toxichome-whoami/binary_alive

Purpose and Deployment Model

Secure Binary Alive System is a PHP 7.4+ / SQLite control plane for keeping Linux executables alive on cPanel/WHM hosts. It manages arbitrary binaries (bots, Node applications, compiled programs), exposes browser and token APIs, and relies on a host cron invocation rather than a persistent PHP daemon.

Core deployment/security boundaries are Apache access rules in .htaccess, db/.htaccess, includes/.htaccess, and components/.htaccess; cron must execute cron.php once per minute.

Web Application Entry Points

index.php is the dashboard and likely primary process-management surface. Authentication lifecycle is handled through login.php, logout.php, and initial TOTP enrollment in setup_2fa.php.

Administrative pages include settings.php for system/security configuration, users.php for role-managed accounts, logs.php for audit-log viewing, and terminal.php for the admin browser shell. Shared UI composition is centralized in components/header.php, components/navbar.php, and components/footer.php.

Process Supervision Stage

cron.php is the autonomous supervision entry point. Each minute it evaluates configured monitored processes, detects stopped binaries or reboot-related loss, and restarts them. This is the critical boundary between the PHP application and operating-system process execution.

Interactive UI management and remote control can initiate start, stop, restart, creation, editing, deletion, and grouping of monitored processes; cron converges actual process state with the stored desired configuration.

Persistence and Configuration

SQLite access and schema/runtime persistence are centralized in includes/database.php, with the database protected beneath db/. Persistent records support users/roles, process definitions, audit events, API tokens, and application state.

config.json supplies deployment-level settings, notably IP allowlisting. This file is intentionally web-blocked by root .htaccess; it is a filesystem configuration boundary rather than an API-facing resource.

Identity, Authorization, and Security

includes/auth.php implements session authentication and RBAC, including the permanent first-account Master Admin hierarchy. Admin privileges gate sensitive operations such as account administration and terminal access.

includes/security.php provides request/security controls such as IP restrictions and headers. CAPTCHA is a separate challenge/check flow in captcha.php and captcha_check.php. TOTP/2FA behavior is supported by includes/totp_helper.php and exposed through setup_2fa.php.

API and External Control Boundary

api.php is the machine-facing entry point for remote process monitoring and control using API tokens. Its contract is documented in API.md. API actions share the same persistence, authorization/token validation, process-control, and audit pathways as browser actions.

There are no required external application services: runtime dependencies are PHP, SQLite, Apache/cPanel, Linux shell/process facilities, and cPanel cron.

Auditability and Shell Access

includes/logger.php records security- and operations-relevant events: authentication attempts, process lifecycle actions, terminal commands, and API key generation. logs.php exposes paginated audit history.

terminal.php is a high-risk administrative boundary: it runs server shell commands with a session-persistent working directory, command history, and a 30-second timeout guard. It must remain constrained by admin RBAC and audited through the logging layer.