-guard policy.
|
Package guard glues the operator config to the pure forward-guard policy. |
|
mailfwd/intel
Package intel turns exim_mainlog deferral lines into operator-facing reputation signals: which outbound IPs are being throttled, by which mail providers, and for what stated reason.
|
Package intel turns exim_mainlog deferral lines into operator-facing reputation signals: which outbound IPs are being throttled, by which mail providers, and for what stated reason. |
|
mailfwd/inventory
Package inventory enumerates mail forwarders on a host and classifies their destinations, so operators can see which accounts relay mail off-server and to which providers.
|
Package inventory enumerates mail forwarders on a host and classifies their destinations, so operators can see which accounts relay mail off-server and to which providers. |
|
mailfwd/policy
Package policy is the single source of truth for the forward-guard hold decision: given the signals observed for a message, should the external forward copy be held? The same Verdict function feeds both the dry-run "would-hold" accounting and (in Phase 2) the generated MTA rule, so the two can never drift apart.
|
Package policy is the single source of truth for the forward-guard hold decision: given the signals observed for a message, should the external forward copy be held? The same Verdict function feeds both the dry-run "would-hold" accounting and (in Phase 2) the generated MTA rule, so the two can never drift apart. |
|
mailfwd/quarantine
Package quarantine is the CSM-owned Maildir that holds external forward copies the forward-guard decided to withhold.
|
Package quarantine is the CSM-owned Maildir that holds external forward copies the forward-guard decided to withhold. |
|
maillog
Package maillog reads postfix/dovecot log lines from either a tailed file or systemd-journald, normalizing them into a single Line type so the daemon's mail-brute and PHP-relay parsers don't have to care which source supplied the line.
|
Package maillog reads postfix/dovecot log lines from either a tailed file or systemd-journald, normalizing them into a single Line type so the daemon's mail-brute and PHP-relay parsers don't have to care which source supplied the line. |
|
mailranges
Package mailranges maintains an atomic in-memory map of mail-provider IP ranges used to exempt shared-source ranges (carrier CGNAT, mail providers) from firewall DoS heuristics.
|
Package mailranges maintains an atomic in-memory map of mail-provider IP ranges used to exempt shared-source ranges (carrier CGNAT, mail providers) from firewall DoS heuristics. |
|
metrics
Package metrics is CSM's local OpenMetrics implementation.
|
Package metrics is CSM's local OpenMetrics implementation. |
|
mysqlclient
Package mysqlclient wraps the database/sql + go-sql-driver/mysql pair for the read-only queries CSM issues against host-local MySQL/MariaDB.
|
Package mysqlclient wraps the database/sql + go-sql-driver/mysql pair for the read-only queries CSM issues against host-local MySQL/MariaDB. |
|
netutil
Package netutil holds the shared public-range guard used to validate operator- and vendor-supplied IP ranges.
|
Package netutil holds the shared public-range guard used to validate operator- and vendor-supplied IP ranges. |
|
obs
Package obs centralises crash reporting and selective error capture via Sentry.
|
Package obs centralises crash reporting and selective error capture via Sentry. |
|
platform
Package platform detects the host OS, control panel, and web server so CSM checks can pick the right config/log paths instead of hardcoding cPanel+Apache layouts.
|
Package platform detects the host OS, control panel, and web server so CSM checks can pick the right config/log paths instead of hardcoding cPanel+Apache layouts. |
|
processctx
Package processctx maintains process context (PID/PPID/UID/account/exe/cmdline) for use enriching real-time security findings.
|
Package processctx maintains process context (PID/PPID/UID/account/exe/cmdline) for use enriching real-time security findings. |
|
redisinfo
Package redisinfo wraps the go-redis client for the few read-only INFO calls CSM needs (memory metrics, keyspace counts).
|
Package redisinfo wraps the go-redis client for the few read-only INFO calls CSM needs (memory metrics, keyspace counts). |
|
reporting
Package reporting is the node side of CSM abuse reporting (Layer A).
|
Package reporting is the node side of CSM abuse reporting (Layer A). |
|
sdnotify
Package sdnotify is a thin wrapper around go-systemd's daemon notification helpers.
|
Package sdnotify is a thin wrapper around go-systemd's daemon notification helpers. |
|
threatintel
Package threatintel -- bot allowlist + verification.
|
Package threatintel -- bot allowlist + verification. |
|
updatecheck
Package updatecheck polls upstream release channels and tells the daemon whether a newer CSM version is available so the Web UI can surface a banner.
|
Package updatecheck polls upstream release channels and tells the daemon whether a newer CSM version is available so the Web UI can surface a banner. |
|
verdict
Package verdict implements an HMAC-signed HTTP client for the auto_response.verdict_callback hook.
|
Package verdict implements an HMAC-signed HTTP client for the auto_response.verdict_callback hook. |
|
yaraipc
Package yaraipc defines the wire protocol spoken between the CSM daemon and the supervised `csm yara-worker` child process.
|
Package yaraipc defines the wire protocol spoken between the CSM daemon and the supervised `csm yara-worker` child process. |
|
yaraworker
Package yaraworker implements the `csm yara-worker` subcommand: a child process that exists only to host the YARA-X cgo surface and reply to scan requests over a Unix socket.
|
Package yaraworker implements the `csm yara-worker` subcommand: a child process that exists only to host the YARA-X cgo surface and reply to scan requests over a Unix socket. |
Click to show internal directories.
Click to hide internal directories.