Updates and removal

Automatic updatesCopy Anchor Link

On servers, shellz checks for a new release about every 6 hours (with some random delay, so a fleet doesn't update all at once), and five minutes after the recorder starts.

Each update:

1. Is verified. The release manifest must be signed by the shellz release key pinned in the agent, and the download must match the signed SHA-256 hash and size.
2. Only moves forward. shellz refuses any version older than, or equal to, the newest one it has run, and any version that already failed on this server.
3. Is tested before it's used. The new binary runs a self-test before it replaces the old one, which is kept as a backup.
4. Doesn't interrupt sessions. The recorder switches to the new version once no recorded session is running, so an update never ends a session.
5. Rolls back on failure. If the new version doesn't start and report healthy within 2 minutes, or fails to start 3 times, the previous version is restored and an update-rolled-back alert is raised.

To check or update by hand:

sudo /usr/local/bin/shellz update --check   # show whether an update is available
sudo /usr/local/bin/shellz update           # install it now

ContainersCopy Anchor Link

Containers run the version that's in their image. To update, rebuild the image, which picks up the latest release with get.shellz.dev/container, or update the version and checksum in your ADD line.

Removing shellzCopy Anchor Link

shellz can't be removed from a server without your org's approval. This stops someone with root access from quietly removing it.

1. Approve the removal. An owner or admin removes the server from your org, after confirming it's them. The server receives a signed policy that allows removal, on its next heartbeat. In Perfect Secrecy mode, the policy is signed in their browser.

2. Uninstall on the server:

   Copy Text

   sudo /usr/local/bin/shellz uninstall

3. shellz finishes any running sessions and uploads what's left in its spool (waiting at most 10 minutes), then:

   • restores every account's original login shell;
   • removes the SSH drop-in, the recorder unit, the SELinux module, the session shell, the binary and /etc/shellz and /var/lib/shellz;
   • on Docker hosts, gives the Docker socket back to Docker (see Docker host);
   • reports uninstalled to your org.

Recordings already uploaded stay in your org, under the retention lock.

If you run shellz uninstall without an approved removal, it's refused, nothing is changed, and an uninstall-refused alert names the account that tried.

FleetsCopy Anchor Link

To stop recording a container workload, deploy it without the shellz entrypoint, then revoke or delete the fleet on its page.