{"id":85141,"date":"2020-06-13T13:42:24","date_gmt":"2020-06-13T11:42:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki"},"modified":"2020-06-13T13:42:24","modified_gmt":"2020-06-13T11:42:24","slug":"chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","title":{"rendered":"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506334\/\"><img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/867a0b09b6e2b2676e520a16cee0148d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><i>kdpv \u2014 Reuters<\/i><\/p>\n<p>Pokud jste si pronajali server, nem\u00e1te nad n\u00edm plnou kontrolu. To znamen\u00e1, \u017ee kdykoli mohou k hostiteli p\u0159ij\u00edt specializovan\u00ed lid\u00e9 a po\u017e\u00e1dat o poskytnut\u00ed jak\u00fdchkoli va\u0161ich dat. A hostitel je poskytne, pokud bude po\u017eadavek formulov\u00e1n podle z\u00e1kona. <\/p>\n<p>Opravdu si nep\u0159ejete, aby se logy va\u0161eho webov\u00e9ho serveru nebo data u\u017eivatel\u016f dostala k n\u011bkomu jin\u00e9mu. Ide\u00e1ln\u00ed ochrana nen\u00ed mo\u017en\u00e1. Ochr\u00e1nit se p\u0159ed hostitelem, kter\u00fd ovl\u00e1d\u00e1 hypervizor a poskytuje v\u00e1m virtu\u00e1ln\u00ed stroj, je t\u00e9m\u011b\u0159 nemo\u017en\u00e9. Ale mo\u017en\u00e1 se poda\u0159\u00ed m\u00edrn\u011b sn\u00ed\u017eit rizika. \u0160ifrov\u00e1n\u00ed pronajat\u00fdch stroj\u016f nen\u00ed tak bezcenn\u00e9, jak se na prvn\u00ed pohled zd\u00e1. Z\u00e1rove\u0148 se pod\u00edv\u00e1me na hrozby vypl\u00fdvaj\u00edc\u00ed z extrakce dat z fyzick\u00fdch server\u016f.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Model hrozeb<\/h2>\n<p>\nObecn\u011b se hostitel bude sna\u017eit co nejv\u00edce chr\u00e1nit z\u00e1jmy klienta, jak jen to bude mo\u017en\u00e9 podle z\u00e1kona. Pokud v dopise od ofici\u00e1ln\u00edch org\u00e1n\u016f po\u017eadovali pouze p\u0159\u00edstupov\u00e9 logy, hostitel neposkytne kopie v\u0161ech va\u0161ich virtu\u00e1ln\u00edch stroj\u016f s datab\u00e1zemi. Nem\u011bl by, alespo\u0148 podle pravidel. Pokud po\u017e\u00e1daj\u00ed o v\u0161echny data, hostitel zkop\u00edruje virtu\u00e1ln\u00ed disky se v\u0161emi soubory a vy se o tom nikdy nedozv\u00edte.<\/p>\n<p>Bez ohledu na v\u00fdvoj ud\u00e1lost\u00ed je va\u0161\u00edm hlavn\u00edm \u00fakolem u\u010dinit \u00fatok p\u0159\u00edli\u0161 slo\u017eit\u00fdm a n\u00e1kladn\u00fdm. Obvykle existuj\u00ed t\u0159i hlavn\u00ed varianty hrozeb.<\/p>\n<h2>Ofici\u00e1ln\u00ed<\/h2>\n<p>\nNej\u010dast\u011bji je do ofici\u00e1ln\u00edho \u00fa\u0159adu hostitele zas\u00edl\u00e1n pap\u00edrov\u00fd dopis s po\u017eadavkem na poskytnut\u00ed pot\u0159ebn\u00fdch dat podle p\u0159\u00edslu\u0161n\u00e9ho usnesen\u00ed. Pokud je v\u0161e spr\u00e1vn\u011b formulov\u00e1no, hostitel poskytuje pot\u0159ebn\u00e9 p\u0159\u00edstupov\u00e9 logy a dal\u0161\u00ed data ofici\u00e1ln\u00edm org\u00e1n\u016fm. Obvykle prost\u011b po\u017e\u00e1daj\u00ed o zasl\u00e1n\u00ed pot\u0159ebn\u00fdch dat.<\/p>\n<p>P\u0159\u00edle\u017eitostn\u011b, pokud je to opravdu nutn\u00e9, z\u00e1stupciorg\u00e1n\u016f \u010dinn\u00fdch v trestn\u00edm \u0159\u00edzen\u00ed p\u0159ij\u00ed\u017ed\u011bj\u00ed osobn\u011b do datov\u00e9ho centra. Nap\u0159\u00edklad kdy\u017e m\u00e1te sv\u016fj dedikovan\u00fd server a data z n\u011bj je mo\u017en\u00e9 z\u00edskat pouze fyzicky.<\/p>\n<p>Ve v\u0161ech zem\u00edch k z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu na soukrom\u00e9 \u00fazem\u00ed, proveden\u00ed prohl\u00eddky a dal\u0161\u00edch akc\u00ed je pot\u0159eba m\u00edt d\u016fkazy, \u017ee tyto mohou obsahovat d\u016fle\u017eit\u00e9 informace pro vy\u0161et\u0159ov\u00e1n\u00ed trestn\u00e9ho \u010dinu. Krom\u011b toho je vy\u017eadov\u00e1n \u0159\u00e1dn\u011b vypracovan\u00fd p\u0159\u00edkaz k prohl\u00eddce. Zde mohou b\u00fdt nuance spojen\u00e9 se specifiky m\u00edstn\u00ed legislativy. Hlavn\u00ed, co je t\u0159eba pochopit \u2013 v p\u0159\u00edpad\u011b spr\u00e1vn\u00e9ho ofici\u00e1ln\u00edho postupu z\u00e1stupci datov\u00fdch center nepust\u00ed nikoho d\u00e1l za vr\u00e1tnici.<\/p>\n<p>Nav\u00edc ve v\u011bt\u0161in\u011b zem\u00ed nen\u00ed mo\u017en\u00e9 jen tak vz\u00edt a vyt\u00e1hnout funguj\u00edc\u00ed za\u0159\u00edzen\u00ed. Nap\u0159\u00edklad v Rusku do konce roku 2018 podle \u010dl\u00e1nku 183 trestn\u00edho \u0159\u00e1du RF \u010d\u00e1st 3.1 bylo zaru\u010deno, \u017ee p\u0159i prov\u00e1d\u011bn\u00ed v\u00fdb\u011bru se zabaven\u00ed elektronick\u00fdch nosi\u010d\u016f informac\u00ed uskute\u010d\u0148uje za \u00fa\u010dasti specialisty. Na \u017e\u00e1dost z\u00e1konn\u00e9ho vlastn\u00edka zab\u00edran\u00fdch elektronick\u00fdch nosi\u010d\u016f informac\u00ed nebo osoby, kter\u00e1 je obsa\u017eena na nich, se specialistou \u00fa\u010dastn\u00edc\u00edm se v\u00fdb\u011bru v p\u0159\u00edtomnosti sv\u011bdk\u016f prov\u00e1d\u00ed kop\u00edrov\u00e1n\u00ed informac\u00ed na jin\u00e9 elektronick\u00e9 nosi\u010de informac\u00ed.<\/p>\n<p>Bohu\u017eel, tento bod byl pozd\u011bji z \u010dl\u00e1nku odstran\u011bn.<\/p>\n<h2>Tajn\u00e9 a neofici\u00e1ln\u00ed<\/h2>\n<p>\nTo u\u017e je \u00fazem\u00ed \u010dinnosti speci\u00e1ln\u011b vy\u0161kolen\u00fdch jedinc\u016f z NSA, FBI, MI5 a dal\u0161\u00edch t\u0159\u00edp\u00edsmenn\u00fdch organizac\u00ed. \u010casto pr\u00e1vn\u00ed r\u00e1mce zem\u00ed poskytuj\u00ed extr\u00e9mn\u011b \u0161irok\u00e9 pravomoci pro podobn\u00e9 struktury. Nav\u00edc t\u00e9m\u011b\u0159 v\u017edy existuje legislativn\u00ed z\u00e1kaz na jak\u00e9koli p\u0159\u00edm\u00e9 \u010di nep\u0159\u00edm\u00e9 zve\u0159ejn\u011bn\u00ed samotn\u00e9ho faktu spolupr\u00e1ce s takov\u00fdmi silov\u00fdmi \u00fa\u0159ady. V Rusku existuj\u00ed obdobn\u00e1 <noindex><a rel=\"nofollow\" href=\"http:\/\/publication.pravo.gov.ru\/Document\/View\/0001201801220009?index=3&amp;rangeSize=1\">pr\u00e1vn\u00ed normy<\/a><\/noindex>.<\/p>\n<p>V p\u0159\u00edpad\u011b podobn\u00e9 hrozby va\u0161im dat\u016fm je t\u00e9m\u011b\u0159 jist\u00e9, \u017ee je vyt\u00e1hnou. Krom\u011b oby\u010dejn\u00e9ho zabaven\u00ed mohou b\u00fdt pou\u017eity v\u0161echny neofici\u00e1ln\u00ed arzen\u00e1ly backdoor\u016f, zranitelnost\u00ed s nulov\u00fdm dnem, extrakce dat z opera\u010dn\u00ed pam\u011bti va\u0161\u00ed virtu\u00e1ln\u00ed machine a dal\u0161\u00ed efekty. Poskytovatel hostingu bude povinen maxim\u00e1ln\u011b pom\u00e1hat specialist\u016fm silov\u00fdch struktur.<\/p>\n<h2>Nedbal\u00fd zam\u011bstnanec<\/h2>\n<p>\nNen\u00ed ka\u017ed\u00fd \u010dlov\u011bk stejn\u011b dobr\u00fd. N\u011bkdo z administr\u00e1tor\u016f datov\u00e9ho centra m\u016f\u017ee m\u00edt chu\u0165 p\u0159ivyd\u011blat si a prodat va\u0161e data. Dal\u0161\u00ed v\u00fdvoj ud\u00e1lost\u00ed z\u00e1vis\u00ed na jeho pravomoc\u00edch a p\u0159\u00edstupech. Nejd\u016fle\u017eit\u011bj\u0161\u00ed je, \u017ee administr\u00e1tor s p\u0159\u00edstupem k virtualiza\u010dn\u00ed konzoli m\u00e1 plnou kontrolu nad va\u0161imi stroji. V\u017edy je mo\u017en\u00e9 po\u0159\u00eddit sn\u00edmek spolu s ve\u0161ker\u00fdm obsahem opera\u010dn\u00ed pam\u011bti a d\u00e1le si ho v klidu prozkoumat.<\/p>\n<h2>VDS<\/h2>\n<p>\nTak\u017ee m\u00e1te virtu\u00e1ln\u00ed stroj, kter\u00fd v\u00e1m poskytl poskytovatel hostingu. Jak m\u016f\u017eete uspo\u0159\u00e1dat \u0161ifrov\u00e1n\u00ed, abyste se ochr\u00e1nili? Ve skute\u010dnosti t\u00e9m\u011b\u0159 v\u016fbec. Nav\u00edc, i ciz\u00ed dedikovan\u00fd server se m\u016f\u017ee nakonec uk\u00e1zat jako virtu\u00e1ln\u00ed stroj, do kter\u00e9ho jsou p\u0159ipojena pot\u0159ebn\u00e1 za\u0159\u00edzen\u00ed.<\/p>\n<p>Pokud \u00fakol vzd\u00e1len\u00e9ho syst\u00e9mu zahrnuje nejen ukl\u00e1d\u00e1n\u00ed dat, ale tak\u00e9 prov\u00e1d\u011bn\u00ed n\u011bjak\u00fdch v\u00fdpo\u010dt\u016f, jedinou mo\u017enost\u00ed, jak pracovat s ned\u016fv\u011bryhodn\u00fdm strojem, bude realizace <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9F%D0%BE%D0%BB%D0%BD%D0%BE%D1%81%D1%82%D1%8C%D1%8E_%D0%B3%D0%BE%D0%BC%D0%BE%D0%BC%D0%BE%D1%80%D1%84%D0%BD%D0%BE%D0%B5_%D1%88%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5\">homomorfn\u00edho \u0161ifrov\u00e1n\u00ed<\/a><\/noindex>. P\u0159itom syst\u00e9m prov\u00e1d\u00ed v\u00fdpo\u010dty bez mo\u017enosti pochopit, co vlastn\u011b d\u011bl\u00e1. Bohu\u017eel, n\u00e1klady na implementaci takov\u00e9ho \u0161ifrov\u00e1n\u00ed jsou tak vysok\u00e9, \u017ee jejich praktick\u00e9 uplatn\u011bn\u00ed je v sou\u010dasnosti omezeno na velmi \u00fazk\u00e9 \u00fakoly.<\/p>\n<p>Nav\u00edc, v okam\u017eiku, kdy je virtu\u00e1ln\u00ed stroj spu\u0161t\u011bn a prov\u00e1d\u00ed n\u011bjak\u00e9 akce, jsou v\u0161echny za\u0161ifrovan\u00e9 objemy dostupn\u00e9, jinak by opera\u010dn\u00ed syst\u00e9m s nimi nemohl pracovat. To znamen\u00e1, \u017ee pokud m\u00e1te p\u0159\u00edstup k virtualiza\u010dn\u00ed konzoli, m\u016f\u017eete v\u017edy po\u0159\u00eddit sn\u00edmek b\u011b\u017e\u00edc\u00edho stroje a z\u00edskat v\u0161echny kl\u00ed\u010de z opera\u010dn\u00ed pam\u011bti.<\/p>\n<p>Mnoho v\u00fdrobc\u016f se pokusilo zav\u00e9st hardwarov\u00e9 \u0161ifrov\u00e1n\u00ed RAM, aby ani poskytovatel hostingu nem\u011bl p\u0159\u00edstup k t\u011bmto dat\u016fm. Nap\u0159\u00edklad technologie Intel Software Guard Extensions, kter\u00e1 vytv\u00e1\u0159\u00ed oblasti v virtu\u00e1ln\u00edm adresn\u00edm prostoru, chr\u00e1n\u011bn\u00e9 p\u0159ed \u010dten\u00edm a zapisov\u00e1n\u00edm zven\u010d\u00ed t\u011bmito oblastmi jin\u00fdmi procesy, v\u010detn\u011b j\u00e1dra opera\u010dn\u00edho syst\u00e9mu. Bohu\u017eel, tomuto technologii se nebudete moci pln\u011b d\u016fv\u011b\u0159ovat, proto\u017ee budete omezeni sv\u00fdm virtu\u00e1ln\u00edm strojem. Nav\u00edc ji\u017e existuj\u00ed konkr\u00e9tn\u00ed p\u0159\u00edklady <noindex><a rel=\"nofollow\" href=\"https:\/\/www.theregister.co.uk\/2017\/03\/07\/eggheads_slip_a_note_under_intels_door_sgx_can_leak_crypto_keys\/\">\u00fasp\u011b\u0161n\u00e9ho \u00fatoku<\/a><\/noindex> na tuto technologii. A p\u0159esto \u0161ifrov\u00e1n\u00ed virtu\u00e1ln\u00edch stroj\u016f nen\u00ed tak bezv\u00fdznamn\u00e9, jak by se mohlo zd\u00e1t.<\/p>\n<h2>\u0160ifrujeme data na VDS<\/h2>\n<p>\nHned na \u00favod mus\u00edm \u0159\u00edct, \u017ee v\u0161echno, co ud\u011bl\u00e1me n\u00ed\u017ee, nen\u00ed plnohodnotn\u00e1 ochrana. Hypervisor umo\u017en\u00ed prov\u00e9st pot\u0159ebn\u00e9 kopie bez zastaven\u00ed slu\u017eby a bez va\u0161eho v\u011bdom\u00ed.<\/p>\n<ul>\n<li>Pokud poskytovatel hostingu p\u0159ed\u00e1 \u201echladn\u00fd\u201c obraz va\u0161\u00ed virtu\u00e1ln\u00ed stroje na po\u017e\u00e1d\u00e1n\u00ed, jste relativn\u011b v bezpe\u010d\u00ed. To je nejb\u011b\u017en\u011bj\u0161\u00ed sc\u00e9n\u00e1\u0159.<\/li>\n<li>Pokud poskytovatel hostingu vyd\u00e1 \u00fapln\u00fd snapshot b\u011b\u017e\u00edc\u00edho stroje, situace nen\u00ed dobr\u00e1. V\u0161echna data budou na syst\u00e9mu p\u0159ipojena v otev\u0159en\u00e9m stavu. Krom\u011b toho se otev\u0159e mo\u017enost prozkoumat RAM za \u00fa\u010delem hled\u00e1n\u00ed priv\u00e1tn\u00edch kl\u00ed\u010d\u016f a podobn\u00fdch \u00fadaj\u016f.<\/li>\n<\/ul>\n<p>\nVe v\u00fdchoz\u00edm nastaven\u00ed, pokud jste nasadili OS z vanilla obrazu, poskytovatel hostingu nem\u00e1 root p\u0159\u00edstup. V\u017edy je mo\u017en\u00e9 p\u0159ipojit za\u0159\u00edzen\u00ed s rescue obrazem a zm\u011bnit heslo pro root, p\u0159i\u010dem\u017e dojde k chrootu do prost\u0159ed\u00ed virtu\u00e1ln\u00edho stroje. To v\u0161ak vy\u017eaduje restart, co\u017e bude zaznamen\u00e1no. Nav\u00edc v\u0161echny p\u0159ipojen\u00e9 \u0161ifrovan\u00e9 odd\u00edly budou uzav\u0159eny.<\/p>\n<p>Nicm\u00e9n\u011b, pokud je nasazen\u00ed virtu\u00e1ln\u00edho stroje provedeno z p\u0159edem p\u0159ipraven\u00e9ho obrazu a nikoliv z vanilla obrazu, poskytovatel \u010dasto m\u016f\u017ee p\u0159id\u00e1vat privilegovan\u00fd \u00fa\u010det pro pomoc v nouzov\u00fdch situac\u00edch pro klienta. Nap\u0159\u00edklad pro zm\u011bnu zapomenut\u00e9ho hesla pro root.<\/p>\n<p>I v p\u0159\u00edpad\u011b \u00fapln\u00e9ho snapshotu to nen\u00ed tak \u0161patn\u00e9. \u00dato\u010dn\u00edk nez\u00edsk\u00e1 \u0161ifrovan\u00e9 soubory, pokud jste je p\u0159ipojili z vzd\u00e1len\u00e9ho souborov\u00e9ho syst\u00e9mu jin\u00e9ho stroje. Ano, teoreticky je mo\u017en\u00e9 prozkoumat dump opera\u010dn\u00ed pam\u011bti a extrahovat kl\u00ed\u010de \u0161ifrov\u00e1n\u00ed odtud. Ale v praxi je to velmi netrivi\u00e1ln\u00ed a je velmi nepravd\u011bpodobn\u00e9, \u017ee by proces pokra\u010doval d\u00e1l ne\u017e k prost\u00e9mu p\u0159enosu soubor\u016f.<\/p>\n<h2>Objedn\u00e1v\u00e1me stroj<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/3a4c244720963e8da57e782aa53e2db0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro na\u0161e testovac\u00ed \u00fa\u010dely bereme jednoduch\u00fd stroj v <noindex><a rel=\"nofollow\" href=\"https:\/\/ruvds.com\/ru-rub#order\">sekci pro objedn\u00e1v\u00e1n\u00ed server\u016f<\/a><\/noindex>. Nepot\u0159ebujeme mnoho zdroj\u016f, tak\u017ee zvol\u00edme variantu s platbou za skute\u010dn\u011b spot\u0159ebovan\u00e9 megaherce a provoz. To by m\u011blo sta\u010dit na alespo\u0148 n\u011bjak\u00e9 pokusy.<\/p>\n<p>Klasick\u00fd dm-crypt pro cel\u00fd odd\u00edl selhal. Disk je ve v\u00fdchoz\u00edm nastaven\u00ed poskytov\u00e1n jako jeden kus, s rootem na cel\u00fd odd\u00edl. Zmen\u0161en\u00ed odd\u00edlu s ext4 na p\u0159ipojen\u00e9m rootu je prakticky zaru\u010den\u00fdm zp\u016fsobem, jak skon\u010dit s 'brickem' m\u00edsto souborov\u00e9ho syst\u00e9mu. Zkusil jsem to) Buben\u00edk nepomohl.<\/p>\n<h2>Vytv\u00e1\u0159\u00edme kryptokontejner<\/h2>\n<p>\nProto nebudeme \u0161ifrovat celou sekci, ale pou\u017eijeme souborov\u00e9 kryptokontejnery, konkr\u00e9tn\u011b auditovan\u00fd a spolehliv\u00fd VeraCrypt. To pro na\u0161e \u00fa\u010dely sta\u010d\u00ed. Nejprve st\u00e1hn\u011bte a nainstalujte bal\u00ed\u010dek s CLI verz\u00ed z ofici\u00e1ln\u00ed str\u00e1nky. M\u016f\u017eete z\u00e1rove\u0148 zkontrolovat podpis.<\/p>\n<pre><code class=\"bash\">wget https:\/\/launchpad.net\/veracrypt\/trunk\/1.24-update4\/+download\/veracrypt-console-1.24-Update4-Ubuntu-18.04-amd64.deb\ndpkg -i veracrypt-console-1.24-Update4-Ubuntu-18.04-amd64.deb\n<\/code><\/pre>\n<p>\nNyn\u00ed vytvo\u0159\u00edme samotn\u00fd kontejner n\u011bkde ve sv\u00e9 dom\u00e1c\u00ed slo\u017ece, abychom ho mohli p\u0159ipojit ru\u010dn\u011b po restartu. V interaktivn\u00ed variant\u011b ur\u010dete velikost kontejneru, heslo a \u0161ifrovac\u00ed algoritmy. M\u016f\u017eete zvolit vlasteneck\u00fd \u0161ifrovac\u00ed algoritmus Kuzn\u011b\u010dik a hash funkci Stribog.<\/p>\n<pre><code class=\"bash\">veracrypt -t -c ~\/my_super_secret<\/code><\/pre>\n<p>\nNyn\u00ed nainstalujme nginx, p\u0159ipojme kontejner a nahrajme do n\u011bj tajn\u00e9 informace.<\/p>\n<pre><code class=\"bash\">mkdir \/var\/www\/html\/images\nveracrypt ~\/my_super_secret \/var\/www\/html\/images\/\nwget https:\/\/upload.wikimedia.org\/wikipedia\/ru\/2\/24\/Lenna.png<\/code><\/pre>\n<p>\nTrochu uprav\u00edme \/var\/www\/html\/index.nginx-debian.html, abychom z\u00edskali po\u017eadovanou str\u00e1nku a mohli zkontrolovat.<\/p>\n<h2>P\u0159ipojujeme se a kontrolujeme<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/1b1567cfd45db0d6f8421e89c0617a3a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Kontejner je p\u0159ipojen, data jsou dostupn\u00e1 a odes\u00edlaj\u00ed se.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/216440e8f586886a6ce79dc2b8d76fb0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>A tady je stroj po restartu. Data jsou bezpe\u010dn\u011b ulo\u017eena v ~\/my_super_secret.<\/i><\/p>\n<p>Pokud je opravdu pot\u0159eba a chcete hardcore, m\u016f\u017eete za\u0161ifrovat cel\u00fd opera\u010dn\u00ed syst\u00e9m, aby po restartu vy\u017eadoval p\u0159ipojen\u00ed p\u0159es ssh a zad\u00e1n\u00ed hesla. I to bude sta\u010dit ve sc\u00e9n\u00e1\u0159i jednoduch\u00e9ho odejmut\u00ed \u201estuden\u00fdch dat\u201c. Tady <noindex><a rel=\"nofollow\" href=\"https:\/\/benediktkr.github.io\/ops\/2015\/05\/01\/remote-fde.html\">je n\u00e1vod na pou\u017eit\u00ed dropbear<\/a><\/noindex> a vzd\u00e1len\u00e9 \u0161ifrov\u00e1n\u00ed disk\u016f. I kdy\u017e v p\u0159\u00edpad\u011b VDS je to slo\u017eit\u00e9 a nadbyte\u010dn\u00e9.<\/p>\n<h2>Bare metal<\/h2>\n<p>\nNen\u00ed tak jednoduch\u00e9 um\u00edstit vlastn\u00ed server do datacentra. Ciz\u00ed dedicated m\u016f\u017ee b\u00fdt virtu\u00e1ln\u00ed stroj, do kter\u00e9ho jsou p\u0159ipojeny v\u0161echny za\u0159\u00edzen\u00ed. Ale n\u011bco zaj\u00edmav\u00e9ho v oblasti ochrany za\u010d\u00edn\u00e1, kdy\u017e m\u00e1te mo\u017enost um\u00edstit do datacentra sv\u016fj d\u016fv\u011bryhodn\u00fd fyzick\u00fd server. Zde je mo\u017en\u00e9 naplno vyu\u017e\u00edt tradi\u010dn\u00ed dm-crypt, VeraCrypt nebo jakoukoli jinou \u0161ifrovac\u00ed metodu podle va\u0161eho v\u00fdb\u011bru.<\/p>\n<p>Je t\u0159eba si uv\u011bdomit, \u017ee p\u0159i realizaci tot\u00e1ln\u00edho \u0161ifrov\u00e1n\u00ed server nebude schopen se s\u00e1m spustit po restartu. Bude nutn\u00e9 nav\u00e1zat p\u0159ipojen\u00ed k m\u00edstn\u00edmu rozhran\u00ed IP-KVM, IPMI nebo jin\u00e9mu podobn\u00e9mu analogov\u00e9mu za\u0159\u00edzen\u00ed. Pot\u00e9 ru\u010dn\u011b zad\u00e1me hlavn\u00ed kl\u00ed\u010d. Sch\u00e9ma vypad\u00e1 docela chab\u011b z hlediska kontinuity a odolnosti proti selh\u00e1n\u00ed, ale zde nejsou \u017e\u00e1dn\u00e9 v\u00fdznamn\u00e9 alternativy, pokud jsou data tak cenn\u00e1.<\/p>\n<p><img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/db32aac0efebed1bc71a2277b7f51244.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>NCipher nShield F3 Hardware Security Module<\/i><\/p>\n<p>M\u011bk\u010d\u00ed varianta p\u0159edpokl\u00e1d\u00e1, \u017ee jsou data \u0161ifrov\u00e1na a kl\u00ed\u010d se nach\u00e1z\u00ed p\u0159\u00edmo v serveru ve speci\u00e1ln\u00edm HSM (Hardware Security Module). Obvykle se jedn\u00e1 o velmi funk\u010dn\u00ed za\u0159\u00edzen\u00ed, kter\u00e1 nejen zaji\u0161\u0165uj\u00ed hardwarovou kryptografii, ale maj\u00ed tak\u00e9 mechanismy detekce pokus\u016f o fyzick\u00e9 naru\u0161en\u00ed. Pokud by n\u011bkdo za\u010dal hrabat ve va\u0161em serveru \u00fahlovou bruskou, HSM s nez\u00e1visl\u00fdm zdrojem nap\u00e1jen\u00ed resetuje kl\u00ed\u010de, kter\u00e9 uchov\u00e1v\u00e1 ve sv\u00e9 pam\u011bti. \u00dato\u010dn\u00edkovi z\u016fstanou \u0161ifrovan\u00e9 zbytky. P\u0159itom m\u016f\u017ee doj\u00edt k automatick\u00e9mu restartu.<\/p>\n<p>Odstran\u011bn\u00ed kl\u00ed\u010d\u016f je mnohem rychlej\u0161\u00ed a hum\u00e1nn\u011bj\u0161\u00ed varianta ne\u017e aktivace termitov\u00e9 n\u00e1lo\u017ee nebo elektromagnetick\u00e9ho v\u00fdboje. Za takov\u00e1 za\u0159\u00edzen\u00ed v\u00e1s dlouho budou b\u00edt sousedi v datacentru. O to v\u00edc, pokud pou\u017e\u00edv\u00e1te <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Opal_Storage_Specification\">TCG Opal 2<\/a><\/noindex> \u0161ifrov\u00e1n\u00ed na samotn\u00fdch nosi\u010d\u00edch prakticky nezp\u016fsobuje \u017e\u00e1dn\u00e9 zpo\u017ed\u011bn\u00ed. To v\u0161e prob\u00edh\u00e1 pr\u016fhledn\u011b pro opera\u010dn\u00ed syst\u00e9m. Pravda, mus\u00edte d\u016fv\u011b\u0159ovat hypotetick\u00e9mu Samsungu a doufat, \u017ee tam maj\u00ed poctiv\u00fd AES256, a ne prost\u00e9 XOR.<\/p>\n<p>P\u0159itom bychom nem\u011bli zapom\u00ednat, \u017ee v\u0161echny nadbyte\u010dn\u00e9 porty mus\u00ed b\u00fdt fyzicky odpojen\u00e9 nebo jednodu\u0161e zaplombovan\u00e9. Jinak d\u00e1v\u00e1te \u00fato\u010dn\u00edk\u016fm mo\u017enost prov\u00e9st <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/DMA_attack\">DMA \u00fatoky<\/a><\/noindex>. Pokud m\u00e1te venku vy\u010dn\u00edvaj\u00edc\u00ed PCI Express nebo Thunderbolt, v\u010detn\u011b USB s jeho podporou \u2013 jste zraniteln\u00ed. \u00dato\u010dn\u00edk bude schopen p\u0159es tyto porty prov\u00e9st \u00fatok a z\u00edskat p\u0159\u00edm\u00fd p\u0159\u00edstup do pam\u011bti s kl\u00ed\u010di.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"E6gzVVjW4yY\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/E6gzVVjW4yY\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>V je\u0161t\u011b rafinovan\u011bj\u0161\u00ed variant\u011b m\u016f\u017ee \u00fato\u010dn\u00edk prov\u00e9st cold boot \u00fatok. Prost\u011b nalije dobrou porci tekut\u00e9ho dus\u00edku na v\u00e1\u0161 server, hrub\u011b vyt\u00e1hne zmrazen\u00e9 pam\u011b\u0165ov\u00e9 moduly a ud\u011bl\u00e1 z nich dump se v\u0161emi kl\u00ed\u010di. \u010casto sta\u010d\u00ed pro proveden\u00ed \u00fatoku oby\u010dejn\u00fd chlad\u00edc\u00ed sprej a teplota kolem -50 stup\u0148\u016f. Existuje i \u0161etrn\u011bj\u0161\u00ed varianta. Pokud nejste odpojeni od bootov\u00e1n\u00ed z extern\u00edch za\u0159\u00edzen\u00ed, algoritmus \u00fato\u010dn\u00edka bude je\u0161t\u011b jednodu\u0161\u0161\u00ed:<\/p>\n<ol>\n<li>Zamrazit pam\u011b\u0165ov\u00e9 moduly bez otev\u0159en\u00ed sk\u0159\u00edn\u011b<\/li>\n<li>P\u0159ipojit svou bootovac\u00ed flash disk<\/li>\n<li>Speci\u00e1ln\u00edmi utilitami z\u00edskat data z opera\u010dn\u00ed pam\u011bti, kter\u00e1 p\u0159e\u017eila restart d\u00edky zamra\u017een\u00ed.<\/li>\n<\/ol>\n<p><\/p>\n<h2>D\u011blit a vl\u00e1dnout<\/h2>\n<p>\nOk, m\u00e1me jen virtu\u00e1ln\u00ed stroje, ale chceme alespo\u0148 n\u011bjak sn\u00ed\u017eit riziko \u00faniku dat.<br \/>\nM\u016f\u017eete v z\u00e1sad\u011b zv\u00e1\u017eit p\u0159epracov\u00e1n\u00ed architektury a odd\u011blen\u00ed ukl\u00e1d\u00e1n\u00ed dat a zpracov\u00e1n\u00ed do r\u016fzn\u00fdch jurisdikc\u00ed. Nap\u0159\u00edklad, frontend s \u0161ifrovac\u00edmi kl\u00ed\u010di u hostitele v \u010cesku a backend se za\u0161ifrovan\u00fdmi daty n\u011bkde v Rusku. V p\u0159\u00edpad\u011b standardn\u00edho pokusu o zabaven\u00ed je vysoce nepravd\u011bpodobn\u00e9, \u017ee by bezpe\u010dnostn\u00ed slo\u017eky mohly jednat sou\u010dasn\u011b v r\u016fzn\u00fdch jurisdikc\u00edch. Nav\u00edc n\u00e1s to \u010d\u00e1ste\u010dn\u011b chr\u00e1n\u00ed p\u0159ed sc\u00e9n\u00e1\u0159em s po\u0159\u00edzen\u00edm sn\u00edmku.<\/p>\n<p>Nebo m\u016f\u017eete zv\u00e1\u017eit zcela \u010distou variantu \u2014 End-to-End \u0161ifrov\u00e1n\u00ed. Samoz\u0159ejm\u011b to p\u0159esahuje r\u00e1mec zad\u00e1n\u00ed a neznamen\u00e1 vykon\u00e1v\u00e1n\u00ed v\u00fdpo\u010dt\u016f na stran\u011b vzd\u00e1len\u00e9ho stroje. Nicm\u00e9n\u011b, to je zcela p\u0159ijateln\u00e1 varianta, pokud jde o ukl\u00e1d\u00e1n\u00ed a synchronizaci dat. Nap\u0159\u00edklad, je to velmi pohodln\u011b implementov\u00e1no ve stejn\u00e9m Nextcloudu. P\u0159itom synchronizace, verzionov\u00e1n\u00ed a dal\u0161\u00ed vymo\u017eenosti serverov\u00e9 \u010d\u00e1sti nikam nezmiz\u00ed.<\/p>\n<h2>Celkem<\/h2>\n<p>\nNeexistuj\u00ed dokonale chr\u00e1n\u011bn\u00e9 syst\u00e9my. \u00dakolem je pouze u\u010dinit \u00fatok n\u00e1kladn\u011bj\u0161\u00edm ne\u017e potenci\u00e1ln\u00ed zisk.<\/p>\n<p>N\u011bjak\u00e9 sn\u00ed\u017een\u00ed rizika p\u0159\u00edstupu k dat\u016fm na virtu\u00e1ln\u00edm stroji lze dos\u00e1hnout kombinac\u00ed \u0161ifrov\u00e1n\u00ed a odd\u011blen\u00e9ho ukl\u00e1d\u00e1n\u00ed u r\u016fzn\u00fdch hostitel\u016f.<\/p>\n<p>Pom\u011brn\u011b spolehliv\u00e1 varianta \u2014 pou\u017eit\u00ed vlastn\u00edho fyzick\u00e9ho serveru.<\/p>\n<p>A hostiteli se budete muset tak \u010di onak d\u016fv\u011b\u0159ovat. Na tom je postaven cel\u00fd pr\u016fmysl.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=mekl&amp;utm_content=prishli-siloviki\"><img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/13474ad7e4e39f259f91f51f4fd1febc.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=mekl&amp;utm_content=prishli-siloviki#order\"><img decoding=\"async\" alt=\"Co d\u011blat, pokud k tv\u00e9mu hostiteli p\u0159i\u0161li siloviki\" src=\"\/wp-content\/uploads\/2020\/06\/92555b963c5ff5b7bf0393a1918c40dd.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506334\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u043a\u0434\u043f\u0432 \u2014 Reuters \u0415\u0441\u043b\u0438 \u0432\u044b \u0430\u0440\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440, \u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0443 \u0432\u0430\u0441 \u043d\u0430\u0434 \u043d\u0438\u043c \u043d\u0435\u0442. \u042d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043a \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u043b\u044e\u0434\u0438 \u0438 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u0432\u0430\u0448\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. \u0418 \u0445\u043e\u0441\u0442\u0435\u0440 \u0438\u0445 \u043e\u0442\u0434\u0430\u0441\u0442, \u0435\u0441\u043b\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043e \u043f\u043e \u0437\u0430\u043a\u043e\u043d\u0443. \u0412\u044b \u043e\u0447\u0435\u043d\u044c \u043d\u0435 \u0445\u043e\u0442\u0438\u0442\u0435, \u0447\u0442\u043e\u0431\u044b \u043b\u043e\u0433\u0438 \u0432\u0430\u0448\u0435\u0433\u043e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85142,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85141","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043a \u0442\u0432\u043e\u0435\u043c\u0443 \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043f\u0440\u0438\u0448\u043b\u0438 siloviki | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-13T11:42:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-13T11:42:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Co d\u011blat, pokud k va\u0161emu hostiteli p\u0159i\u0161li siloviki | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043a \u0442\u0432\u043e\u0435\u043c\u0443 \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043f\u0440\u0438\u0448\u043b\u0438 siloviki | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-13T11:42:24+00:00","article:modified_time":"2020-06-13T11:42:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85141","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:43:30","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=85141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85141\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/85142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=85141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=85141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=85141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}