{"id":31057,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","title":{"rendered":"Jak p\u0159evz\u00edt kontrolu nad s\u00edtovou infrastrukturou. T\u0159et\u00ed kapitola. Bezpe\u010dnost s\u00edt\u011b. Druh\u00e1 \u010d\u00e1st","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Tento \u010dl\u00e1nek je \u010dtvrt\u00fd v cyklu \u010dl\u00e1nk\u016f \"Jak z\u00edskat kontrolu nad s\u00ed\u0165ovou infrastrukturou\". Obsah v\u0161ech \u010dl\u00e1nk\u016f cyklu a odkazy naleznete <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">zde<\/a><\/noindex><\/i>.<\/p>\n<p>V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">prvn\u00ed \u010d\u00e1sti<\/a><\/noindex> v t\u00e9to kapitole jsme probrali n\u011bkter\u00e9 aspekty s\u00ed\u0165ov\u00e9 bezpe\u010dnosti segmentu \u201eData Center\u201c. Tato \u010d\u00e1st se zam\u011b\u0159\u00ed na segment \u201eInternet Access\u201c. <\/p>\n<p><img decoding=\"async\" alt=\"Jak p\u0159evz\u00edt kontrolu nad s\u00edtovou infrastrukturou. T\u0159et\u00ed kapitola. Bezpe\u010dnost s\u00edt\u011b. Druh\u00e1 \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2019\/04\/10b33f9b02e3a7562d9e7cf023cbc197.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>p\u0159\u00edstup k internetu<\/h1>\n<p>\nT\u00e9ma bezpe\u010dnosti je nepochybn\u011b jedn\u00edm z nejslo\u017eit\u011bj\u0161\u00edch t\u00e9mat v oblasti p\u0159enosov\u00fdch s\u00edt\u00ed. Jak u\u017e bylo zm\u00edn\u011bno d\u0159\u00edve, bez n\u00e1roku na hloubku a \u00faplnost, se zde zam\u011b\u0159\u00edm na relativn\u011b jednoduch\u00e9, ale podle m\u00e9ho n\u00e1zoru d\u016fle\u017eit\u00e9 ot\u00e1zky, jejich\u017e odpov\u011bdi douf\u00e1m pomohou zv\u00fd\u0161it \u00farove\u0148 zabezpe\u010den\u00ed va\u0161\u00ed s\u00edt\u011b.<\/p>\n<p>P\u0159i auditu tohoto segmentu v\u011bnujte pozornost n\u00e1sleduj\u00edc\u00edm aspekt\u016fm:<\/p>\n<ul>\n<li>design<\/li>\n<li>nastaven\u00ed BGP <\/li>\n<li>ochrana proti DOS\/DDOS<\/li>\n<li>filtrov\u00e1n\u00ed provozu na firewallu<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Design<\/h3>\n<p>\nJako p\u0159\u00edklad designu tohoto segmentu pro podnikovou s\u00ed\u0165 bych doporu\u010dil <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-pin-secure-internet-edge.pdf\">pr\u016fvodce<\/a><\/noindex> od Cisco v r\u00e1mci <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">modelu SAFE<\/a><\/noindex>.<\/p>\n<p>Samoz\u0159ejm\u011b, \u017ee \u0159e\u0161en\u00ed jin\u00fdch dodavatel\u016f se v\u00e1m m\u016f\u017ee zd\u00e1t atraktivn\u011bj\u0161\u00ed (viz <noindex><a rel=\"nofollow\" href=\"https:\/\/researchcenter.paloaltonetworks.com\/2018\/10\/palo-alto-networks-seven-time-gartner-magic-quadrant-leader\/\">Gartner\u016fv kvadrant za rok 2018<\/a><\/noindex>), ale bez toho, abych v\u00e1s vyz\u00fdval k tomu, abyste se podrobn\u011b \u0159\u00eddili t\u00edmto designem, pova\u017euji za u\u017eite\u010dn\u00e9 pochopit principy a my\u0161lenky, kter\u00e9 stoj\u00ed za n\u00edm.<\/p>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>V modelu SAFE je segment \u201eRemote Access\u201c sou\u010d\u00e1st\u00ed \u201eInternet Access\u201c. Ale v tomto cyklu \u010dl\u00e1nk\u016f se na n\u011bj budeme d\u00edvat zvl\u00e1\u0161\u0165.<\/p><\/blockquote>\n<p>Standardn\u00ed v\u00fdbava v tomto segmentu pro podnikov\u00e9 s\u00edt\u011b zahrnuje <\/p>\n<ul>\n<li>okrajov\u00e9 sm\u011brova\u010de (border routers)<\/li>\n<li>firewally<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Pozn\u00e1mka 1<\/b><\/p>\n<p>V tomto cyklu \u010dl\u00e1nk\u016f, kdy\u017e mluv\u00edm o firewallech, mysl\u00edm t\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Next-generation_firewall\">NGFW<\/a><\/noindex>.<\/p><\/blockquote>\n<blockquote><p><b>Pozn\u00e1mka 2<\/b><\/p>\n<p>Zab\u00fdv\u00e1m se pouze ot\u00e1zkami na \u00farovni L3 a vy\u0161\u0161\u00ed. Z\u010d\u00e1sti byly ot\u00e1zky \u00farovn\u011b L1\/L2 probr\u00e1ny v kapitole &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">\u00dadr\u017eba a dokumentace<\/a><\/noindex>&#171;.<\/p><\/blockquote>\n<p> Pokud jste v tomto segmentu nena\u0161li firewall, nemus\u00edte sp\u011bchat s z\u00e1v\u011bry.<\/p>\n<p>Poj\u010fme, jak u\u017e jsme v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">p\u0159edchoz\u00ed \u010d\u00e1sti<\/a><\/noindex>, za\u010d\u00edt ot\u00e1zkou, zda je v tomto segmentu nutn\u00e9 m\u00edt firewall ve va\u0161em p\u0159\u00edpad\u011b?<\/p>\n<p>Mohu \u0159\u00edci, \u017ee se zd\u00e1, \u017ee je to nejopodstatn\u011bn\u011bj\u0161\u00ed m\u00edsto pro pou\u017eit\u00ed firewall\u016f a aplikaci slo\u017eit\u00fdch provozn\u00edch filtr\u016f. V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">\u010d\u00e1sti 1<\/a><\/noindex> jsme zm\u00ednili 4 faktory, kter\u00e9 mohou br\u00e1nit pou\u017eit\u00ed firewall\u016f v segmentu datov\u00e9ho centra. Ale zde u\u017e nejsou tak v\u00fdznamn\u00e9.<\/p>\n<blockquote><p>P\u0159\u00edklad 1. <b>Zpo\u017ed\u011bn\u00ed<\/b><\/p>\n<p>Kdy\u017e hovo\u0159\u00edme o internetu, nem\u00e1 smysl zmi\u0148ovat latenci ani v \u0159\u00e1du 1 milisekundy. Proto latence v tomto segmentu nem\u016f\u017ee b\u00fdt faktorem, kter\u00fd by omezoval vyu\u017eit\u00ed firewallu.<\/p><\/blockquote>\n<blockquote><p>P\u0159\u00edklad 2. <b>V\u00fdkon<\/b><\/p>\n<p>V n\u011bkter\u00fdch p\u0159\u00edpadech m\u016f\u017ee tento faktor st\u00e1le b\u00fdt v\u00fdznamn\u00fd. Proto mo\u017en\u00e1 \u010d\u00e1st provozu (nap\u0159\u00edklad provoz load balancer\u016f) budete muset v\u00e9st mimo firewall.<\/p><\/blockquote>\n<blockquote><p>P\u0159\u00edklad 3. <b>Spolehlivost<\/b><\/p>\n<p>Tento faktor st\u00e1le mus\u00edme br\u00e1t v \u00favahu, ale vzhledem k nespolehlivosti samotn\u00e9ho internetu nen\u00ed jeho v\u00fdznam pro tento segment tak velk\u00fd jako pro datov\u00e9 centrum. <\/p>\n<p>P\u0159edpokl\u00e1dejme tedy, \u017ee va\u0161e slu\u017eba b\u011b\u017e\u00ed na http\/https (s kr\u00e1tk\u00fdmi relacemi). V takov\u00e9m p\u0159\u00edpad\u011b m\u016f\u017eete pou\u017e\u00edt dv\u011b nez\u00e1visl\u00e9 jednotky (bez HA) a v p\u0159\u00edpad\u011b probl\u00e9m\u016f s jednou z nich sm\u011brovat ve\u0161ker\u00fd provoz na druhou. <\/p>\n<p>Nebo m\u016f\u017eete pou\u017e\u00edvat firewally v transparentn\u00edm re\u017eimu a v p\u0159\u00edpad\u011b jejich v\u00fdpadku nechat provoz proudit mimo firewally, dokud nevy\u0159e\u0161\u00edte probl\u00e9m.<\/p><\/blockquote>\n<p> Proto sp\u00ed\u0161e pr\u00e1v\u011b tento <b>cena<\/b> m\u016f\u017ee b\u00fdt t\u00edm faktorem, kter\u00fd v\u00e1s donut\u00ed vzd\u00e1t se pou\u017eit\u00ed firewall\u016f v tomto segmentu.<\/p>\n<blockquote><p><b>D\u016fle\u017eit\u00e9!<\/b><\/p>\n<p>Objevuje se poku\u0161en\u00ed kombinovat tento firewall s firewallem datov\u00e9ho centra (pou\u017e\u00edvat jeden firewall pro tyto segmenty). \u0158e\u0161en\u00ed je v z\u00e1sad\u011b mo\u017en\u00e9, ale je t\u0159eba m\u00edt na pam\u011bti, \u017ee proto\u017ee firewall \"Internet Access\" v podstat\u011b stoj\u00ed na p\u0159edn\u00ed linii va\u0161\u00ed obrany a \"p\u0159eb\u00edr\u00e1\" minim\u00e1ln\u011b \u010d\u00e1st \u0161kodliv\u00e9ho provozu, je t\u0159eba br\u00e1t v \u00favahu zv\u00fd\u0161en\u00e9 riziko, \u017ee tento firewall bude vy\u0159azen z provozu. To znamen\u00e1, \u017ee pou\u017e\u00edv\u00e1n\u00edm stejn\u00fdch za\u0159\u00edzen\u00ed v t\u011bchto dvou segmentech podstatn\u011b sn\u00ed\u017e\u00edte dostupnost va\u0161eho segmentu datov\u00e9ho centra.<\/p><\/blockquote>\n<p> Jak obvykle, je t\u0159eba pochopit, \u017ee v z\u00e1vislosti na slu\u017eb\u011b, kterou firma poskytuje, se design tohoto segmentu m\u016f\u017ee v\u00fdrazn\u011b li\u0161it. Obvykle m\u016f\u017eete vybrat r\u016fzn\u00e9 p\u0159\u00edstupy podle po\u017eadavk\u016f. <\/p>\n<blockquote><p><b>P\u0159\u00edklad<\/b><\/p>\n<p>Pokud jste poskytovatel obsahu se s\u00edt\u00ed CDN (viz nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/ramax\/posts\/\">s\u00e9rii \u010dl\u00e1nk\u016f<\/a><\/noindex>), nemus\u00edte cht\u00edt vytv\u00e1\u0159et v des\u00edtk\u00e1ch nebo dokonce stovk\u00e1ch bod\u016f p\u0159\u00edtomnosti infrastrukturu s pou\u017eit\u00edm jednotliv\u00fdch za\u0159\u00edzen\u00ed pro sm\u011brov\u00e1n\u00ed a filtrov\u00e1n\u00ed provozu. To by bylo n\u00e1kladn\u00e9 a mohlo by se to uk\u00e1zat jako nadbyte\u010dn\u00e9. <\/p>\n<p>Pro BGP nen\u00ed nutn\u00e9 m\u00edt vyhrazen\u00e9 routery, m\u016f\u017eete vyu\u017e\u00edt open-source n\u00e1stroje, nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quagga.net\">Quagga<\/a><\/noindex>. Proto v\u00e1m mo\u017en\u00e1 sta\u010d\u00ed jen server nebo n\u011bkolik server\u016f, switch a BGP.<\/p>\n<p>V takov\u00e9m p\u0159\u00edpad\u011b v\u00e1\u0161 server nebo n\u011bkolik server\u016f mohou fungovat nejen jako server CDN, ale tak\u00e9 jako router. Samoz\u0159ejm\u011b, jsou zde je\u0161t\u011b dal\u0161\u00ed detaily (nap\u0159\u00edklad, jak zajistit vyv\u00e1\u017een\u00ed), ale je to realizovateln\u00e9 a tento p\u0159\u00edstup jsme \u00fasp\u011b\u0161n\u011b aplikovali pro jednoho z na\u0161ich partner\u016f.<\/p>\n<p>M\u016f\u017eete m\u00edt n\u011bkolik datov\u00fdch center s plnou ochranou (firewally, slu\u017eby proti DDoS poskytovan\u00e9 va\u0161imi internetov\u00fdmi poskytovateli) a des\u00edtky nebo stovky \u201ezjednodu\u0161en\u00fdch\u201c bod\u016f p\u0159\u00edtomnosti pouze s L2 switche a servery.<\/p>\n<p>A co ochrana v tomto p\u0159\u00edpad\u011b?<\/p>\n<p>Pod\u00edvejme se nap\u0159\u00edklad na popul\u00e1rn\u00ed <noindex>DDoS \u00fatok typu DNS Amplification<\/noindex>. Jeho nebezpe\u010d\u00ed spo\u010d\u00edv\u00e1 v tom, \u017ee se generuje velk\u00e9 mno\u017estv\u00ed provozu, kter\u00fd prost\u011b \u201ezapln\u00ed\u201c v\u0161echny va\u0161e uplinky na 100%. <\/p>\n<p>Co m\u00e1me v p\u0159\u00edpad\u011b na\u0161eho designu.<\/p>\n<ul>\n<li>Pokud pou\u017e\u00edv\u00e1te AnyCast, provoz se rozd\u011bluje mezi va\u0161e body p\u0159\u00edtomnosti. Pokud m\u00e1te souhrnnou \u0161\u00ed\u0159ku p\u00e1sma na t\u00e9r\u00e9bitech, pak to samo o sob\u011b (ostatn\u011b, v posledn\u00ed dob\u011b se objevilo n\u011bkolik \u00fatok\u016f s malwarov\u00fdm provozem v rozsahu terabitu) v\u00e1s chr\u00e1n\u00ed p\u0159ed \u201ep\u0159et\u00ed\u017een\u00edm\u201c uplink\u016f.<\/li>\n<li>Pokud se p\u0159esto n\u011bjak\u00e9 uplinky \u201ezapln\u00ed\u201c, jednodu\u0161e tuto lokalitu vy\u0159ad\u00edte z provozu (p\u0159estanete oznamovat prefix).<\/li>\n<li>M\u016f\u017eete tak\u00e9 zv\u00fd\u0161it pod\u00edl provozu, kter\u00fd poskytujete z va\u0161ich \"plnohodnotn\u00fdch\" (a tedy chr\u00e1n\u011bn\u00fdch) datov\u00fdch center, \u010d\u00edm\u017e podstatn\u011b odstran\u00edte \u010d\u00e1st \u0161kodliv\u00e9ho provozu z nechr\u00e1n\u011bn\u00fdch bod\u016f p\u0159\u00edtomnosti.<\/li>\n<\/ul>\n<p>\nA je\u0161t\u011b mal\u00e9 pozn\u00e1mka k tomuto p\u0159\u00edkladu. Pokud dostate\u010dn\u00e9 mno\u017estv\u00ed provozu pos\u00edl\u00e1te p\u0159es IX, sni\u017euje to tak\u00e9 va\u0161i zranitelnost v\u016f\u010di podobn\u00fdm \u00fatok\u016fm.<\/p><\/blockquote>\n<h3>Nastaven\u00ed BGP<\/h3>\n<p>\nZde jsou dv\u011b t\u00e9mata.<\/p>\n<ul>\n<li>Konektivita<\/li>\n<li>Nastaven\u00ed BGP<\/li>\n<\/ul>\n<p>\nO konektivit\u011b jsme u\u017e trochu hovo\u0159ili v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">\u010d\u00e1sti 1<\/a><\/noindex>. Podstatou je zajistit, aby byl provoz k va\u0161im klient\u016fm optim\u00e1ln\u011b sm\u011brov\u00e1n. I kdy\u017e optimalizace nen\u00ed v\u017edy pouze o latenci, obvykle je v\u0161ak n\u00edzk\u00e1 latence hlavn\u00edm ukazatelem optimality. Pro n\u011bkter\u00e9 firmy je to d\u016fle\u017eit\u011bj\u0161\u00ed, pro jin\u00e9 m\u00e9n\u011b. V\u0161e z\u00e1vis\u00ed na slu\u017eb\u011b, kterou poskytujete.<\/p>\n<blockquote><p><b>P\u0159\u00edklad 1<\/b><\/p>\n<p>Pokud jste burza a pro va\u0161e klienty jsou d\u016fle\u017eit\u00e9 \u010dasov\u00e9 intervaly krat\u0161\u00ed ne\u017e milisekundy, pak je jasn\u00e9, \u017ee o \u017e\u00e1dn\u00e9m internetu se v\u016fbec ned\u00e1 mluvit.<\/p><\/blockquote>\n<blockquote><p><b>P\u0159\u00edklad 2<\/b><\/p>\n<p>Pokud jste hern\u00ed spole\u010dnost a pro v\u00e1s jsou d\u016fle\u017eit\u00e9 des\u00edtky milisekund, pak je pro v\u00e1s samoz\u0159ejm\u011b konektivita velmi d\u016fle\u017eit\u00e1.<\/p><\/blockquote>\n<blockquote><p><b>P\u0159\u00edklad 3<\/b><\/p>\n<p>Tak\u00e9 je t\u0159eba ch\u00e1pat, \u017ee vzhledem k vlastnostem protokolu TCP z\u00e1vis\u00ed rychlost p\u0159enosu dat v r\u00e1mci jedn\u00e9 TCP relace tak\u00e9 na RTT (Round Trip Time). CDN s\u00edt\u011b jsou budov\u00e1ny mimo jin\u00e9 i k \u0159e\u0161en\u00ed tohoto probl\u00e9mu a p\u0159ibli\u017euj\u00ed servery distribuce obsahu bl\u00ed\u017ee k u\u017eivateli tohoto obsahu.<\/p><\/blockquote>\n<p> Studie konektivity je zcela samostatn\u00e9 zaj\u00edmav\u00e9 t\u00e9ma, zasluhuj\u00edc\u00ed samostatn\u00fd \u010dl\u00e1nek nebo s\u00e9rii \u010dl\u00e1nk\u016f, a vy\u017eaduje dobr\u00e9 pochopen\u00ed toho, jak je internet \"uspo\u0159\u00e1d\u00e1n\".<\/p>\n<p>U\u017eite\u010dn\u00e9 zdroje:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/ripe.net\">ripe.net<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex><\/p>\n<blockquote><p><b>P\u0159\u00edklad<\/b><\/p>\n<p>Uvedu jen jeden mal\u00fd p\u0159\u00edklad.<\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee v\u00e1\u0161 datacentrum se nach\u00e1z\u00ed v Moskv\u011b a m\u00e1te pouze jeden uplink \u2013 Rostelecom (AS12389). V tomto p\u0159\u00edpad\u011b (single homed) BGP nepot\u0159ebujete a jako ve\u0159ejn\u00e9 adresy pravd\u011bpodobn\u011b pou\u017e\u00edv\u00e1te adresn\u00ed blok od Rostelecomu. <\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee poskytujete n\u011bjakou slu\u017ebu a m\u00e1te dostate\u010dn\u00fd po\u010det klient\u016f z Ukrajiny, kte\u0159\u00ed si st\u011b\u017euj\u00ed na velk\u00e9 zpo\u017ed\u011bn\u00ed. P\u0159i zkoum\u00e1n\u00ed jste zjistili, \u017ee IP adresy n\u011bkter\u00fdch z nich jsou v rozsahu 37.52.0.0\/21. <\/p>\n<p>Po proveden\u00ed traceroute jste vid\u011bli, \u017ee provoz jde p\u0159es AS1299 (Telia), a po proveden\u00ed pingu jste z\u00edskali pr\u016fm\u011brn\u00e9 RTT 70 \u2014 80 milisekund. M\u016f\u017eete to tak\u00e9 vid\u011bt na <noindex><a rel=\"nofollow\" href=\"http:\/\/lg.ip.rt.ru\">looking glass Rostelecomu<\/a><\/noindex>.<\/p>\n<p>Pomoc\u00ed utility whois (na webu ripe.net nebo m\u00edstn\u00ed utilita) m\u016f\u017eete snadno zjistit, \u017ee blok 37.52.0.0\/21 pat\u0159\u00ed AS6849 (Ukrtelecom).<\/p>\n<p>D\u00e1le, kdy\u017e se pod\u00edv\u00e1te na <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex> vid\u00edte, \u017ee AS6849 nem\u00e1 vztahy s AS12389 (nen\u00ed ani klientem, ani uplinkem pro sebe, stejn\u011b tak nemaj\u00ed peering). Ale pokud se pod\u00edv\u00e1te na <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\/AS6849#_peers\">seznam peer\u016f<\/a><\/noindex> pro AS6849, uvid\u00edte nap\u0159\u00edklad AS29226 (Mastertel) a AS31133 (Megafon). <\/p>\n<p>Nalezen\u00edm looking glass t\u011bchto poskytovatel\u016f m\u016f\u017eete porovnat cestu a RTT. Nap\u0159\u00edklad pro Mastertel bude RTT kolem 30 milisekund. <\/p>\n<p>Tak\u017ee pokud je rozd\u00edl mezi 80 a 30 milisekundami v\u00fdznamn\u00fd pro va\u0161i slu\u017ebu, mo\u017en\u00e1 byste m\u011bli p\u0159em\u00fd\u0161let o konektivit\u011b, z\u00edskat v RIPE sv\u00e9 \u010d\u00edslo AS, sv\u016fj adresn\u00ed blok a p\u0159ipojit dal\u0161\u00ed uplinky a\/nebo vytvo\u0159it m\u00edsta p\u0159\u00edtomnosti na IX-\u00e1ch.<\/p><\/blockquote>\n<p>\nP\u0159i pou\u017e\u00edv\u00e1n\u00ed BGP nejen\u017ee m\u016f\u017eete zlep\u0161it konektivitu, ale tak\u00e9 si rezervujete sv\u00e9 p\u0159ipojen\u00ed k internetu.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ssi.gouv.fr\/uploads\/2016\/03\/bgp-configuration-best-practices.pdf\">Tento dokument<\/a><\/noindex> obsahuje doporu\u010den\u00ed k nastaven\u00ed BGP. I kdy\u017e byla tato doporu\u010den\u00ed vypracov\u00e1na na z\u00e1klad\u011b \u201ebest practice\u201c poskytovatel\u016f, jsou bezesporu u\u017eite\u010dn\u00e1 a m\u011bly by b\u00fdt sou\u010d\u00e1st\u00ed hardeningu, o kter\u00e9m jsme mluvili v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">prvn\u00ed \u010d\u00e1sti<\/a><\/noindex>.<\/p>\n<h3>ochrana proti DOS\/DDOS<\/h3>\n<p>\nV sou\u010dasnosti jsou \u00fatoky DOS\/DDOS ka\u017edodenn\u00ed realitou pro mnoho firem. Ve skute\u010dnosti v\u00e1s v n\u011bjak\u00e9 podob\u011b \u00fato\u010d\u00ed celkem \u010dasto. To, \u017ee si toho zat\u00edm nev\u0161imnete, jen nazna\u010duje, \u017ee zat\u00edm nebyl organizov\u00e1n c\u00edlen\u00fd \u00fatok proti v\u00e1m a \u017ee ochrann\u00e9 prost\u0159edky, kter\u00e9 pou\u017e\u00edv\u00e1te (r\u016fzn\u00e9 vestav\u011bn\u00e9 ochrany opera\u010dn\u00edch syst\u00e9m\u016f), dost mo\u017en\u00e1 sta\u010d\u00ed k tomu, aby se degradace poskytovan\u00fdch slu\u017eeb minimalizovala pro v\u00e1s a va\u0161e klienty.<\/p>\n<p>Existuj\u00ed internetov\u00e9 zdroje, kter\u00e9 na z\u00e1klad\u011b log\u016f z vybaven\u00ed v re\u00e1ln\u00e9m \u010dase zobrazuj\u00ed kr\u00e1sn\u00e9 mapy \u00fatok\u016f.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3217944\/security\/8-top-cyber-attack-maps-and-how-to-use-them.html\">Zde<\/a><\/noindex> m\u016f\u017eete naj\u00edt odkazy na n\u011b.<\/p>\n<p>Moje obl\u00edben\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/threatmap.checkpoint.com\/ThreatPortal\/livemap.html\">mapa<\/a><\/noindex> od CheckPointu.<\/p>\n<p>Ochrana proti DDOS\/DOS obvykle p\u0159edstavuje vrstvenou ochranu. Abychom pochopili pro\u010d, mus\u00edme rozum\u011bt, jak\u00e9 typy \u00fatok\u016f DOS\/DDOS existuj\u00ed (viz nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3222095\/network-security\/ddos-explained-how-denial-of-service-attacks-are-evolving.html\">zde <\/a><\/noindex> nebo <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.thousandeyes.com\/three-types-ddos-attacks\/\">zde<\/a><\/noindex>)<\/p>\n<p>To znamen\u00e1, \u017ee m\u00e1me t\u0159i typy \u00fatok\u016f:<\/p>\n<ul>\n<li>volumetric attacks<\/li>\n<li>protocol attacks<\/li>\n<li>application attacks<\/li>\n<\/ul>\n<p>\nPokud se m\u016f\u017eete ochr\u00e1nit p\u0159ed posledn\u00edmi dv\u011bma typy \u00fatok\u016f sami pomoc\u00ed nap\u0159\u00edklad firewall\u016f, p\u0159ed \u00fatoky zam\u011b\u0159en\u00fdmi na \u201ep\u0159ete\u010den\u00ed\u201c va\u0161ich uplink\u016f se sami neochr\u00e1n\u00edte (samoz\u0159ejm\u011b, pokud va\u0161e celkov\u00e1 kapacita internetov\u00fdch kan\u00e1l\u016f nen\u00ed v terabitech, a je\u0161t\u011b l\u00e9pe, v des\u00edtk\u00e1ch terabit).<\/p>\n<p>Proto prvn\u00ed linie ochrany \u2014 je ochrana proti \u201evolumetric\u201c \u00fatok\u016fm a tuto ochranu v\u00e1m mus\u00ed zajistit v\u00e1\u0161 poskytovatel nebo poskytovatel\u00e9. Pokud jste si toho dosud neuv\u011bdomili, doposud m\u00e1te jen \u0161t\u011bst\u00ed.<\/p>\n<blockquote><p><b>P\u0159\u00edklad<\/b><\/p>\n<p>P\u0159edstavme si, \u017ee m\u00e1te n\u011bkolik uplink\u016f, ale pouze jeden poskytovatel v\u00e1m m\u016f\u017ee tuto ochranu poskytnout. Ale pokud ve\u0161ker\u00fd provoz bude prob\u00edhat p\u0159es jednoho poskytovatele, co s konektivitou, kterou jsme kr\u00e1tce prodiskutovali d\u0159\u00edve?<\/p>\n<p>B\u011bhem \u00fatoku budete muset v tomto p\u0159\u00edpad\u011b \u010d\u00e1ste\u010dn\u011b ob\u011btovat konektivitu. Ale<\/p>\n<ul>\n<li>to je pouze b\u011bhem \u00fatoku. V p\u0159\u00edpad\u011b \u00fatoku m\u016f\u017eete ru\u010dn\u011b nebo automaticky p\u0159eprogramovat BGP, aby provoz proch\u00e1zel pouze p\u0159es poskytovatele, kter\u00fd v\u00e1m poskytuje \u201ede\u0161tn\u00edk\u201c. Po skon\u010den\u00ed \u00fatoku m\u016f\u017eete vr\u00e1tit sm\u011brov\u00e1n\u00ed do p\u016fvodn\u00edho stavu.<\/li>\n<li>nen\u00ed nutn\u00e9 p\u0159ev\u00e1d\u011bt ve\u0161ker\u00fd provoz. Pokud nap\u0159\u00edklad vid\u00edte, \u017ee p\u0159es n\u011bkter\u00e9 uplinky nebo peering nedoch\u00e1z\u00ed k \u00fatoku (nebo je provoz nepatrn\u00fd), m\u016f\u017eete nad\u00e1le oznamovat prefixy s konkuren\u010dn\u00edmi atributy sm\u011brem k t\u011bmto BGP soused\u016fm.<\/li>\n<\/ul>\n<\/blockquote>\n<p>\nOchranu proti \u201eprotokolov\u00fdm \u00fatok\u016fm\u201c a \u201eaplikovan\u00fdm \u00fatok\u016fm\u201c m\u016f\u017eete tak\u00e9 p\u0159enechat partner\u016fm.<br \/>\nTady <noindex><a rel=\"nofollow\" href=\"https:\/\/geekflare.com\/ddos-protection-service\/\">zde<\/a><\/noindex> m\u016f\u017eete si p\u0159e\u010d\u00edst dobrou studii (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/company\/hosting-cafe\/blog\/324848\/\">p\u0159eklad<\/a><\/noindex>). Pravda, \u010dl\u00e1nek je star\u00fd dva roky, ale d\u00e1 v\u00e1m p\u0159edstavu o p\u0159\u00edstupech, jak se m\u016f\u017eete chr\u00e1nit p\u0159ed DDoS \u00fatoky.<\/p>\n<p>V podstat\u011b m\u016f\u017eete t\u00edmto zp\u016fsobem omezit svou ochranu na outsourcing. V tomto \u0159e\u0161en\u00ed jsou v\u00fdhody, ale existuje tak\u00e9 z\u0159ejm\u00e9 minus. T\u00fdk\u00e1 se to (op\u011bt v z\u00e1vislosti na tom, \u010d\u00edm se va\u0161e spole\u010dnost zab\u00fdv\u00e1) p\u0159e\u017eit\u00ed podnik\u00e1n\u00ed. A d\u016fv\u011b\u0159ovat takov\u00fdm v\u011bcem extern\u00edm organizac\u00edm...<\/p>\n<p>Proto se pod\u00edvejme, jak organizovat druhou a t\u0159et\u00ed obrannou linii (jako dopln\u011bk ochrany od poskytovatele).<\/p>\n<p>Druh\u00e1 vrstva ochrany je filtrov\u00e1n\u00ed a omezova\u010de provozu (policers) na vstupu do va\u0161\u00ed s\u00edt\u011b. <\/p>\n<blockquote><p><b>P\u0159\u00edklad 1<\/b><\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee jste se \u201echr\u00e1nili de\u0161tn\u00edkem\u201c proti DDoS pomoc\u00ed jednoho z poskytovatel\u016f. P\u0159edpokl\u00e1dejme, \u017ee tento poskytovatel pou\u017e\u00edv\u00e1 Arbor k filtraci provozu a filtry na hranici sv\u00e9 s\u00edt\u011b. <\/p>\n<p>\u0160\u00ed\u0159ka, kterou m\u016f\u017ee \u201ezpracov\u00e1vat\u201c Arbor, je omezen\u00e1 a poskytovatel samoz\u0159ejm\u011b nem\u016f\u017ee trvale propou\u0161t\u011bt provoz v\u0161ech sv\u00fdch partner\u016f, kte\u0159\u00ed si tuto slu\u017ebu objednali, p\u0159es filtra\u010dn\u00ed za\u0159\u00edzen\u00ed. Proto se v b\u011b\u017en\u00fdch podm\u00ednk\u00e1ch provoz nefiltruje.<\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee prob\u00edh\u00e1 \u00fatok SYN flood. I kdy\u017e jste si objednali slu\u017ebu, p\u0159i kter\u00e9 se v p\u0159\u00edpad\u011b \u00fatoku provoz automaticky p\u0159esm\u011brov\u00e1v\u00e1 na filtrov\u00e1n\u00ed, nedoch\u00e1z\u00ed k tomu okam\u017eit\u011b. Po dobu jedn\u00e9 minuty nebo d\u00e9le z\u016fst\u00e1v\u00e1te pod \u00fatokem. A to m\u016f\u017ee v\u00e9st k poru\u0161e va\u0161eho vybaven\u00ed nebo degradaci slu\u017eby. V tomto p\u0159\u00edpad\u011b omezen\u00ed provozu na okru\u017en\u00ed routovac\u00ed vrstv\u011b, i kdy\u017e zp\u016fsob\u00ed, \u017ee n\u011bkter\u00e9 TCP session se v t\u00e9to dob\u011b neustanov\u00ed, ale zachr\u00e1n\u00ed va\u0161i infrastrukturu p\u0159ed v\u011bt\u0161\u00edmi probl\u00e9my.<\/p><\/blockquote>\n<blockquote><p><b>P\u0159\u00edklad 2<\/b><\/p>\n<p>Anom\u00e1ln\u011b velk\u00e9 mno\u017estv\u00ed SYN paket\u016f m\u016f\u017ee b\u00fdt nejen v\u00fdsledkem \u00fatoku SYN flood. P\u0159edpokl\u00e1dejme, \u017ee poskytujete slu\u017ebu, p\u0159i kter\u00e9 m\u016f\u017eete m\u00edt sou\u010dasn\u011b zhruba 100 tis\u00edc TCP p\u0159ipojen\u00ed (v jednom datov\u00e9m centru).<\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee v d\u016fsledku kr\u00e1tkodob\u00e9ho probl\u00e9mu s jedn\u00edm z va\u0161ich hlavn\u00edch poskytovatel\u016f se v\u00e1m \"vy\u0159adila\" polovina session. Pokud je va\u0161e aplikace navr\u017eena tak, \u017ee \"bez rozm\u00fd\u0161len\u00ed\" okam\u017eit\u011b (nebo s n\u011bjak\u00fdm stejn\u00fdm \u010dasov\u00fdm intervalem pro v\u0161echny session) se sna\u017e\u00ed znovu nav\u00e1zat spojen\u00ed, pak p\u0159ibli\u017en\u011b sou\u010dasn\u011b obdr\u017e\u00edte alespo\u0148 50 tis\u00edc SYN paket\u016f. <\/p>\n<p>Pokud je\u0161t\u011b na t\u011bchto session m\u00e1 nap\u0159\u00edklad prob\u00edhat ssl\/tls handshake, kter\u00fd zahrnuje v\u00fdm\u011bnu certifik\u00e1t\u016f, pak z pohledu vy\u010derp\u00e1n\u00ed zdroj\u016f pro v\u00e1\u0161 load balancer to bude mnohem siln\u011bj\u0161\u00ed \"DDOS\" ne\u017e jednoduch\u00fd SYN flood. Zd\u00e1lo by se, \u017ee load balancery by m\u011bly takov\u00e9 situace zvl\u00e1dnout, ale \u2026 bohu\u017eel, setkali jsme se s touto problematikou v pln\u00e9 \u0161\u00ed\u0159i.<\/p>\n<p>A samoz\u0159ejm\u011b, policer na okru\u017en\u00edm routeru zachr\u00e1n\u00ed va\u0161e vybaven\u00ed i v tomto p\u0159\u00edpad\u011b.<\/p><\/blockquote>\n<p>T\u0159et\u00ed \u00farove\u0148 ochrany proti DDOS\/DOS \u2013 to jsou nastaven\u00ed va\u0161\u00ed firewallu.<\/p>\n<p>Zde m\u016f\u017eete potla\u010dit jak \u00fatoky druh\u00e9ho, tak t\u0159et\u00edho typu. Obecn\u011b lze v\u0161e, co doraz\u00ed k firewallu, filtrovat zde. <\/p>\n<blockquote><p><b>Tip<\/b><\/p>\n<p>Sna\u017ete se d\u00e1t firewallu co nejm\u00e9n\u011b pr\u00e1ce t\u00edm, \u017ee co nejv\u00edce filtrujete na prvn\u00edch dvou lini\u00edch obrany. A to je d\u016fvod.<\/p>\n<p>Stalo se v\u00e1m n\u011bkdy, \u017ee p\u0159i generov\u00e1n\u00ed dopravy pro testov\u00e1n\u00ed, nap\u0159\u00edklad jak odoln\u00fd je opera\u010dn\u00ed syst\u00e9m va\u0161ich server\u016f v\u016f\u010di DDoS \u00fatok\u016fm, jste \u201ezabili\u201c sv\u016fj firewall, zat\u011b\u017euj\u00edc ho na 100 procent, p\u0159i\u010dem\u017e p\u0159itom provoz m\u011bl b\u011b\u017enou intenzitu? Pokud ne, mo\u017en\u00e1 jste to jen nezkusili?<\/p>\n<p>Obecn\u011b vzato, firewall, jak jsem ji\u017e zm\u00ednil, je slo\u017eit\u00e1 v\u011bc, a dob\u0159e funguje s zn\u00e1m\u00fdmi zranitelnostmi a testovan\u00fdmi \u0159e\u0161en\u00edmi, ale pokud po\u0161lete n\u011bco neobvykl\u00e9ho, n\u011bjak\u00e9 \u0161um nebo pakety s nespr\u00e1vn\u00fdmi hlavi\u010dkami, m\u016f\u017eete se s ur\u010dit\u00fdm, rozhodn\u011b ne mal\u00fdm (na z\u00e1klad\u011b m\u00fdch zku\u0161enost\u00ed) pravd\u011bpodobnost\u00ed dostat do pot\u00ed\u017e\u00ed i s pokro\u010dil\u00fdm za\u0159\u00edzen\u00edm. Proto na \u00farovni 2 pomoc\u00ed b\u011b\u017en\u00fdch ACL (na \u00farovni L3\/L4) vypou\u0161t\u011bjte do va\u0161\u00ed s\u00edt\u011b pouze ten provoz, kter\u00fd tam m\u00e1 vstupovat.<\/p><\/blockquote>\n<h3>Filtrov\u00e1n\u00ed dopravy na firewallu<\/h3>\n<p>\nPokra\u010dujeme v diskuzi o firewallu. Je t\u0159eba ch\u00e1pat, \u017ee \u00fatoky DOS\/DDoS jsou pouze jedn\u00edm z typ\u016f kybernetick\u00fdch \u00fatok\u016f. <\/p>\n<p>Krom\u011b ochrany proti DOS\/DDoS m\u016f\u017eeme m\u00edt tak\u00e9 n\u011bco jako n\u00e1sleduj\u00edc\u00ed seznam mo\u017enost\u00ed:<\/p>\n<ul>\n<li>aplika\u010dn\u00ed firewall<\/li>\n<li>prevence hrozeb (antivirus, antispyware a zranitelnost)<\/li>\n<li>filtrace URL<\/li>\n<li>filtrace dat (filtrace obsahu)<\/li>\n<li>blokov\u00e1n\u00ed soubor\u016f (blokov\u00e1n\u00ed typ\u016f soubor\u016f)<\/li>\n<\/ul>\n<p>\nJe na v\u00e1s, co ze tohoto seznamu pot\u0159ebujete.<\/p>\n<p><i>Pokra\u010dov\u00e1n\u00ed p\u0159\u00ed\u0161t\u011b<\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436230\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23032,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak vz\u00edt s\u00ed\u0165ovou infrastrukturu pod svou kontrolu. \u010c\u00e1st t\u0159et\u00ed. S\u00ed\u0165ov\u00e1 bezpe\u010dnost. Druh\u00e1 \u010d\u00e1st | ProHoster","description":"Tento \u010dl\u00e1nek je \u010dtvrt\u00fdm v cyklu \u010dl\u00e1nk\u016f \u201eJak vz\u00edt s\u00ed\u0165ovou infrastrukturu pod svou kontrolu\u201c.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23032"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}