SecureAnyCloud
Deployment guide

MONARC

Overview

MONARC (Optimised Risk Analysis Method) is an open source risk assessment and governance, risk and compliance platform built by CASES and the Luxembourg House of Cybersecurity. It implements a repeatable ISO 27005 method built on capitalisation: instead of starting every analysis from a blank page, MONARC reuses risk models built for comparable contexts.

This SecureAnyCloud image ships MONARC v2.14.1 exactly as its authors released it, on Ubuntu 24.04 LTS with Apache 2.4, PHP 8.3 and MariaDB, all from the Ubuntu noble archive. A risk register holds sensitive material, so the image has no default administrator login: it contains no application account and no database password. A unique administrator password and a unique database password are generated on the first boot of every virtual machine, and Apache does not serve until that has completed.

What you get:

  • MONARC v2.14.1 from the upstream release tarball, installed at /var/lib/monarc/fo
  • The bundled CASES knowledge base, already loaded: 42 asset types, 30 threats and 706 vulnerabilities available for modelling, together with the referentials MONARC ships
  • Apache 2.4 with mod_php, serving /var/lib/monarc/fo/public
  • PHP 8.3 with the mysql, zip, gd, mbstring, curl, xml, bcmath, intl and imagick extensions
  • MariaDB with the monarc_common (CASES knowledge base) and monarc_cli (your analyses) databases, bound to the loopback interface only
  • monarc-firstboot.service, which generates this machine's administrator and database passwords before Apache serves
  • A /healthz endpoint that checks PHP and the database, not merely that the web server is listening
  • Apache, MariaDB and the first-boot service enabled and starting on boot
  • 24/7 SecureAnyCloud support

SecureAnyCloud is not affiliated with CIRCL, CASES Luxembourg or the MONARC project. MONARC is licensed under the GNU Affero General Public License v3.0 and is shipped here unmodified.

Prerequisites

  • An active Azure subscription, an SSH key, and a VNet with a subnet.
  • Standard_B2s (2 vCPU, 4 GB RAM) is a comfortable size for a small to mid-sized risk programme. Move to a larger burstable or D-series size if many analysts work concurrently.
  • On the network security group, open port 80 (and 443 once you add TLS) and port 22 for SSH. Restrict the source ranges to trusted addresses: a risk register should never be published to the whole internet.

Step 1 to 3: Deploy and connect

Create the VM from the SecureAnyCloud MONARC image. Choose your VNet, subnet, network security group and SSH public key. The admin username is azureuser.

When the VM is running, connect over SSH:

ssh azureuser@<your-vm-public-ip>
4

Verify the services

MONARC runs as three units: Apache serves the application, MariaDB holds the data, and a one-shot first-boot service provisioned this machine's credentials. Confirm that all three are active and that the health endpoint answers:

sudo systemctl is-active apache2 mariadb monarc-firstboot.service curl -s http://127.0.0.1/healthz

Expected output:

active active active ok

/healthz is deliberately not a static file. It executes PHP, reads the configuration written at first boot, and opens a real database connection with this machine's own credentials. An ok response therefore means the whole stack is serving, not merely listening.

5

Retrieve your per-instance credentials

The image ships with no MONARC account. On this machine's first boot, a unique administrator password and a unique database password were generated and written to a root-only file. Read it with sudo:

sudo cat /root/monarc-credentials.txt

The file is mode 0600, owned by root, and lists the web address, the administrator sign-in and the database credentials. These values were generated on this virtual machine and exist only here. SecureAnyCloud does not hold them.

6

Sign in to MONARC

Browse to http://<your-vm-public-ip>/. Sign in with the username and password from the credentials file.

After your first sign-in, change the administrator password from the user menu at the top right.

7

Create your first risk analysis

MONARC organises work as analyses. From the home screen, choose Create a risk analysis, give it a name and pick a language. Then base it on one of the bundled models. The CASES model brings in the full knowledge base of assets, threats and vulnerabilities, while the blank model starts empty.

Open the analysis and build the scope by dragging objects from the Assets library on the left into the analysis tree, such as a building, a business database or administrator workstations. MONARC generates the applicable information risks for each asset from its asset-threat-vulnerability links and lists them under Information risks.

Set the impact for each asset, then the threat probability and vulnerability level for each risk. MONARC computes and colours the resulting risk levels.

8

Work through the ISO 27005 method

Follow the numbered steps across the top of the analysis. They map to the MONARC method: establish the context, model the assets, assess and treat the risks, then implement and monitor the treatment plan. Each step names the deliverable it produces, so the tool doubles as a checklist for the method itself.

Security posture

No default login. Upstream MONARC documents an initial account of admin@admin.localhost with the password admin, and upstream's own virtual machine build ships with it live. This image does not. The image contains no user row and no database password. The account is created on your machine's first boot with a generated password, and the published default is refused.

You can verify this yourself. The upstream default returns no token, while the credentials from your own machine do:

# The credential MONARC upstream publishes curl -s -X POST http://127.0.0.1/auth -H 'Content-Type: application/json' \
  --data '{"login":"admin@admin.localhost","password":"admin"}'
# The per instance credential generated on this machine
sudo /usr/local/sbin/monarc-cred-roundtrip.sh

Apache does not serve before provisioning. The Apache unit carries a condition on a marker file, which the first-boot service creates only after it has written this machine's credentials. If provisioning has not completed, the web server does not start, so MONARC is never reachable without a password.

Only two ports are open. The appliance exposes SSH and HTTP and nothing else. MariaDB is bound to 127.0.0.1 and is reachable only from the machine itself:

sudo ss -tlnp | grep -vE '127\.0\.0\.|\[::1\]' grep bind-address /etc/mysql/mariadb.conf.d/50-server.cnf

Your analyses start empty. The CASES knowledge base in monarc_common is shipped reference data and is present from the start. The monarc_cli database, which holds client risk analyses, is empty on a new machine.

Database privileges are scoped. The application database user holds privileges only on the two MONARC databases, not globally. The MariaDB administrative account uses socket authentication, so no database root password is stored anywhere in the image.

Enabling HTTPS

The image serves plain HTTP so that it can start on a bare IP address with no certificate. For any real deployment, put MONARC behind TLS. Point a DNS name at the VM, then run:

sudo a2enmod ssl
sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Certbot writes the TLS virtual host and the renewal timer. Once HTTPS works, remove port 80 from the network security group, or leave it open only for the HTTP-to-HTTPS redirect that certbot installs.

On-box database maintenance

Both databases are local. To take a backup, run:

sudo mysqldump --protocol=socket -uroot --no-tablespaces monarc_cli \
  | gzip > ~/monarc_cli-$(date +%F).sql.gz

monarc_cli holds your analyses and accounts, so back it up regularly. monarc_common holds the shipped CASES knowledge base and changes only when you import new models.

Optional: the global dashboard Stats Service

MONARC can feed anonymised statistics to a separate Stats Service that powers its global dashboard. Upstream runs that service under Docker, and it is not included in this image, which keeps the appliance to a single web stack with no container runtime. The application is configured with a local Stats Service address, so the feature is inactive.

To use the global dashboard, install the Stats Service from the MONARC project and point statsApi.baseUrl in /var/lib/monarc/fo/config/autoload/local.php at it.

Support

SecureAnyCloud provides 24/7 technical support for this image by email at sales@secureanycloud.com. Support covers deployment, first-boot credentials and configuration of the image itself. For questions about the MONARC application and the risk methodology, contact the MONARC project at https://www.monarc.lu.

Deploy on Azure

Launch MONARC on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure