Protect Overview and Installation

Protect is our optional but highly recommended PHP RASP integration. This integrates with the PHP runtime at the lowest level to monitor and block malicious activity.

For example, if a file is being written to the filesystem via PHP, such as a Wordpress Upload, our Protect RASP can analyse and block malicious activity.

Preparation

To install any Monarx package, add the Monarx repository to your package manager:

CentOS / RHEL / CloudLinux / Alma / Rocky

curl -fsS https://repository.monarx.com/repository/monarx-yum/monarx.repo | sudo tee /etc/yum.repos.d/monarx.repo

sudo rpm --import https://repository.monarx.com/repository/monarx/publickey/monarxpub.gpg

Ubuntu

curl -fsS https://repository.monarx.com/repository/monarx/publickey/monarxpub.gpg | sudo tee /etc/apt/trusted.gpg.d/monarx.asc

echo "deb [arch=amd64] https://repository.monarx.com/repository/ubuntu-$(lsb_release -sc)/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/monarx.list

Debian

sudo apt-key adv --keyserver "keyserver.ubuntu.com" --recv-keys "4E240071023138C8"

echo "deb [arch=amd64] https://repository.monarx.com/repository/debian-$(lsb_release -sc)/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/monarx.list

Standard Installation

For standard apache, litespeed, cPanel, Plesk style environments, the php extension can be automatically installed with:

Yum (CentOS / RHEL / CloudLinux / Alma / Rocky)

sudo yum install monarx-protect-autodetect

Apt (Ubuntu / Debian)

sudo apt-get install monarx-protect-autodetect

The monarx-protect-autodetect package pulls in the monarx-agent and monarx-protect packages as dependencies. It configures Protect to be loaded as a PHP extension for common configurations of PHP, although you may need to restart your web servers for the changes to take effect.

Custom Installation

For bespoke webserver configurations, the Monarx Protect PHP extension can be installed as a familiar PHP extension.

Install the monarx-protect package with your preferred package manager:

Yum (CentOS / RHEL / CloudLinux / Alma / Rocky)

sudo yum install monarx-protect

Apt (Ubuntu / Debian)

sudo apt-get install monarx-protect

This makes the Monarx PHP .so extension available on the system:

$ repoquery -l monarx-protect
/usr/lib64/monarx-protect/monarxprotect-php53.so
/usr/lib64/monarx-protect/monarxprotect-php54.so
/usr/lib64/monarx-protect/monarxprotect-php55.so
[...]
/usr/lib64/monarx-protect/monarxprotect-php82.so
/usr/lib64/monarx-protect/monarxprotect-php83.so
/usr/lib64/monarx-protect/monarxprotect-php84.so

You can copy/link the .so extension to your PHP extension directories (e.g. php --ini | grep extension_dir).

You can enable the extension with standard e.g. extension=monarxprotect-php84.so in a .ini file in their your PHP config directory (e.g. php --ini | grep additional).

Installation Verification

You can verify that the Protect module is loaded and running via php -m | grep monarxprotect.

Alternatively navigate to the Agents module in the Monarx web app, select the Agent then select Extensions where loaded and active PHP modules will be displayed: