Runs monit as non-root user

Question

I'm using Monit to monitor my nodejs process. Right now monit itself runs as the root user which may lead to security holes. How could I run monit via the 'monit' user?

I installed monit by using apt-get install monit. So at the moment, it starts at system start up.

I just want accomplish the rule that all services that listen on port must be run as a non-root user.

I've found a vulnerability that makes me prefer not to run monit as root. Or at least disable access via http interface.

Answer 1

I'm not convinced that it's an issue having monit run as root so long as access to it is limited correctly. Looking at the config file, /etc/monit/monitrc I noticed this section to the file:

## Monit has an embedded web server which can be used to view status of 
## services monitored and manage services from a web interface. See the
## Monit Wiki if you want to enable SSL for the web server. 
#
# set httpd port 2812 and
#    use address localhost  # only accept connection from localhost
#    allow localhost        # allow localhost to connect to the server and
#    allow admin:monit      # require user 'admin' with password 'monit'
#    allow @monit           # allow users of group 'monit' to connect (rw)
#    allow @users readonly  # allow users of group 'users' to connect readonly
#

You could simply only allow access to the HTTP server by only allowing access to it via localhost. This will completely wall monit off so that only access to it is allowed locally. You can then setup SSH tunnels if you need to access it later on using ssh -R 8080:monitserver:80 monitserver for example.