{"id":85990,"date":"2020-06-21T01:42:12","date_gmt":"2020-06-20T23:42:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata"},"modified":"2020-06-21T01:42:12","modified_gmt":"2020-06-20T23:42:12","slug":"snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","title":{"rendered":"Snort nebo Suricata. \u010c\u00e1st 2: instalace a po\u010d\u00e1te\u010dn\u00ed nastaven\u00ed Suricaty","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Podle statistik se objem s\u00ed\u0165ov\u00e9ho provozu ka\u017ed\u00fd rok zvy\u0161uje p\u0159ibli\u017en\u011b o 50 %. To vede k n\u00e1r\u016fstu z\u00e1t\u011b\u017ee na za\u0159\u00edzen\u00ed a konkr\u00e9tn\u011b zvy\u0161uje po\u017eadavky na v\u00fdkon IDS\/IPS. M\u016f\u017eete si zakoupit drah\u00e9 specializovan\u00e9 hardwarov\u00e9 vybaven\u00ed, ale existuje i levn\u011bj\u0161\u00ed varianta \u2014 implementace jednoho z otev\u0159en\u00fdch syst\u00e9m\u016f. Mnoho za\u010d\u00ednaj\u00edc\u00edch administr\u00e1tor\u016f si mysl\u00ed, \u017ee instalace a konfigurace bezplatn\u00e9ho IPS je pom\u011brn\u011b slo\u017eit\u00e1. V p\u0159\u00edpad\u011b Suricaty to v\u0161ak nen\u00ed \u00fapln\u011b pravda \u2014 jej\u00ed instalace a za\u010d\u00e1tek ochrany proti typick\u00fdm \u00fatok\u016fm s pou\u017eit\u00edm sady bezplatn\u00fdch pravidel m\u016f\u017ee trvat jen n\u011bkolik minut.<\/p>\n

\"Snort<\/a><\/noindex><\/a><\/noindex>
\nSnort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b<\/a><\/noindex><\/p>\n

Pro\u010d pot\u0159ebujeme dal\u0161\u00ed otev\u0159en\u00e9 IPS?<\/h2>\n

\nSyst\u00e9m Snort, kter\u00fd byl dlouho pova\u017eov\u00e1n za standard, se vyv\u00edj\u00ed od konce devades\u00e1t\u00fdch let, a proto byl p\u016fvodn\u011b jednovl\u00e1knov\u00fd. B\u011bhem mnoha let nabyl v\u0161ech modern\u00edch funkc\u00ed, jako je podpora IPv6, mo\u017enost anal\u00fdzy protokol\u016f aplika\u010dn\u00ed vrstvy \u010di univerz\u00e1ln\u00ed modul pro p\u0159\u00edstup k dat\u016fm. <\/p>\n

Z\u00e1kladn\u00ed engin Snort 2.X se nau\u010dil pracovat s v\u00edce j\u00e1dry, p\u0159esto z\u016fstal jednovl\u00e1knov\u00fd a nem\u016f\u017ee tak optim\u00e1ln\u011b vyu\u017e\u00edt v\u00fdhody modern\u00edch hardwarov\u00fdch platforem. <\/p>\n

Tento probl\u00e9m byl vy\u0159e\u0161en ve t\u0159et\u00ed verzi syst\u00e9mu, av\u0161ak p\u0159\u00edprava trvala tak dlouho, \u017ee na trh vstoupila Suricata, napsan\u00e1 od z\u00e1klad\u016f. Jej\u00edm v\u00fdvojem byla zah\u00e1jena v roce 2009 jako v\u00edcevl\u00e1knov\u00e1 alternativa k Snortu, kter\u00e1 od samotn\u00e9ho za\u010d\u00e1tku nab\u00edzela funk\u010dnost IPS. K\u00f3d je distribuov\u00e1n pod licenc\u00ed GPLv2, ale finan\u010dn\u00ed partne\u0159i projektu maj\u00ed p\u0159\u00edstup k uzav\u0159en\u00e9 verzi enginu. N\u011bkter\u00e9 probl\u00e9my se \u0161k\u00e1lovatelnost\u00ed v prvn\u00edch verz\u00edch syst\u00e9mu se objevily, ale byly rychle vy\u0159e\u0161eny.<\/p>\n

Pro\u010d Suricata?<\/h2>\n

\nSuricata m\u00e1 n\u011bkolik modul\u016f (jako Snort): pro zachyt\u00e1v\u00e1n\u00ed, sb\u011br, dek\u00f3dov\u00e1n\u00ed, detekci a v\u00fdstup. Ve v\u00fdchoz\u00edm nastaven\u00ed proch\u00e1zej\u00ed zachycen\u00e9 pakety dek\u00f3dov\u00e1n\u00edm jedn\u00edm vl\u00e1knem, i kdy\u017e to v\u00edce zat\u011b\u017euje syst\u00e9m. V p\u0159\u00edpad\u011b pot\u0159eby lze vl\u00e1kna rozd\u011blit v nastaven\u00ed a distribuovat mezi procesory \u2014 Suricata se velmi dob\u0159e optimalizuje na konkr\u00e9tn\u00ed hardware, i kdy\u017e to u\u017e nen\u00ed \u00farove\u0148 HOWTO pro za\u010d\u00e1te\u010dn\u00edky. Tak\u00e9 stoj\u00ed za zm\u00ednku, \u017ee Suricata obsahuje pokro\u010dil\u00e9 prost\u0159edky pro inspekci HTTP zalo\u017een\u00e9 na knihovn\u011b HTP. Ty mohou b\u00fdt tak\u00e9 pou\u017eity pro protokolov\u00e1n\u00ed provozu bez detekce. Syst\u00e9m tak\u00e9 podporuje dek\u00f3dov\u00e1n\u00ed IPv6, v\u010detn\u011b tunel\u016f IPv4-in-IPv6, IPv6-in-IPv6 a dal\u0161\u00edch. <\/p>\n

Pro zachyt\u00e1v\u00e1n\u00ed datov\u00e9ho toku mohou b\u00fdt pou\u017eity r\u016fzn\u00e9 rozhran\u00ed (NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING), a v re\u017eimu Unix Socket je mo\u017en\u00e9 automaticky analyzovat soubory PCAP, kter\u00e9 byly zachyceny jin\u00fdm snifferem. Modul\u00e1rn\u00ed architektura Suricaty tak\u00e9 usnad\u0148uje p\u0159ipojen\u00ed nov\u00fdch prvk\u016f pro zachyt\u00e1v\u00e1n\u00ed, dek\u00f3dov\u00e1n\u00ed, anal\u00fdzu a zpracov\u00e1n\u00ed s\u00ed\u0165ov\u00fdch paket\u016f. Je tak\u00e9 d\u016fle\u017eit\u00e9 poznamenat, \u017ee v Suricat\u011b se blokov\u00e1n\u00ed datov\u00e9ho toku prov\u00e1d\u00ed prost\u0159edky standardn\u00edho filtru opera\u010dn\u00edho syst\u00e9mu. V GNU\/Linux jsou k dispozici dv\u011b varianty IPS: prost\u0159ednictv\u00edm fronty NFQUEUE (re\u017eim NFQ) a prost\u0159ednictv\u00edm zero copy (re\u017eim AF_PACKET). V prvn\u00edm p\u0159\u00edpad\u011b paket, kter\u00fd vstupuje do iptables, je sm\u011brov\u00e1n do fronty NFQUEUE, kde m\u016f\u017ee b\u00fdt zpracov\u00e1n na u\u017eivatelsk\u00e9 \u00farovni. Suricata ho zpracov\u00e1v\u00e1 podle sv\u00fdch pravidel a vyjad\u0159uje jeden ze t\u0159\u00ed verdikt\u016f: NF_ACCEPT, NF_DROP a NF_REPEAT. Prvn\u00ed dv\u011b vysv\u011btlen\u00ed nevy\u017eaduj\u00ed, zat\u00edmco posledn\u00ed umo\u017e\u0148uje ozna\u010dovat pakety a poslat je na za\u010d\u00e1tek aktu\u00e1ln\u00ed tabulky iptables. Re\u017eim AF_PACKET se vyzna\u010duje vy\u0161\u0161\u00ed rychlost\u00ed, ale na syst\u00e9m klade ur\u010dit\u00e9 omezen\u00ed: mus\u00ed m\u00edt dv\u011b s\u00ed\u0165ov\u00e1 rozhran\u00ed a fungovat jako br\u00e1na. Zablokovan\u00fd paket se prost\u011b neodes\u00edl\u00e1 na druh\u00e9 rozhran\u00ed. <\/p>\n

Hlavn\u00ed vlastnost Suricaty spo\u010d\u00edv\u00e1 v mo\u017enosti vyu\u017eit\u00ed pravidel vytvo\u0159en\u00fdch pro Snort. Administr\u00e1tor m\u00e1 k dispozici nap\u0159\u00edklad sady pravidel Sourcefire VRT a OpenSource Emerging Threats, stejn\u011b jako komer\u010dn\u00ed Emerging Threats Pro. Unified output lze analyzovat pomoc\u00ed popul\u00e1rn\u00edch backend\u016f a tak\u00e9 je podporov\u00e1n v\u00fdstup v PCAP a Syslog. Nastaven\u00ed syst\u00e9mu a pravidla jsou ulo\u017eena v souborech ve form\u00e1tu YAML, kter\u00fd je snadno \u010diteln\u00fd a m\u016f\u017ee b\u00fdt automaticky zpracov\u00e1n. Engine Suricata rozpozn\u00e1v\u00e1 mnoho protokol\u016f, tak\u017ee nen\u00ed t\u0159eba v pravidlech odkazovat na \u010d\u00edsla port\u016f. D\u00e1le je v pravidlech Suricaty aktivn\u011b pou\u017e\u00edv\u00e1na koncepce flowbits. Pro sledov\u00e1n\u00ed aktivace se pou\u017e\u00edvaj\u00ed prom\u011bnn\u00e9 relac\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed vytv\u00e1\u0159et a pou\u017e\u00edvat r\u016fzn\u00e9 po\u010d\u00edtadla a flagy. Mnoho IDS pova\u017euje r\u016fzn\u00e9 TCP p\u0159ipojen\u00ed za samostatn\u00e9 entity a nemus\u00ed si v\u0161imnout vazeb mezi nimi, kter\u00e9 nazna\u010duj\u00ed za\u010d\u00e1tek \u00fatoku. Suricata se sna\u017e\u00ed vid\u011bt celkov\u00fd obraz a ve mnoha p\u0159\u00edpadech rozpozn\u00e1v\u00e1 \u0161kodliv\u00fd provoz rozlo\u017een\u00fd mezi r\u016fzn\u00e1 p\u0159ipojen\u00ed. O jej\u00edch v\u00fdhod\u00e1ch se d\u00e1 dlouho hovo\u0159it, rad\u011bji p\u0159ejdeme k instalaci a konfiguraci.<\/p>\n

Jak nainstalovat?<\/h2>\n

\nNainstalujeme Suricatu na virtu\u00e1ln\u00edm serveru b\u011b\u017e\u00edc\u00edm na Ubuntu 18.04 LTS. V\u0161echny p\u0159\u00edkazy je t\u0159eba prov\u00e1d\u011bt z pozice superu\u017eivatele (root). Nejbezpe\u010dn\u011bj\u0161\u00ed variantou je p\u0159ipojit se k serveru p\u0159es SSH s pr\u00e1vy b\u011b\u017en\u00e9ho u\u017eivatele a pot\u00e9 pou\u017e\u00edt utilitu sudo pro zv\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed. Nejprve je t\u0159eba nainstalovat bal\u00ed\u010dky, kter\u00e9 budeme pot\u0159ebovat:<\/p>\n

sudo apt -y install libpcre3 libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config libnetfilter-queue-dev geoip-bin geoip-database geoipupdate apt-transport-https<\/code><\/pre>\n
\nP\u0159ipoj\u00edme extern\u00ed repozit\u00e1\u0159:<\/p>\n
sudo add-apt-repository ppa:oisf\/suricata-stable\nsudo apt-get update<\/code><\/pre>\n
\nNainstalujeme posledn\u00ed stabiln\u00ed verzi Suricaty:<\/p>\n
sudo apt-get install suricata<\/code><\/pre>\n
\nV p\u0159\u00edpad\u011b pot\u0159eby uprav\u00edme konfigura\u010dn\u00ed soubory a nahrad\u00edme v\u00fdchoz\u00ed eth0 skute\u010dn\u00fdm n\u00e1zvem extern\u00edho rozhran\u00ed serveru. V\u00fdchoz\u00ed nastaven\u00ed jsou ulo\u017eena v souboru \/etc\/default\/suricata a u\u017eivatelsk\u00e1 nastaven\u00ed v \/etc\/suricata\/suricata.yaml. Konfigurace IDS je v\u011bt\u0161inou o \u00faprav\u011b tohoto konfigura\u010dn\u00edho souboru. Obsahuje mnoho parametr\u016f, kter\u00e9 n\u00e1zvem a \u00fa\u010delem odpov\u00eddaj\u00ed obdob\u00e1m ze Snort. Syntaxe je v\u0161ak zcela jin\u00e1, ale soubor se \u010dte mnohem sn\u00e1ze ne\u017e konfigurace Snort, nav\u00edc je dob\u0159e okomentovan\u00fd.<\/p>\n
sudo nano \/etc\/default\/suricata<\/code><\/pre>\n
\n\"Snort
\n
\na<\/p>\n
sudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n
\n\"Snort
\n
\nPozor! P\u0159ed spu\u0161t\u011bn\u00edm je dobr\u00e9 zkontrolovat hodnoty prom\u011bnn\u00fdch v sekci vars.<\/p>\n
K dokon\u010den\u00ed nastaven\u00ed je nutn\u00e9 nainstalovat suricata-update pro aktualizaci a stahov\u00e1n\u00ed pravidel. Ud\u011blat to je docela jednoduch\u00e9:<\/p>\n
sudo apt install python-pip\nsudo pip install pyyaml\nsudo pip install <a href="https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip">https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip<\/a>\nsudo pip install --pre --upgrade suricata-update<\/code><\/pre>\n
\nPot\u00e9 je t\u0159eba spustit p\u0159\u00edkaz suricata-update k instalaci souboru pravidel Emerging Threats Open:<\/p>\n
sudo suricata-update<\/code><\/pre>\n
\n\"Snort
\n
\nPro zobrazen\u00ed seznamu zdroj\u016f pravidel spus\u0165te n\u00e1sleduj\u00edc\u00ed p\u0159\u00edkaz:<\/p>\n
sudo suricata-update list-sources<\/code><\/pre>\n
\n\"Snort
\n
\nAktualizujeme zdroje pravidel:<\/p>\n
sudo suricata-update update-sources<\/code><\/pre>\n
\n\"Snort
\n
\nZnovu prohl\u00ed\u017e\u00edme aktualizovan\u00e9 zdroje:<\/p>\n
sudo suricata-update list-sources<\/code><\/pre>\n
\nV p\u0159\u00edpad\u011b pot\u0159eby lze povolit dostupn\u00e9 bezplatn\u00e9 zdroje:<\/p>\n
sudo suricata-update enable-source ptresearch\/attackdetection\nsudo suricata-update enable-source oisf\/trafficid\nsudo suricata-update enable-source sslbl\/ssl-fp-blacklist<\/code><\/pre>\n
\nPot\u00e9 je nutn\u00e9 pravidla znovu aktualizovat:<\/p>\n
sudo suricata-update<\/code><\/pre>\n
\nInstalaci a prvotn\u00ed nastaven\u00ed Suricata na Ubuntu 18.04 LTS m\u016f\u017eeme pova\u017eovat za dokon\u010den\u00e9. D\u00e1le za\u010d\u00edn\u00e1 to nejzaj\u00edmav\u011bj\u0161\u00ed: v dal\u0161\u00edm \u010dl\u00e1nku p\u0159ipoj\u00edme virtu\u00e1ln\u00ed server k firemn\u00ed s\u00edti p\u0159es VPN a za\u010dneme analyzovat ve\u0161ker\u00fd p\u0159\u00edchoz\u00ed a odchoz\u00ed provoz. Zvl\u00e1\u0161tn\u00ed pozornost v\u011bnujeme blokov\u00e1n\u00ed DDoS \u00fatok\u016f, aktivit\u00e1m \u0161kodliv\u00e9ho softwaru a pokus\u016fm o vyu\u017eit\u00ed zranitelnost\u00ed ve slu\u017eb\u00e1ch p\u0159\u00edstupn\u00fdch z ve\u0159ejn\u00fdch s\u00edt\u00ed. Pro n\u00e1zornost budou simulov\u00e1ny \u00fatoky nejb\u011b\u017en\u011bj\u0161\u00edch typ\u016f.<\/p>\n
\"Snort<\/a><\/noindex><\/p>\n
\"Snort<\/a><\/noindex>
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043a\u0443\u043f\u0430\u0442\u044c \u0434\u043e\u0440\u043e\u0433\u043e\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0436\u0435\u043b\u0435\u0437\u043e, \u043d\u043e \u0435\u0441\u0442\u044c \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u043e\u0434\u0435\u0448\u0435\u0432\u043b\u0435 \u2014 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0431\u0443\u0434\u0442\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0441\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IPS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85991,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort nebo Suricata. \u010c\u00e1st 2: instalace a prvotn\u00ed nastaven\u00ed Suricata | ProHoster","description":"Pokud v\u011b\u0159\u00edme statistik\u00e1m, objem s\u00ed\u0165ov\u00e9ho provozu se ka\u017edoro\u010dn\u011b zvy\u0161uje p\u0159ibli\u017en\u011b o 50 %. To vede ke zv\u00fd\u0161en\u00ed z\u00e1t\u011b\u017ee na za\u0159\u00edzen\u00ed a zejm\u00e9na zvy\u0161uje po\u017eadavky na v\u00fdkon IDS\/IPS.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-20T23:42:12+00:00","article:modified_time":"2020-06-20T23:42:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85990","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:26:01","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=85990"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85990\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/85991"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=85990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=85990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=85990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}