{"id":85475,"date":"2020-06-16T13:42:55","date_gmt":"2020-06-16T11:42:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti"},"modified":"2020-06-16T13:42:55","modified_gmt":"2020-06-16T11:42:55","slug":"snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","title":{"rendered":"Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kdysi sta\u010dilo pro ochranu lok\u00e1ln\u00ed s\u00edt\u011b b\u011b\u017en\u00e9 firewall a antivirus, ale proti \u00fatok\u016fm modern\u00edch hacker\u016f a pandemii malwaru je takov\u00e1 sada u\u017e nedostate\u010dn\u011b efektivn\u00ed. Star\u00fd zn\u00e1m\u00fd firewall analyzuje pouze hlavi\u010dky paket\u016f a povoluje nebo blokuje je podle souboru form\u00e1ln\u00edch pravidel. O obsahu paket\u016f nic nev\u00ed, a proto nedok\u00e1\u017ee rozpoznat zd\u00e1nliv\u011b leg\u00e1ln\u00ed akce \u00fato\u010dn\u00edk\u016f. Antivirus ne v\u017edy zachyt\u00ed \u0161kodliv\u00fd software, a tak se p\u0159ed administr\u00e1torem objevuje \u00fakol sledovat anom\u00e1ln\u00ed aktivitu a v\u010das izolovat infikovan\u00e9 hostitele. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\"><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/06\/e5bf2d1eeec4b350c9a3b89fdf2a2475.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Existuje mnoho pokro\u010dil\u00fdch n\u00e1stroj\u016f, kter\u00e9 umo\u017e\u0148uj\u00ed chr\u00e1nit IT infrastrukturu spole\u010dnosti. Dnes si promluv\u00edme o syst\u00e9mech detekce a prevence naru\u0161en\u00ed s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem, kter\u00e9 lze implementovat bez nutnosti zakoupit drah\u00e9 vybaven\u00ed a softwarov\u00e9 licence.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Klasifikace IDS\/IPS<\/h2>\n<p>\nIDS (Intrusion Detection System) je syst\u00e9m ur\u010den\u00fd k registraci podez\u0159el\u00fdch akc\u00ed v s\u00edti nebo na jednotliv\u00e9m po\u010d\u00edta\u010di. Vede z\u00e1znamy ud\u00e1lost\u00ed a informuje odpov\u011bdn\u00e9ho pracovn\u00edka za informa\u010dn\u00ed bezpe\u010dnost. V r\u00e1mci IDS m\u016f\u017eeme vy\u010dlenit n\u00e1sleduj\u00edc\u00ed prvky:<\/p>\n<ul>\n<li>senzory pro sledov\u00e1n\u00ed s\u00ed\u0165ov\u00e9ho provozu, r\u016fzn\u00fdch z\u00e1znam\u016f atd.\u00a0<\/li>\n<li>analyza\u010dn\u00ed subsyst\u00e9m, kter\u00fd v z\u00edskan\u00fdch datech odhaluje zn\u00e1mky \u0161kodliv\u00e9ho vlivu;<\/li>\n<li>\u00falo\u017ei\u0161t\u011b pro shroma\u017e\u010fov\u00e1n\u00ed prim\u00e1rn\u00edch ud\u00e1lost\u00ed a v\u00fdsledk\u016f anal\u00fdzy;<\/li>\n<li>ovl\u00e1dac\u00ed konzoli.<\/li>\n<\/ul>\n<p>\nP\u016fvodn\u011b byly IDS klasifikov\u00e1ny podle um\u00edst\u011bn\u00ed: mohly b\u00fdt orientov\u00e1ny na ochranu jednotliv\u00fdch uzl\u016f (host-based nebo Host Intrusion Detection System \u2014 HIDS) nebo chr\u00e1nit celou firemn\u00ed s\u00ed\u0165 (network-based nebo Network Intrusion Detection System \u2014 NIDS). Je tak\u00e9 t\u0159eba zm\u00ednit tzv. APIDS (Application protocol-based IDS): ty sleduj\u00ed omezenou skupinu aplika\u010dn\u00edch protokol\u016f pro odhalen\u00ed specifick\u00fdch \u00fatok\u016f a nevykon\u00e1vaj\u00ed hlubokou anal\u00fdzu s\u00ed\u0165ov\u00fdch paket\u016f. Tyto produkty obvykle p\u0159ipom\u00ednaj\u00ed proxy a pou\u017e\u00edvaj\u00ed se k ochran\u011b konkr\u00e9tn\u00edch slu\u017eeb: webov\u00fdch server\u016f a webov\u00fdch aplikac\u00ed (nap\u0159. napsan\u00fdch v PHP), datab\u00e1zov\u00fdch server\u016f atd. Typick\u00fdm z\u00e1stupcem t\u00e9to t\u0159\u00eddy je mod_security pro webov\u00fd server Apache. <\/p>\n<p>Zaj\u00edm\u00e1me se p\u0159edev\u0161\u00edm o univerz\u00e1ln\u00ed NIDS, kter\u00e9 podporuj\u00ed \u0161irokou \u0161k\u00e1lu komunika\u010dn\u00edch protokol\u016f a technologii hlubok\u00e9 anal\u00fdzy paket\u016f DPI (Deep Packet Inspection). Tyto syst\u00e9my monitoruj\u00ed ve\u0161ker\u00fd proch\u00e1zej\u00edc\u00ed provoz od \u00farovn\u011b kan\u00e1lu a odhaluj\u00ed \u0161irok\u00e9 spektrum s\u00ed\u0165ov\u00fdch \u00fatok\u016f, stejn\u011b jako pokusy o neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k informac\u00edm. \u010casto se takov\u00e9 syst\u00e9my vyzna\u010duj\u00ed distribuovanou architekturou a mohou spolupracovat s r\u016fzn\u00fdm aktivn\u00edm s\u00ed\u0165ov\u00fdm vybaven\u00edm. Je t\u0159eba poznamenat, \u017ee mnoh\u00e9 modern\u00ed NIDS jsou hybridn\u00ed a kombinuj\u00ed n\u011bkolik p\u0159\u00edstup\u016f. V z\u00e1vislosti na konfiguraci a nastaven\u00edch mohou plnit r\u016fzn\u00e9 \u00fakoly \u2013 nap\u0159\u00edklad ochranu jednoho uzlu nebo cel\u00e9 s\u00edt\u011b. Nav\u00edc funkce IDS pro pracovn\u00ed stanice p\u0159evzaly antivirov\u00e9 bal\u00ed\u010dky, je\u017e se staly multifunk\u010dn\u00edmi firewally, kter\u00e9 tak\u00e9 \u0159e\u0161\u00ed \u00fakoly rozpozn\u00e1v\u00e1n\u00ed a blokov\u00e1n\u00ed podez\u0159el\u00e9ho provozu. <\/p>\n<p>Zpo\u010d\u00e1tku mohly IDS pouze detekovat \u010dinnost \u0161kodliv\u00e9ho softwaru, pr\u00e1ci skener\u016f port\u016f nebo poru\u0161ov\u00e1n\u00ed firemn\u00edch bezpe\u010dnostn\u00edch politik u\u017eivateli. P\u0159i v\u00fdskytu ur\u010dit\u00e9 ud\u00e1losti informovaly spr\u00e1vce, ale brzy se uk\u00e1zalo, \u017ee k rozpozn\u00e1n\u00ed \u00fatoku nesta\u010d\u00ed \u2013 je nutn\u00e9 jej zablokovat. Tak se IDS transformovaly na IPS (Intrusion Prevention Systems) \u2013 syst\u00e9my prevence naru\u0161en\u00ed, kter\u00e9 jsou schopny spolupracovat se s\u00ed\u0165ov\u00fdmi br\u00e1nami.<\/p>\n<h2>Metody detekce<\/h2>\n<p>\nModern\u00ed \u0159e\u0161en\u00ed pro detekci a prevenci naru\u0161en\u00ed pou\u017e\u00edvaj\u00ed r\u016fzn\u00e9 metody k ur\u010den\u00ed \u0161kodliv\u00e9 aktivity, kter\u00e9 lze rozd\u011blit do t\u0159\u00ed kategori\u00ed. To n\u00e1m d\u00e1v\u00e1 dal\u0161\u00ed mo\u017enost klasifikace syst\u00e9m\u016f:<\/p>\n<ul>\n<li>Signaturn\u00ed IDS\/IPS odhaluj\u00ed v provozu ur\u010dit\u00e9 vzory nebo sleduj\u00ed zm\u011bny stavu syst\u00e9m\u016f, aby ur\u010dili s\u00ed\u0165ov\u00fd \u00fatok nebo pokus o n\u00e1kazu. Prakticky nezp\u016fsobuj\u00ed fale\u0161n\u00e9 poplachy, ale nejsou schopny odhalit nezn\u00e1m\u00e9 hrozby.<\/li>\n<li>Syst\u00e9my IDS pro detekci anom\u00e1li\u00ed nepou\u017e\u00edvaj\u00ed \u00fato\u010dn\u00e9 signatury. Rozpozn\u00e1vaj\u00ed chov\u00e1n\u00ed informa\u010dn\u00edch syst\u00e9m\u016f, kter\u00e9 se odchyluje od normy (v\u010detn\u011b anom\u00e1li\u00ed v s\u00ed\u0165ov\u00e9m provozu), a dok\u00e1\u017eou identifikovat i nezn\u00e1m\u00e9 \u00fatoky. Tyto syst\u00e9my generuj\u00ed pom\u011brn\u011b mnoho fale\u0161n\u00fdch poplach\u016f a p\u0159i nevhodn\u00e9m pou\u017eit\u00ed mohou paralyzovat fungov\u00e1n\u00ed m\u00edstn\u00ed s\u00edt\u011b.<\/li>\n<li>Syst\u00e9my IDS zalo\u017een\u00e9 na pravidlech funguj\u00ed na principu: pokud FAKT, pak AKCE. V podstat\u011b se jedn\u00e1 o expertn\u00ed syst\u00e9my s datab\u00e1zemi znalost\u00ed \u2014 souhrn\u00e9m fakt\u016f a pravidel logick\u00e9ho odvozen\u00ed. Tato \u0159e\u0161en\u00ed jsou n\u00e1ro\u010dn\u00e1 na nastaven\u00ed a vy\u017eaduj\u00ed od administr\u00e1tora podrobn\u00e9 porozum\u011bn\u00ed fungov\u00e1n\u00ed s\u00edt\u011b.\u00a0<\/li>\n<\/ul>\n<p><\/p>\n<h2>Historie v\u00fdvoje IDS<\/h2>\n<p>\nEra rychl\u00e9ho rozvoje internetu a podnikov\u00fdch s\u00edt\u00ed za\u010dala v 90. letech minul\u00e9ho stolet\u00ed, av\u0161ak pokro\u010dil\u00e9 technologie s\u00ed\u0165ov\u00e9 bezpe\u010dnosti za\u010dali odborn\u00edci \u0159e\u0161it o n\u011bco d\u0159\u00edve. V roce 1986 publikovali Dorothy Denning a Peter Neumann model IDES (Intrusion Detection Expert System), kter\u00fd se stal z\u00e1kladem v\u011bt\u0161iny modern\u00edch syst\u00e9m\u016f detekce pr\u016fnik\u016f. Tento syst\u00e9m vyu\u017e\u00edval expertn\u00ed syst\u00e9m k identifikaci zn\u00e1m\u00fdch typ\u016f \u00fatok\u016f, stejn\u011b jako statistick\u00e9 metody a profily u\u017eivatel\u016f\/syst\u00e9m\u016f. IDES byla spu\u0161t\u011bna na pracovn\u00edch stanic\u00edch Sun, kontroluj\u00edc\u00ed s\u00ed\u0165ov\u00fd provoz a data aplikac\u00ed. V roce 1993 byla vyd\u00e1na NIDES (Next-generation Intrusion Detection Expert System) \u2014 expertn\u00ed syst\u00e9m nov\u00e9ho typu pro detekci pr\u016fnik\u016f.<\/p>\n<p>Na z\u00e1klad\u011b prac\u00ed Deninga a Neimana vznikl v roce 1988 expertn\u00ed syst\u00e9m MIDAS (Multics intrusion detection and alerting system), kter\u00fd vyu\u017e\u00edv\u00e1 P-BEST a LISP. V t\u00e9 dob\u011b byla tak\u00e9 vytvo\u0159ena na statistick\u00fdch metod\u00e1ch zalo\u017een\u00e1 syst\u00e9m Haystack. Dal\u0161\u00ed statistick\u00fd detektor anom\u00e1li\u00ed W&amp;S (Wisdom &amp; Sense) byl vyvinut o rok pozd\u011bji v N\u00e1rodn\u00ed laborato\u0159i Los Alamos. Rozvoj oboru prob\u00edhal rychl\u00fdm tempem. Nap\u0159\u00edklad v roce 1990 byl v syst\u00e9mu TIM (Time-based inductive machine) implementov\u00e1n detekce anom\u00e1li\u00ed s vyu\u017eit\u00edm induktivn\u00edho u\u010den\u00ed na sekven\u010dn\u00edch vzorc\u00edch u\u017eivatele (jazyk Common LISP). NSM (Network Security Monitor) pro detekci anom\u00e1li\u00ed porovn\u00e1val p\u0159\u00edstupov\u00e9 matice a ISOA (Information Security Officer\u2019s Assistant) podporoval r\u016fzn\u00e9 strategie detekce: statistick\u00e9 metody, kontrolu profilu a expertn\u00ed syst\u00e9m. Syst\u00e9m ComputerWatch vytvo\u0159en\u00fd v AT&amp;T Bell Labs pou\u017e\u00edval pro kontrolu jak statistick\u00e9 metody, tak i pravidla, a prvn\u00ed prototyp distribuovan\u00e9ho IDS vyvinuli v\u00fdvoj\u00e1\u0159i z Kalifornsk\u00e9 univerzity ji\u017e v roce 1991 \u2014 DIDS (Distributed intrusion detection system) byla z\u00e1rove\u0148 expertn\u00edm syst\u00e9mem.<\/p>\n<p>Zpo\u010d\u00e1tku byly IDS propriet\u00e1rn\u00ed, ale ji\u017e v roce 1998 N\u00e1rodn\u00ed laborato\u0159 Lawrence Berkeley uvedla Bro (v roce 2018 byla p\u0159ejmenov\u00e1na na Zeek) \u2014 syst\u00e9m s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem, kter\u00fd pou\u017e\u00edv\u00e1 vlastn\u00ed pravidlov\u00fd jazyk pro anal\u00fdzu dat libpcap. V listopadu t\u00e9ho\u017e roku se objevil sniffer paket\u016f APE, kter\u00fd vyu\u017e\u00edval libpcap a o m\u011bs\u00edc pozd\u011bji byl p\u0159ejmenov\u00e1n na Snort, a pozd\u011bji se stal plnohodnotn\u00fdm IDS\/IPS. Tehdy za\u010daly vznikat tak\u00e9 mnoh\u00e9 propriet\u00e1rn\u00ed \u0159e\u0161en\u00ed. <\/p>\n<h2>Snort a Suricata<\/h2>\n<p>\nV mnoha spole\u010dnostech maj\u00ed preference pro bezplatn\u00e9 IDS\/IPS s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem. Dlouhou dobu bylo standardn\u00edm \u0159e\u0161en\u00edm ji\u017e zm\u00edn\u011bn\u00e9 Snort, ale v sou\u010dasnosti ji nahradila syst\u00e9m Suricata. Pod\u00edvejme se na jejich v\u00fdhody a nev\u00fdhody podrobn\u011bji. Snort kombinuje v\u00fdhody signaturn\u00ed metody s mo\u017enost\u00ed detekce anom\u00e1li\u00ed v re\u00e1ln\u00e9m \u010dase. Suricata tak\u00e9 umo\u017e\u0148uje pou\u017e\u00edt jin\u00e9 metody krom\u011b rozpozn\u00e1v\u00e1n\u00ed \u00fatok\u016f na z\u00e1klad\u011b signatur. Syst\u00e9m byl vytvo\u0159en od\u0161t\u011bpenou skupinou v\u00fdvoj\u00e1\u0159\u016f projektu Snort a podporuje funkce IPS od verze 1.4, zat\u00edmco ve Snort mo\u017enost prevence \u00fatok\u016f p\u0159i\u0161la pozd\u011bji. <\/p>\n<p>Hlavn\u00edm rozd\u00edlem mezi dv\u011bma popul\u00e1rn\u00edmi produkty je, \u017ee Suricata m\u00e1 mo\u017enost vyu\u017eit\u00ed GPU pro v\u00fdpo\u010dty v re\u017eimu IDS, a tak\u00e9 m\u00e1 pokro\u010dilej\u0161\u00ed IPS. Syst\u00e9m je p\u016fvodn\u011b navr\u017een pro v\u00edcerozm\u011brnost, zat\u00edmco Snort je produkt pro jednorozm\u011brn\u00e9 zpracov\u00e1n\u00ed. D\u00edky sv\u00e9 dlouh\u00e9 historii a zd\u011bd\u011bn\u00e9mu k\u00f3du nevyu\u017e\u00edv\u00e1 optim\u00e1ln\u011b v\u00edcej\u00e1drov\u00e9 v\u00edcerozm\u011brn\u00e9 hardwarov\u00e9 platformy, zat\u00edmco Suricata na b\u011b\u017en\u00fdch osobn\u00edch po\u010d\u00edta\u010d\u00edch umo\u017e\u0148uje zpracov\u00e1n\u00ed datov\u00e9ho toku a\u017e 10 Gbit\/s. O podobnostech a rozd\u00edlech obou syst\u00e9m\u016f by se dalo dlouho diskutovat, ale i kdy\u017e Suricata b\u011b\u017e\u00ed rychleji, pro \u00fazk\u00e9 kan\u00e1ly to nem\u00e1 z\u00e1sadn\u00ed v\u00fdznam.<\/p>\n<h2>Mo\u017enosti nasazen\u00ed<\/h2>\n<p>\nIPS by m\u011bla b\u00fdt um\u00edst\u011bna tak, aby syst\u00e9m mohl sledovat kontrolovan\u00e9 \u010d\u00e1sti s\u00edt\u011b. Nej\u010dast\u011bji to je dedikovan\u00fd po\u010d\u00edta\u010d, jeho\u017e jedno rozhran\u00ed je p\u0159ipojeno za hranicemi za\u0159\u00edzen\u00ed a \u201ed\u00edv\u00e1 se\u201c p\u0159es n\u011b do nezabezpe\u010den\u00fdch ve\u0159ejn\u00fdch s\u00edt\u00ed (Internet). Druh\u00e9 rozhran\u00ed IPS je p\u0159ipojeno na vstup chr\u00e1n\u011bn\u00e9 \u010d\u00e1sti, aby ve\u0161ker\u00fd provoz proch\u00e1zel syst\u00e9mem a byl analyzov\u00e1n. V komplikovan\u011bj\u0161\u00edch p\u0159\u00edpadech chr\u00e1n\u011bn\u00fdch segment\u016f jich m\u016f\u017ee b\u00fdt n\u011bkolik: nap\u0159\u00edklad v podnikov\u00fdch s\u00edt\u00edch se \u010dasto vy\u010dle\u0148uje demilitarizovan\u00e1 z\u00f3na (DMZ) s ve\u0159ejn\u011b dostupn\u00fdmi slu\u017ebami z Internetu. <\/p>\n<p><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/06\/15e2e449a81eedea09032718ff4a1bc9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTakov\u00e1 IPS m\u016f\u017ee zabr\u00e1nit pokus\u016fm o skenov\u00e1n\u00ed port\u016f nebo prolomen\u00ed hesel, vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed v po\u0161tovn\u00edm serveru, webov\u00e9m serveru nebo skriptech, stejn\u011b jako dal\u0161\u00edm typ\u016fm extern\u00edch \u00fatok\u016f. V p\u0159\u00edpad\u011b, \u017ee po\u010d\u00edta\u010de v m\u00edstn\u00ed s\u00edti budou napadeny \u0161kodliv\u00fdm softwarem, IDS jim zabr\u00e1n\u00ed nav\u00e1zat spojen\u00ed s venkovn\u00edmi servery botnetu. Pro d\u016fkladn\u011bj\u0161\u00ed ochranu vnit\u0159n\u00ed s\u00edt\u011b bude pravd\u011bpodobn\u011b vy\u017eadov\u00e1na slo\u017eit\u00e1 konfigurace s distribuovan\u00fdm syst\u00e9mem a n\u00e1kladn\u00fdmi spravovan\u00fdmi p\u0159ep\u00edna\u010di schopn\u00fdmi zrcadlit provoz pro p\u0159ipojen\u00e9 rozhran\u00ed IDS na jednom z port\u016f.<\/p>\n<p>\u010casto jsou podnikov\u00e9 s\u00edt\u011b vystaveny distribuovan\u00fdm \u00fatok\u016fm zam\u011b\u0159en\u00fdm na odm\u00edtnut\u00ed slu\u017eby (DDoS). A\u010dkoliv modern\u00ed IDS dok\u00e1\u017eou s nimi bojovat, v\u00fd\u0161e uveden\u00fd zp\u016fsob nasazen\u00ed zde jen st\u011b\u017e\u00ed pom\u016f\u017ee. Syst\u00e9m rozpozn\u00e1v\u00e1 \u0161kodlivou aktivitu a blokuje parazitn\u00ed provoz, ale k tomu mus\u00ed pakety proj\u00edt extern\u00edm internetov\u00fdm p\u0159ipojen\u00edm a dostat se na jeho s\u00ed\u0165ov\u00e9 rozhran\u00ed. V z\u00e1vislosti na intenzit\u011b \u00fatoku nemus\u00ed datov\u00fd kan\u00e1l zvl\u00e1dnout z\u00e1t\u011b\u017e a c\u00edl \u00fato\u010dn\u00edk\u016f bude dosa\u017een. Pro takov\u00e9 p\u0159\u00edpady doporu\u010dujeme nasadit IDS na virtu\u00e1ln\u00edm serveru s v\u00fdrazn\u011b v\u00fdkonn\u011bj\u0161\u00edm internetov\u00fdm p\u0159ipojen\u00edm. P\u0159ipojen\u00ed VPS k lok\u00e1ln\u00ed s\u00edti je mo\u017en\u00e9 p\u0159es VPN, a pot\u00e9 je t\u0159eba nastavit sm\u011brov\u00e1n\u00ed ve\u0161ker\u00e9ho extern\u00edho provozu. Pak v p\u0159\u00edpad\u011b DDoS \u00fatoku nebude t\u0159eba pos\u00edlat pakety p\u0159es p\u0159ipojen\u00ed k poskytovateli, budou zablokov\u00e1ny na extern\u00edm uzlu.<\/p>\n<p><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/06\/7ced164023bf2aa37e676d460804d6da.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Probl\u00e9m volby<\/h2>\n<p>\nZjistit l\u00eddra mezi bezplatn\u00fdmi syst\u00e9my je velmi obt\u00ed\u017en\u00e9. V\u00fdb\u011br IDS\/IPS z\u00e1vis\u00ed na topologii s\u00edt\u011b, pot\u0159ebn\u00fdch funkc\u00edch ochrany, stejn\u011b jako na osobn\u00edch preferenc\u00edch administr\u00e1tora a jeho ochot\u011b se zab\u00fdvat nastaven\u00edmi. Snort m\u00e1 del\u0161\u00ed historii a je l\u00e9pe zdokumentov\u00e1n, a\u010dkoli informace o Suricat\u011b tak\u00e9 nejsou t\u011b\u017eko dostupn\u00e9 na internetu. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b k osvojov\u00e1n\u00ed syst\u00e9mu bude t\u0159eba vynalo\u017eit ur\u010dit\u00e9 \u00fasil\u00ed, kter\u00e9 se nakonec vr\u00e1t\u00ed \u2014 komer\u010dn\u00ed hardwarov\u00e9 a hardwarov\u011b-softwarov\u00e9 IDS\/IPS stoj\u00ed dost draho a ne v\u017edy se vejdou do rozpo\u010dtu. Nevyplat\u00ed se litovat ztracen\u00e9ho \u010dasu, proto\u017ee dobr\u00fd administr\u00e1tor v\u017edy zvy\u0161uje kvalifikaci na \u00fa\u010det zam\u011bstnavatele. V t\u00e9to situaci maj\u00ed v\u0161ichni zisk. V n\u00e1sleduj\u00edc\u00edm \u010dl\u00e1nku se pod\u00edv\u00e1me na n\u011bkter\u00e9 mo\u017enosti nasazen\u00ed Suricaty a v praxi porovn\u00e1me modern\u011bj\u0161\u00ed syst\u00e9m s klasick\u00fdm IDS\/IPS Snort.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata\"><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/06\/19f0fd87faf30e31d34e2a10421514da.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata#order\"><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2020\/06\/a5fe3bac97102322110b9d0e33f3919c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85476,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort nebo Suricata. \u010c\u00e1st 1: vyb\u00edr\u00e1me bezplatnou IDS\/IPS pro ochranu podnikov\u00e9 s\u00edt\u011b | ProHoster","description":"D\u0159\u00edve bylo k ochran\u011b m\u00edstn\u00ed s\u00edt\u011b dosta\u010duj\u00edc\u00ed b\u011b\u017en\u00e9 firewall a antivirov\u00e9 programy, ale proti \u00fatok\u016fm modern\u00edch hacker\u016f a rozmno\u017een\u00e9 malware posledn\u00ed doby u\u017e tento soubor nen\u00ed dostate\u010dn\u00fd.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-16T11:42:55+00:00","article:modified_time":"2020-06-16T11:42:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85475","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:36:28","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=85475"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85475\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/85476"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=85475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=85475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=85475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}