Security Center:Access application protection

On the Manual Access tab, under the Host Access Guide section, click the Point-and-click Push option.

In the Push RASP Agent dialog box, select the server where the agent will be deployed, and click Confirm.

Refer to the console or the following table to add JVM parameters to the application server based on the application runtime environment type.

When following the instructions in the table below, replace the {appId} with your application ID, which can be found on the Host Access Guide tab within the console, as illustrated in the figure below.

export CATALINA_OPTS="$CATALINA_OPTS -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar"

set CATALINA_OPTS=%CATALINA_OPTS% "-javaagent:C:\Program Files (x86)\Alibaba\Aegis\rasp\apps\{appId}\rasp.jar" 

--exec -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar

java -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar

java -jar app.jar

java -javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar -jar app.jar

-javaagent:/usr/local/aegis/rasp/apps/{appId}/rasp.jar

Restart the applications to be added locally.

Once the application restarts, RASP protection becomes immediately active. You can view the Access Instances list within the application group on the Application Configuration page.

On the Manual Access tab, under the Container Access Guide sub-tab, click Point-and-click Push.

You can click the Push Record tab and then select Push RASP Agent to initiate the installation of the RASP agent on the host or container where the application resides.

In the Push RASP Agent dialog box, select the server where the agent will be deployed, and click Confirm.

Start the RASP agent.

• Method 1: Write to Dockerfile

  1. Run the following command to go to the directory where the Dockerfile is located and create a rasp directory.

     cd <Dockerfile所在目录>
     mkdir rasp

  2. Run the following command to copy the RASP files pushed to the server to the newly created rasp directory.

     You can retrieve the application group ID value from the Container Access Guide tab within the Security Center console.

     cp -r /usr/local/aegis/rasp/apps/<应用分组ID>/* ./rasp

  3. Modify the Dockerfile to package the downloaded rasp installation package into the container image. The Dockerfile needs to add the following content.

     COPY rasp /rasp/

     Important

     You need to grant specific users read and execute permissions on the /rasp/ directory and the files in the directory.

  4. Modify the JVM startup parameters in the Dockerfile and add -javaagent:/rasp/rasp.jar.

     You need to substitute the {manager.key} in the table below with the Dmanager.key value shown on the Container Access Guide tab.

     Runtime Environment	Parameter Configuration Description
     SpringBoot	When packaging the image, install the RASP agent, and modify the startup parameters in the Dockerfile. The startup command for the application is modified as follows: Before modification: CMD ["java","-jar","/app.jar"] After modification: CMD ["java","-javaagent:/rasp/rasp.jar","-Dmanager.key={manager.key}","-jar","/app.jar"]
     Tomcat	When packaging the image, install the RASP agent, and add the following content to the Dockerfile. ENV JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" When starting the container, install the RASP agent, and add the following parameters at startup. docker --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" For example, if your container startup command is docker -itd --name=test -P image_name, you need to modify the command to install the RASP agent when starting the container to docker -itd --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" --name=test -P image_name.
     Weblogic

  5. Recreate the image and start the container.

• Method 2: Data volume mount

  1. Run the following command to mount the rasp directory on the server to the specified directory of the container when creating the container.

     docker run -itd --privileged=true -v /usr/local/aegis/rasp/apps/<应用分组ID>:/rasp/ image_id

  2. Run the following command to access the container.

     docker exec -it <container_id> /bin/bash

  3. Add the following JVM parameters to the startup script of the application server to start the RASP agent.

     You must configure certain parameters to suit your business environment. Replace {manager.key} with the Dmanager.key value found on the Container Access Guide tab.

     -javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}

On the Manual Access tab, within the Container Access Guide section, choose Custom Download And Installation from the dropdown menu under the Download And Install RASP Agent category.

You can click the Push Record tab and then select Push RASP Agent to deploy and install the RASP agent on the host or container where the application resides.

In the drop-down list, select No Proxy Access or Self-built Proxy Cluster, depending on whether the server that requires the RASP agent installation accesses the Security Center via a proxy.

After choosing Self-built Proxy Cluster, select the server's proxy cluster for access. For details on proxy access, see Proxy Access.

Click Download to the right of the RASP installation package to retrieve the necessary files.

Start the RASP agent.

• Method 1: Write to Dockerfile

  1. Run the following command to go to the directory where the Dockerfile is located.

     cd <Dockerfile所在目录>

  2. Upload the downloaded RASP installation package to the directory where the Dockerfile is located, and unzip the RASP installation package to that directory.

     unzip <安装包名称> -d .

     Note

     After the installation package is decompressed, a directory named rasp is generated.

  3. Modify the Dockerfile to package the downloaded rasp installation package into the container image. The Dockerfile needs to add the following content.

     COPY rasp /rasp/

     Important

     You need to grant specific users read and execute permissions on the /rasp/ directory and the files in the directory.

  4. Modify the JVM startup parameters in the Dockerfile and add -javaagent:/rasp/rasp.jar.

     You need to substitute the {manager.key} in the table below with the Dmanager.key value shown on the Container Access Guide tab.

     Runtime Environment	Parameter Configuration Description
     SpringBoot	When packaging the image, install the RASP agent, and modify the startup parameters in the Dockerfile. The startup command for the application is modified as follows: Before modification: CMD ["java","-jar","/app.jar"] After modification: CMD ["java","-javaagent:/rasp/rasp.jar","-Dmanager.key={manager.key}","-jar","/app.jar"]
     Tomcat	When packaging the image, install the RASP agent, and add the following content to the Dockerfile. ENV JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" When starting the container, install the RASP agent, and add the following parameters at startup. docker --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" For example, if your container startup command is docker -itd --name=test -P image_name, you need to modify the command to install the RASP agent when starting the container to docker -itd --env JAVA_OPTS="-javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}" --name=test -P image_name.
     Weblogic

  5. Recreate the image and start the container.

• Method 2: Data volume mount

  1. Upload the downloaded RASP installation package to the specified directory on the server, and perform the decompression operation.

     Replace user.path with the correct path based on your specific environment.

     unzip  zhh-php1-China.zip -d /<user.path>/

  2. Run the following command to mount the rasp directory on the server to the specified directory of the container when creating the container.

     docker run -itd  -v /<user.path>/rasp:/rasp/ image_id 

  3. Run the following command to access the container.

     docker exec -it <container_id> /bin/bash

  4. Add the following JVM parameters to the startup script of the application server to start the RASP agent.

     You must configure certain parameters to suit your business environment. Replace {manager.key} with the Dmanager.key value found on the Container Access Guide tab.

     -javaagent:/rasp/rasp.jar -Dmanager.key={manager.key}

On the Manual Access tab, under the Host Access Guide sub-tab, select your application's PHP Version and the Quick Push and Installation option, then click Point-and-click Push.

In the Push RASP Agent dialog box, select the server where the agent will be deployed, and click Confirm.

In the Push Record sub-tab, wait for the corresponding server's status to change to Pushed.

On the Host Access Guide sub-tab, consult the console or follow the steps below to update the php.ini configuration file on the application server, according to the type of application runtime environment.

1. Execute the command below to open the php.ini file.

   Note

   • The editor used here is nano.

   • The php.ini file is typically found at /etc/php/7.0/fpm/php.ini or /etc/php/7.0/apache2/php.ini. Modify the path in the subsequent command to suit your particular environment.

   sudo nano /etc/php/7.0/fpm/php.ini

   or

   sudo nano /etc/php/7.0/apache2/php.ini

2. Add the content below to the end of the php.ini file, or place it within the relevant [Extensions] section.

   You need to replace the {appId} in the table below with the application ID found on the Host Access Guide tab within the console, as indicated in the figure that follows.

   

   [alirasp]
   extension=/usr/local/aegis/rasp/apps/{appId}/php-7.0/alirasp.so
   alirasp.root_dir=/usr/local/aegis/rasp/apps/{appId}/php-7.0

3. Save the php.ini file and close it.

   If you are using the nano editor, save your work by pressing Ctrl + X, then press Y to confirm the save, and press Enter to exit.

Restart your application for the RASP to take effect immediately.

• Nginx service restart command

  sudo systemctl restart nginx

• Apache service restart command

   sudo systemctl restart apache2

  or

   systemctl restart httpd

On the Manual Access tab, under the Host Access Guide section, select your application's PHP Version and the Custom Installation options. Then, click Download on the right to obtain the RASP installation package.

Upload the RASP installation package to the server and unzip it using the command below.

The user.path is where the RASP installation package is stored on the server.

unzip <安装包名称> -d <user.path>

Refer to the console or use the steps below to update the php.ini configuration file on the application server, depending on the type of application runtime environment.

1. Execute the command below to open the php.ini file.

   Note

   • The editor used here is nano.

   • The php.ini file is typically found at /etc/php/7.0/fpm/php.ini or /etc/php/7.0/apache2/php.ini. Modify the path in the subsequent command to suit your particular environment.

   sudo nano /etc/php/7.0/fpm/php.ini

   or

   sudo nano /etc/php/7.0/apache2/php.ini

2. Add the following content to the end of the php.ini file, or include it in the relevant [Extensions] section.

   Replace <user.path> with the directory where the installation package was unzipped.

   [alirasp]
   extension=<user.path>/alirasp.so
   alirasp.root_dir=<user.path>

   Note

   Verify that the PHP worker startup user has read and enter permissions for both the decompressed directory, its parent directory, and the files contained within.

3. Save and close the php.ini file.

   If you are using the nano editor, you can save your work by pressing Ctrl + X, then Y to confirm the save, and press Enter to exit.

Restart your application for the RASP to take effect immediately.

• Nginx service restart command

  sudo systemctl restart nginx

• Apache service restart command

   sudo systemctl restart apache2

  or

   systemctl restart httpd

On the Manual Access tab, within the Container Access Guide section, select your application's PHP Version and the Quick Push and Installation option. Then, click Point-and-click Push.

In the Push RASP Agent dialog box, select the server where the agent will be deployed, and click Confirm.

In the Push Record sub-tab, wait for the corresponding server's status to change to Pushed.

On the Container Access Guide sub-tab, follow the console instructions or the steps below to deploy the agent.

• Method 1: Write to Dockerfile

  1. Navigate to the directory containing the Dockerfile and create a rasp directory with the command below.

     cd <Dockerfile所在目录>
     mkdir rasp

  2. Copy the RASP files pushed to the server into the rasp directory using the command below.

     You can retrieve the application group ID value from the Container Access Guide tab in the Security Center console.

     cp -r /usr/local/aegis/rasp/apps/<application group ID>/php-7.0/* ./rasp

  3. Modify the Dockerfile to include the rasp installation package in the container image. Add the following content to the Dockerfile.

     COPY rasp /rasp/

     Note

     You need to grant specific users read and execute permissions for the /rasp/ directory and its files.

  4. Update the PHP php.ini configuration within the Dockerfile to include the RASP extension, as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  5. Rebuild the image and start the container.

• Method 2: Data Volume Mount

  1. When creating the container, mount the rasp directory from the server to the specified directory in the container using the command below.

     docker run -itd --privileged=true -v /usr/local/aegis/rasp/apps/<application group ID>/php-7.0:/rasp/ image ID

  2. Within the Dockerfile, update the PHP php.ini configuration to include the RASP extension, as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  3. Rebuild the image and start the container.

On the Manual Access tab, under the Container Access Guide sub-tab, select your application's PHP Version and Custom Installation options. Then click Download on the right to retrieve the RASP installation package.

On the Container Access Guide sub-tab, consult the console or follow the steps below to deploy the agent according to the type of application runtime environment.

• Method 1: Write to Dockerfile

  1. Navigate to the directory containing the Dockerfile.

     cd <Dockerfile所在目录>

  2. Upload the RASP installation package to the Dockerfile directory and unzip it there using the command below.

     unzip <installation package name> -d.

     Note

     Once the installation package has been decompressed, a directory called rasp will be created.

  3. Modify the Dockerfile to include the rasp installation package in the container image. Add the following content to the Dockerfile.

     COPY rasp /rasp/

     Note

     You must grant specific users read and execute permissions for the /rasp/ directory and its files.

  4. Within the Dockerfile, update the PHP php.ini configuration to include the RASP extension, as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  5. Rebuild the image and start the container.

• Method 2: Data Volume Mount

  1. Upload the RASP installation package to the server and unzip it using the command below.

     The user.path is the storage path for the RASP installation package on the server.

     unzip <installation package name> -d <user.path>

  2. When creating the container, mount the rasp directory from the server to the specified directory in the container using the command below.

     docker run -itd  -v /{user.path}/rasp:/rasp/ image ID

  3. Within the Dockerfile, update the PHP php.ini configuration to include the RASP extension, as shown below:

     [alirasp]
     extension=/rasp/alirasp.so
     alirasp.root_dir=/rasp

  4. Rebuild the image and start the container.