I'm not convinced that it's an issue having monit
run as root so long as access to it is limited correctly. Looking at the config file, /etc/monit/monitrc
I noticed this section to the file:
## Monit has an embedded web server which can be used to view status of
## services monitored and manage services from a web interface. See the
## Monit Wiki if you want to enable SSL for the web server.
#
# set httpd port 2812 and
# use address localhost # only accept connection from localhost
# allow localhost # allow localhost to connect to the server and
# allow admin:monit # require user 'admin' with password 'monit'
# allow @monit # allow users of group 'monit' to connect (rw)
# allow @users readonly # allow users of group 'users' to connect readonly
#
You could simply only allow access to the HTTP server by only allowing access to it via localhost. This will completely wall monit
off so that only access to it is allowed locally. You can then setup SSH tunnels if you need to access it later on using ssh -R 8080:monitserver:80 monitserver
for example.