Use the application protection feature

In the Access Management panel, click the Manual Access tab. On the Host Access Guide tab, click Point-and-click Push.

In the Push RASP Agent dialog box, select the servers on which you want to install the RASP agent and click OK.

Configure the JVM parameters for the servers based on the runtime environment of the applications. You can configure the JVM parameters based on the information in the Security Center console or in the following table.

When you configure the parameters based on the following table, replace {appId} in the code with the application ID that is displayed on the Host Access Guide tab. The following figure shows the position of an application ID.

export CATALINA_OPTS="$CATALINA_OPTS -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar"

set CATALINA_OPTS=%CATALINA_OPTS% "-javaagent:C:\Program Files (x86)\Alibaba\Aegis\rasp\apps\{appId}\rasp.jar" 

--exec -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar

java -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar

java -jar app.jar

java -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar -jar app.jar

-javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar

Restart the applications that you want to add to the application protection feature on your on-premises device.

The application protection feature takes effect immediately after the applications are restarted. On the Application Configurations page, you can view the servers that are added to the application group.

In the Access Management panel, click the Manual Access tab. On the Add Container tab, click Point-and-click Push.

You can also click Push RASP Agent on the Push Record tab to push the RASP agent to the server or container on which your applications run and install the agent on the server or container.

In the Push RASP Agent dialog box, select the servers on which you want to install the RASP agent and click OK.

Start the RASP agent.

• Method 1: Add parameters to the Dockerfile.

  1. Go to the directory in which the Dockerfile resides and create a directory named rasp.

     cd <Directory of the Dockerfile>
     mkdir rasp

  2. Copy the RASP files that are pushed to the server to the rasp directory.

     You can obtain the application group ID on the Add Container tab in the Security Center console.

     cp -r /usr/local/aegis/rasp/apps/<Application group ID>/* ./rasp

  3. Modify the Dockerfile and package the downloaded installation package into the container image. Then, add the required content to the Dockerfile.

     COPY rasp /rasp/

     Important

     You must grant specific users the read and execute permissions on the /rasp/ directory and the files in the /rasp/ directory.

  4. Modify the JVM startup parameters in the Dockerfile and add javaagent:/rasp/rasp.jar to the Dockerfile.

     The following table describes the parameter settings in different runtime environments. You must replace {manager.key} in the code with the value of Dmanager.key that is displayed on the Add Container tab.

     Runtime environment	Parameter setting
     SpringBoot	To install the RASP agent when an image is being packaged, modify the startup parameters in the Dockerfile and change the startup command for your applications. Startup command before the change: CMD ["java","-jar","/app.jar"] Startup command after the change: CMD ["java","-javaagent:/rasp/rasp.jar","-Dmanager.key={manager.key}","-jar","/app.jar"]
     Tomcat	To install the RASP agent when an image is being packaged, add the following configurations to the Dockerfile: ENV JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" To install the RASP agent when the container is being started, add the following parameter to the startup command: docker --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" For example, the original startup command of a container is docker -itd --name=test -P image name. Before you start the container to install the RASP agent, you must change the startup command to docker -itd --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" --name=test -P image name.
     Weblogic

  5. Recreate an image and start the container.

• Method 2: Mount volumes to the container.

  1. When you create a container, mount the installation directory of the RASP agent of the server to the specified directory of the container.

     docker run -itd --privileged=true -v /usr/local/aegis/rasp/apps/<Application group ID>:/rasp/ Image ID

  2. Run the following command to access the container:

     docker exec -it <Container ID> /bin/bash

  3. Add the following JVM parameter to the startup script of the server to start the RASP agent:

     You must configure the parameter based on your business environment. You must replace {manager.key} with the value of Dmanager.key that is displayed on the Add Container tab.

     -javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}

In the Access Management panel, click the Manual Access tab. On the Add Container tab, select Custom Installation from the drop-down list in the Download and Install RASP Agent step.

You can also click Push RASP Agent on the Push Record tab to push the RASP agent to the server or container on which your applications run and install the agent on the server or container.

In the drop-down list, select Do Not Access Proxy or Self-managed Proxy Cluster to determine whether to add the server on which you want to install the RASP agent to the Security Center by using the proxy access feature.

If you select Self-managed Proxy Cluster, you must select a proxy cluster that you want to use to add the server to Security Center. For more information, see Add servers to Security Center by using the proxy access feature.

Click Download to the right of the installation package of the RASP agent to download the package.

Start the RASP agent.

• Method 1: Add parameters to the Dockerfile.

  1. Go to the directory of the Dockerfile.

     cd <Directory of the Dockerfile>

  2. Upload the downloaded installation package of the RASP agent to the directory of the Dockerfile. Then, decompress the package to the directory.

     unzip <Name of the installation package> -d .

     Note

     After the installation package is decompressed, a directory named rasp is generated.

  3. Modify the Dockerfile and package the downloaded installation package into the container image. Then, add the required content to the Dockerfile.

     COPY rasp /rasp/

     Important

     You must grant specific users the read and execute permissions on the /rasp/ directory and the files in the /rasp/ directory.

  4. Modify the JVM startup parameters in the Dockerfile and add javaagent:/rasp/rasp.jar to the Dockerfile.

     The following table describes the parameter settings in different runtime environments. You must replace {manager.key} in the code with the value of Dmanager.key that is displayed on the Add Container tab.

     Runtime environment	Parameter setting
     SpringBoot	To install the RASP agent when an image is being packaged, modify the startup parameters in the Dockerfile and change the startup command for your applications. Startup command before the change: CMD ["java","-jar","/app.jar"] Startup command after the change: CMD ["java","-javaagent:/rasp/rasp.jar","-Dmanager.key={manager.key}","-jar","/app.jar"]
     Tomcat	To install the RASP agent when an image is being packaged, add the following configurations to the Dockerfile: ENV JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" To install the RASP agent when the container is being started, add the following parameter to the startup command: docker --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" For example, the original startup command of a container is docker -itd --name=test -P image name. Before you start the container to install the RASP agent, you must change the startup command to docker -itd --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" --name=test -P image name.
     Weblogic

  5. Recreate an image and start the container.

• Method 2: Mount volumes to the container.

  1. Upload the downloaded installation package of the RASP agent to the specified directory on the server and decompress the package.

     You must replace user.path with the directory that you use.

     unzip  zhh-php1-China.zip -d /<user.path>/

  2. When you create a container, mount the installation directory of the RASP agent of the server to the specified directory of the container.

     docker run -itd  -v /<user.path>/rasp:/rasp/ Image ID 

  3. Run the following command to access the container:

     docker exec -it <Container ID> /bin/bash

  4. Add the following JVM parameter to the startup script of the server to start the RASP agent:

     You must configure the parameter based on your business environment. You must replace {manager.key} with the value of Dmanager.key that is displayed on the Add Container tab.

     -javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}

In the Manual Access tab, under the Host Access Guide sub-tab, select PHP Version and Quick Push and Installation, and click Point-and-click Push.

In the Push RASP Agent dialog box, select the servers on which you want to install the RASP agent, and click Confirm.

In the Push Record sub-tab, wait for the corresponding server status to change to Pushed.

On the Host Access Guide sub-tab, refer to the console or the following steps to modify the php.ini configuration file in the servers based on the runtime environment of the application.

1. Execute the following command to open the php.ini file.

   Note

   • The editor used in the current step is nano.

   • The php.ini file is usually located in /etc/php/7.0/fpm/php.ini or /etc/php/7.0/apache2/php.ini. Please modify the path in the following command based on your specific environment.

   sudo nano /etc/php/7.0/fpm/php.ini

   or

   sudo nano /etc/php/7.0/apache2/php.ini

2. Add the following content at the end of the php.ini file or under the appropriate [Extensions] section.

   You need to use the application ID displayed on the Host Access Guide tab in the console to replace {appId} in the table below. The location of the application ID is shown in the following figure:

   

   [alirasp]
   extension=/usr/local/aegis/rasp/apps/{appId}/php-7.0/alirasp.so
   alirasp.root_dir=/usr/local/aegis/rasp/apps/{appId}/php-7.0

3. Save and close the php.ini file.

   If you are using the nano editor, you can save by pressing Ctrl + X, then press Y to confirm saving, and press Enter to exit.

Restart your application. After the restart, the RASP agent can take effect immediately.

• Nginx server restart command

  sudo systemctl restart nginx

• Apache server restart command

   sudo systemctl restart apache2

  or

  sudo systemctl restart httpd

In the Manual Access tab, under the Host Access Guide sub-tab, select PHP Version and Custom Installation, and click Download on the right side of the RASP installation package.

Upload the downloaded RASP installation package to the server and execute the following command to unzip the installation package.

user.path is the storage path of the RASP installation package on the server.

unzip <Installation package name> -d <user.path>

Refer to the console or the following steps to modify the php.ini configuration file in the server based on the application runtime environment.

1. Execute the following command to open the php.ini file.

   Note

   • The editor currently in use is nano.

   • The php.ini file is typically found at /etc/php/7.0/fpm/php.ini or /etc/php/7.0/apache2/php.ini. You should modify the path in the subsequent command to suit your particular environment.

   sudo nano /etc/php/7.0/fpm/php.ini

   or

   sudo nano /etc/php/7.0/apache2/php.ini

2. Add the following content to the end of the php.ini file, or under the appropriate [Extensions] section.

   Substitute <user.path> in the code below with the path to the directory where the installation package has been extracted.

   [alirasp]
   extension=<user.path>/alirasp.so
   alirasp.root_dir=<user.path>

   Note

   Ensure that the extracted directory, its parent directory, and all contained files have read and execute permissions for the PHP worker start user.

3. Save and close the php.ini file.

   When using the nano editor, save your changes by pressing Ctrl + X, confirm with Y, and press Enter to exit.

Restart your application. After the restart, the RASP agent can take effect immediately.

• Nginx server restart command

  sudo systemctl restart nginx

• Apache server restart command

   sudo systemctl restart apache2

  or

  sudo systemctl restart httpd

On the Manual Access tab, under the Add Container sub-tab, select the PHP Version and Quick Push and Installation, then click Point-and-click Push.

In the Push RASP Agent dialog box, select the servers on which you want to install the RASP agent and click OK.

In the Push Record sub-tab, wait until the server status updates to Pushed.

On the Add Container sub-tab, follow the console instructions or the steps below to install the agent:

• Method 1: Add parameters to the Dockerfile.

  1. Navigate to the directory containing the Dockerfile and create a rasp directory with the following command:

     cd <Directory where Dockerfile is located>
     mkdir rasp

  2. Execute the following command to copy the RASP files that have been pushed to the server into the newly created rasp directory.

     You can find the application group ID from the Add Container tab in the Security Center console.

     cp -r /usr/local/aegis/rasp/apps/<Application Group ID>/php-7.0/* ./rasp

  3. Add the following content to the Dockerfile to include the RASP installation package in the container image:

     COPY rasp /rasp/

     Note

     Ensure the specified user has read and execute permissions for the /rasp/ directory and its files.

  4. In the Dockerfile, update the PHP php.ini configuration to include the RASP extension, as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  5. Rebuild the image and launch the container.

• Method 2: Mount volumes to the container.

  1. When creating the container, mount the rasp directory from the server to the specified directory in the container using the command below:

     docker run -itd --privileged=true -v /usr/local/aegis/rasp/apps/<Application Group ID>/php-7.0:/rasp/ image ID

  2. In the Dockerfile, update the PHP php.ini configuration to include the RASP extension, as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  3. Rebuild the image and start the container.

On the Manual Access tab, under the Add Container sub-tab, select the PHP Version and Custom Installation, click Download on the right side of the RASP installation package.

In the Add Container section, follow the console instructions or the steps below to install the agent based on your application runtime environment.

• Method 1: Add parameters to the Dockerfile.

  1. Navigate to the directory containing the Dockerfile.

     cd <directory where Dockerfile is located>

  2. Upload the RASP installation package to the same directory and extract it using the command below.

     unzip <installation package name> -d.

     Note

     Extracting the package will create a directory named 'rasp'.

  3. Add the following content to your Dockerfile to include the RASP installation package in the container image:

     COPY rasp /rasp/

     Note

     Assign read and execute permissions to the specified user for the /rasp/ directory and its files.

  4. Update the php.ini configuration in the Dockerfile and include the RASP extension as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  5. Rebuild the image and launch the container.

• Method 2: Mount volumes to the container.

  1. Upload the RASP installation package to the server and unzip it using the command below.

     The 'user.path' represents the storage path for the RASP installation package.

     unzip <installation package name> -d <user.path>

  2. When creating the container, mount rasp directory of the server to the designated directory within the container using the following command:

     docker run -itd  -v /{user.path}/rasp:/rasp/ image ID

  3. Modify the php.ini configuration in the Dockerfile to add the RASP extension as below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  4. Rebuild the image and start the container.