httpd socket is not created

[SzV]

Hello! I've just realized all users may "remote control" monit thus the whole server through the open by default HTTP port.

When switching to a unix socket monit does not create it

set httpd unixsocket /run/monit.sock

Message: error : Unix socket /run/monit.sock error -- No such file or directory

I must manually issue: mkfifo --mode=0600 /run/monit.sock

Please advise. Would it be possible to automatically do it?

[Tildeslash]

The unix socket is created automatically, but the "set httpd" statement always requires at least one "allow" option.

If it is missing (like in the reported configuration), the following error is displayed, the http interface is not started and the socket is not created:

monit: monit httpd not started since no connect allowed

[SzV]

Thanks.

Could you please tell me what should i set in "allow" when I am using a unix socket?

[SzV]

...and I'd like to avoid local access. For me HTTP auth is not really a protection, I'd like to keep the HTTP port closed. Is there a solution for unix socket-only?

[SzV]

https://mmonit.com/monit/documentation/monit.html#MONIT-HTTPD

 set httpd unixsocket /var/run/monit.sock
     allow username:password

Is there such a thing as socket authentication? I thought it is based on permissions of the socket file.

[Tildeslash]

Yes, the authentication is required for unix socket too - monit enforces the authentication at application level

[SzV]

Thank you.

So I have to set 0600 on monit config to hide username/pwd.

[Tildeslash]

Yes, monit also enforces 0600 on its config file for the same reason (otherwise it won't start)