monit console commands do not work with readonly privileges on UI

[Harivardhan Pyaram]

If we restrict access to the Monit webserver with one readonly user and one md5 encrypted superuser, the console commands like monit summary or even monit stop and start fail.

Basically, until unless there is at least one user password in cleartext with full privileges in the control file, monit can not be used through the console.

[Harivardhan Pyaram]

monit is being run as root and the file permissions are rw for root.

[Tildeslash]

The monit command line communicates with monit daemon via the HTTP interface, which uses BasicAuthentication to protect it (we recommend to enable SSL to protect the credentials). When you execute monit CLI command, it reads the monit configuration file (same way as if you start monit) and gets monit credentials from it. If the configuration file has only non-cleartext credentials for admin access, then the CLI cannot read the password and cannot authenticate.

This limitation is documented in monit manual (https://mmonit.com/monit/documentation/monit.html#Authentication):

If the Monit command line interface is being used, at least one cleartext password is necessary (see bellow), otherwise the Monit command line
interface will not be able to connect to the Monit web interface.

If there is read-only cleartext password, actions which require admin privileges like start/stop/restart/monitor/unmonitor cannot be performed. We may allow "status" and "summary" though.

Alternatively SSL client certificate authentication can be used in the next monit version (work in progress) - it will allow to replace BasicAuthentication with client certificate, no cleartext password will be needed.

[Harivardhan Pyaram]

Would'nt it be easier for monit to use the md5 user profile specified in the control file just like it does for the Web UI?? I mean if it doesn't find a cleartext password with full privileges, it should use the profile with full privileges. Or if there's a way to give username and passwords through monit console commands to different profiles it would be better. It would give two different user experiences just like in the UI.

[Harivardhan Pyaram]

@tildeslash: any plans to implement this enhancement??

[Tildeslash]

Removing version: 5.14 (automated comment)