{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">p\u0159edchoz\u00ed \u010dl\u00e1nku<\/a><\/noindex> Hovo\u0159ili jsme o tom, jak spustit stabiln\u00ed verzi Suricata na Ubuntu 18.04 LTS. Nastavit IDS na jednom uzlu a p\u0159ipojit zdarma pravidla je pom\u011brn\u011b snadn\u00e9. Dnes se pod\u00edv\u00e1me na to, jak pomoc\u00ed nainstalovan\u00e9 Suricaty na virtu\u00e1ln\u00edm serveru chr\u00e1nit firemn\u00ed s\u00ed\u0165 p\u0159ed nejb\u011b\u017en\u011bj\u0161\u00edmi typy \u00fatok\u016f. K tomu budeme pot\u0159ebovat VDS na Linuxu se dv\u011bma v\u00fdpo\u010detn\u00edmi j\u00e1dry. Velikost opera\u010dn\u00ed pam\u011bti z\u00e1vis\u00ed na zat\u00ed\u017een\u00ed: n\u011bkomu sta\u010d\u00ed 2 GB, ale pro seri\u00f3zn\u011bj\u0161\u00ed \u00fakoly m\u016f\u017ee b\u00fdt pot\u0159eba 4 nebo dokonce 6. V\u00fdhodou virtu\u00e1ln\u00edho stroje je mo\u017enost experimentov\u00e1n\u00ed: m\u016f\u017eete za\u010d\u00edt s minim\u00e1ln\u00ed konfigurac\u00ed a zvy\u0161ovat v\u00fdkon podle pot\u0159eby.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>foto: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort nebo Suricata. \u010c\u00e1st 1: vyberte si bezplatn\u00e9 IDS\/IPS pro ochranu firemn\u00ed s\u00edt\u011b<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">Snort nebo Suricata. \u010c\u00e1st 2: instalace a po\u010d\u00e1te\u010dn\u00ed nastaven\u00ed Suricaty<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>Spojujeme s\u00edt\u011b<\/h2>\n<p>\nP\u0159enesen\u00ed IDS na virtu\u00e1ln\u00ed stroj m\u016f\u017ee b\u00fdt v prvn\u00ed \u0159ad\u011b pot\u0159ebn\u00e9 pro testov\u00e1n\u00ed. Pokud jste se nikdy nesetkali s podobn\u00fdmi \u0159e\u0161en\u00edmi, nen\u00ed dobr\u00e9 hned objedn\u00e1vat fyzick\u00fd hardware a m\u011bnit architekturu s\u00edt\u011b. L\u00e9pe je bezpe\u010dn\u011b otestovat syst\u00e9m bez zbyte\u010dn\u00fdch n\u00e1klad\u016f, abyste ur\u010dili pot\u0159eby na v\u00fdpo\u010detn\u00ed v\u00fdkon. Je d\u016fle\u017eit\u00e9 pochopit, \u017ee ve\u0161ker\u00fd firemn\u00ed provoz bude muset proj\u00edt jedin\u00fdm extern\u00edm uzlem: pro p\u0159ipojen\u00ed m\u00edstn\u00ed s\u00edt\u011b (nebo n\u011bkolika s\u00edt\u00ed) k VDS s nainstalovanou IDS Suricata lze pou\u017e\u00edt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 snadno nastaviteln\u00fd multiplatformn\u00ed server VPN, kter\u00fd zaji\u0161\u0165uje spolehliv\u00e9 \u0161ifrov\u00e1n\u00ed. Firemn\u00ed p\u0159ipojen\u00ed k internetu nemus\u00ed m\u00edt skute\u010dnou IP, proto je lep\u0161\u00ed jej spustit na VPS. V repozit\u00e1\u0159i Ubuntu nejsou \u017e\u00e1dn\u00e9 hotov\u00e9 bal\u00ed\u010dky, software budete muset st\u00e1hnout bu\u010f z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">str\u00e1nky projektu<\/a><\/noindex>, nebo z extern\u00edho repozit\u00e1\u0159e na slu\u017eb\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (pokud mu d\u016fv\u011b\u0159ujete):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nSeznam dostupn\u00fdch bal\u00ed\u010dk\u016f si m\u016f\u017eete prohl\u00e9dnout pomoc\u00ed n\u00e1sleduj\u00edc\u00edho p\u0159\u00edkazu:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBudeme pot\u0159ebovat softether-vpnserver (server v testovac\u00ed konfiguraci b\u011b\u017e\u00ed na VDS), stejn\u011b jako softether-vpncmd \u2014 p\u0159\u00edkazov\u00fd n\u00e1stroj pro jeho nastaven\u00ed.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nK nastaven\u00ed serveru se pou\u017e\u00edv\u00e1 speci\u00e1ln\u00ed p\u0159\u00edkazov\u00fd n\u00e1stroj:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPodrobn\u011b vysv\u011btlovat nastaven\u00ed nebudeme: postup je pom\u011brn\u011b jednoduch\u00fd, je dob\u0159e pops\u00e1n v mnoha publikac\u00edch a p\u0159\u00edmo se k t\u00e9matu \u010dl\u00e1nku nevztahuje. Pokud to shrneme, po spu\u0161t\u011bn\u00ed vpncmd mus\u00edte vybrat polo\u017eku 1, abyste p\u0159e\u0161li do konzole pro spr\u00e1vu serveru. K tomu je pot\u0159eba zadat n\u00e1zev localhost a stisknout enter m\u00edsto zad\u00e1n\u00ed n\u00e1zvu hubu. V konzole je nastaven administr\u00e1torsk\u00fd heslo p\u0159\u00edkazem serverpasswordset, odstran\u00ed se virtu\u00e1ln\u00ed hub DEFAULT (p\u0159\u00edkaz hubdelete) a vytvo\u0159\u00ed se nov\u00fd s n\u00e1zvem Suricata_VPN, a tak\u00e9 se nastav\u00ed jeho heslo (p\u0159\u00edkaz hubcreate). D\u00e1le je t\u0159eba p\u0159ej\u00edt do \u0159\u00edd\u00edc\u00ed konzole nov\u00e9ho hubu pomoc\u00ed p\u0159\u00edkazu hub Suricata_VPN, abychom vytvo\u0159ili skupinu a u\u017eivatele pomoc\u00ed p\u0159\u00edkaz\u016f groupcreate a usercreate. U\u017eivatelovo heslo je nastaveno pomoc\u00ed userpasswordset. <\/p>\n<p>SoftEther podporuje dva re\u017eimy p\u0159enosu provozu: SecureNAT a Local Bridge. Prvn\u00ed p\u0159edstavuje propriet\u00e1rn\u00ed technologii pro vytv\u00e1\u0159en\u00ed virtu\u00e1ln\u00ed priv\u00e1tn\u00ed s\u00edt\u011b s vlastn\u00edm NAT a DHCP. SecureNAT nevy\u017eaduje TUN\/TAP, ani konfiguraci Netfilter nebo jin\u00e9ho firewallu. Routerov\u00e1n\u00ed nezasahuje do j\u00e1dra syst\u00e9mu a v\u0161echny procesy jsou virtualizov\u00e1ny a funguj\u00ed na jak\u00e9mkoliv VPS\/VDS bez ohledu na pou\u017eit\u00e9 hypervizory. To vede k vy\u0161\u0161\u00ed z\u00e1t\u011b\u017ei procesoru a sn\u00ed\u017een\u00ed rychlosti ve srovn\u00e1n\u00ed s re\u017eimem Local Bridge, kter\u00fd spojuje virtu\u00e1ln\u00ed hub SoftEther s fyzick\u00fdm s\u00ed\u0165ov\u00fdm adapt\u00e9rem nebo za\u0159\u00edzen\u00edm TAP. <\/p>\n<p>Nastaven\u00ed v tomto p\u0159\u00edpad\u011b je slo\u017eit\u011bj\u0161\u00ed, proto\u017ee routov\u00e1n\u00ed prob\u00edh\u00e1 na \u00farovni j\u00e1dra pomoc\u00ed Netfilteru. Na\u0161e VDS jsou postaveny na Hyper-V, proto na posledn\u00edm kroku vytv\u00e1\u0159\u00edme m\u00edstn\u00ed most a aktivujeme za\u0159\u00edzen\u00ed TAP pomoc\u00ed p\u0159\u00edkazu bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes. Po opu\u0161t\u011bn\u00ed \u0159\u00eddic\u00ed konzole hubu uvid\u00edme v syst\u00e9mu nov\u00e9 s\u00ed\u0165ov\u00e9 rozhran\u00ed, kter\u00e9mu je\u0161t\u011b nebyla p\u0159i\u0159azena IP:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le bude nutn\u00e9 povolit sm\u011brov\u00e1n\u00ed paket\u016f mezi rozhran\u00edmi (ip forward), pokud nen\u00ed aktivn\u00ed:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\nOdkomentujte n\u00e1sleduj\u00edc\u00ed \u0159\u00e1dek:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nUlo\u017e\u00edme zm\u011bny v souboru, opust\u00edme editor a pou\u017eijeme je pomoc\u00ed n\u00e1sleduj\u00edc\u00edho p\u0159\u00edkazu:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nD\u00e1le mus\u00edme ur\u010dit pro virtu\u00e1ln\u00ed s\u00ed\u0165 pods\u00ed\u0165 s fiktivn\u00edmi IP (nap\u0159\u00edklad 10.0.10.0\/24) a p\u0159i\u0159adit adresu rozhran\u00ed:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nPot\u00e9 bude nutn\u00e9 napsat pravidla Netfilter.<\/p>\n<p>1. V p\u0159\u00edpad\u011b pot\u0159eby povolte p\u0159\u00edchoz\u00ed pakety na sledovan\u00fdch portech (protokol SoftEther pou\u017e\u00edv\u00e1 HTTPS a port 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Nastavujeme NAT z pods\u00edt\u011b 10.0.10.0\/24 na hlavn\u00ed IP serveru<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Povolujeme proch\u00e1zej\u00edc\u00ed pakety z pods\u00edt\u011b 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Povolujeme proch\u00e1zej\u00edc\u00ed pakety pro ji\u017e ustanoven\u00e1 spojen\u00ed<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nAutomatizaci procesu p\u0159i restartu syst\u00e9mu pomoc\u00ed inicia\u010dn\u00edch skript\u016f nech\u00e1me \u010dten\u00e1\u0159\u016fm jako dom\u00e1c\u00ed \u00fakol. <\/p>\n<p>Pokud chcete automaticky p\u0159id\u011blovat klient\u016fm IP adresy, budete pot\u0159ebovat tak\u00e9 nainstalovat n\u011bjakou slu\u017ebu DHCP pro m\u00edstn\u00ed most. T\u00edmto je konfigurace serveru dokon\u010dena a m\u016f\u017eeme p\u0159ej\u00edt k klient\u016fm. SoftEther podporuje mnoho protokol\u016f, jejich\u017e pou\u017eit\u00ed z\u00e1vis\u00ed na mo\u017enostech hardware m\u00edstn\u00ed s\u00edt\u011b. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJeliko\u017e n\u00e1\u0161 testovac\u00ed router tak\u00e9 b\u011b\u017e\u00ed na Ubuntu, nainstalujeme na n\u011bm z extern\u00edho repozit\u00e1\u0159e bal\u00ed\u010dky softether-vpnclient a softether-vpncmd, abychom mohli vyu\u017e\u00edt propriet\u00e1rn\u00ed protokol. Je pot\u0159eba spustit klienta:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nK nastaven\u00ed pou\u017eijeme utilitu vpncmd, vybereme localhost jako stroj, na kter\u00e9m b\u011b\u017e\u00ed vpnclient. V\u0161echny p\u0159\u00edkazy se prov\u00e1d\u011bj\u00ed v konzoli: bude pot\u0159eba vytvo\u0159it virtu\u00e1ln\u00ed rozhran\u00ed (NicCreate) a \u00fa\u010det (AccountCreate). <\/p>\n<p>V n\u011bkter\u00fdch p\u0159\u00edpadech je nutn\u00e9 nastavit zp\u016fsob autentizace pomoc\u00ed p\u0159\u00edkaz\u016f AccountAnonymousSet, AccountPasswordSet, AccountCertSet a AccountSecureCertSet. Proto\u017ee nepou\u017e\u00edv\u00e1me DHCP, adresa pro virtu\u00e1ln\u00ed adapt\u00e9r se zad\u00e1v\u00e1 ru\u010dn\u011b. <\/p>\n<p>Krom\u011b toho bude pot\u0159eba povolit ip forward (parametr net.ipv4.ip_forward=1 v souboru \/etc\/sysctl.conf) a nastavit statick\u00e9 trasy. V p\u0159\u00edpad\u011b pot\u0159eby lze na VDS se Suricatou nastavit p\u0159esm\u011brov\u00e1n\u00ed port\u016f pro vyu\u017eit\u00ed slu\u017eeb nainstalovan\u00fdch v m\u00edstn\u00ed s\u00edti. T\u00edm je spojen\u00ed s\u00edt\u00ed pova\u017eov\u00e1no za dokon\u010den\u00e9.<\/p>\n<p>Navrhovan\u00e1 konfigurace bude vypadat p\u0159ibli\u017en\u011b takto:<\/p>\n<p><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Nastavujeme Suricatu<\/h2>\n<p>\nV <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">p\u0159edchoz\u00ed \u010dl\u00e1nku<\/a><\/noindex> Hovo\u0159ili jsme o dvou re\u017eimech fungov\u00e1n\u00ed IDS: prost\u0159ednictv\u00edm fronty NFQUEUE (re\u017eim NFQ) a prost\u0159ednictv\u00edm zero copy (re\u017eim AF_PACKET). Druh\u00fd vy\u017eaduje dva rozhran\u00ed, ale nab\u00edz\u00ed vy\u0161\u0161\u00ed v\u00fdkon \u2014 pou\u017eijeme pr\u00e1v\u011b tento. Parametr je nastaven ve v\u00fdchoz\u00edm nastaven\u00ed v \/etc\/default\/suricata. Rovn\u011b\u017e budeme pot\u0159ebovat upravit sekci vars v \/etc\/suricata\/suricata.yaml, kde uvedeme virtu\u00e1ln\u00ed pods\u00ed\u0165 jako dom\u00e1c\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro restart IDS pou\u017eijeme p\u0159\u00edkaz:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\n\u0158e\u0161en\u00ed je hotov\u00e9, nyn\u00ed budete mo\u017en\u00e1 pot\u0159ebovat ov\u011b\u0159it jeho odolnost v\u016f\u010di \u00fatok\u016fm \u00fato\u010dn\u00edk\u016f.<\/p>\n<h2>Modelujeme \u00fatoky<\/h2>\n<p>\nSc\u00e9n\u00e1\u0159\u016f bojov\u00e9ho nasazen\u00ed extern\u00edho IDS m\u016f\u017ee b\u00fdt n\u011bkolik:<\/p>\n<p><b>Ochrana proti \u00fatok\u016fm DDoS (prim\u00e1rn\u00ed \u00fa\u010del)<\/b><\/p>\n<p>Implementace takov\u00e9ho varianty v r\u00e1mci firemn\u00ed s\u00edt\u011b je slo\u017eit\u00e1, proto\u017ee pakety pro anal\u00fdzu mus\u00ed proj\u00edt skrze rozhran\u00ed syst\u00e9mu sm\u011b\u0159uj\u00edc\u00ed na internet. I kdy\u017e je IDS zablokuje, parazitn\u00ed provoz m\u016f\u017ee ochromit datov\u00fd kan\u00e1l. Aby se tomu p\u0159ede\u0161lo, je t\u0159eba objednat VPS s dostate\u010dn\u011b v\u00fdkonn\u00fdm internetov\u00fdm p\u0159ipojen\u00edm, schopn\u00fdm zpracovat ve\u0161ker\u00fd provoz m\u00edstn\u00ed s\u00edt\u011b a ve\u0161ker\u00fd vn\u011bj\u0161\u00ed provoz. \u010casto je to jednodu\u0161\u0161\u00ed a levn\u011bj\u0161\u00ed ne\u017e roz\u0161i\u0159ovat kancel\u00e1\u0159sk\u00fd kan\u00e1l. Jako alternativu je mo\u017eno zm\u00ednit specializovan\u00e9 slu\u017eby pro ochranu proti DDoS. Cena jejich slu\u017eeb je srovnateln\u00e1 s cenou virtu\u00e1ln\u00edho serveru, p\u0159i\u010dem\u017e nen\u00ed pot\u0159eba n\u00e1ro\u010dn\u00e1 konfigurace, ale m\u00e1 to i nev\u00fdhody \u2014 za sv\u00e9 pen\u00edze klient z\u00edsk\u00e1 pouze ochranu proti DDoS, zat\u00edmco vlastn\u00ed IDS lze konfigurovat jakkoli.<\/p>\n<p><b>Ochrana proti extern\u00edm \u00fatok\u016fm jin\u00e9ho druhu<\/b> <\/p>\n<p>Suricata je schopna se vypo\u0159\u00e1dat s pokusy o vyu\u017eit\u00ed r\u016fzn\u00fdch zranitelnost\u00ed v dostupn\u00fdch internetov\u00fdch slu\u017eb\u00e1ch firemn\u00ed s\u00edt\u011b (po\u0161tovn\u00ed server, webov\u00fd server a webov\u00e9 aplikace atd.). Obvykle se IDS instaluj\u00ed uvnit\u0159 lok\u00e1ln\u00ed s\u00edt\u011b za hranicemi, ale jejich um\u00edst\u011bn\u00ed venku m\u00e1 tak\u00e9 sv\u00e9 opodstatn\u011bn\u00ed.<\/p>\n<p><b>Ochrana proti intern\u00edm zlo\u010dinc\u016fm<\/b><\/p>\n<p>I p\u0159es ve\u0161ker\u00e9 snahy syst\u00e9mov\u00e9ho administr\u00e1tora mohou b\u00fdt po\u010d\u00edta\u010de v podnikov\u00e9 s\u00edti infikov\u00e1ny \u0161kodliv\u00fdm softwarem. V m\u00edstn\u00ed s\u00edti se tak\u00e9 ob\u010das objevuj\u00ed vandali, kte\u0159\u00ed se sna\u017e\u00ed prov\u00e1d\u011bt neleg\u00e1ln\u00ed operace. Suricata m\u016f\u017ee pomoci zablokovat takov\u00e9 pokusy, i kdy\u017e pro ochranu vnit\u0159n\u00ed s\u00edt\u011b je lep\u0161\u00ed ji nainstalovat uvnit\u0159 perimetru a pou\u017e\u00edvat ji spole\u010dn\u011b s \u0159\u00edzen\u00fdm switchem, kter\u00fd um\u00ed zrcadlit provoz na jeden port. Vn\u011bj\u0161\u00ed IDS v tomto p\u0159\u00edpad\u011b tak\u00e9 nen\u00ed zbyte\u010dn\u00e1 \u2013 alespo\u0148 bude schopna zachytit pokusy o spojen\u00ed \u0161kodliv\u00e9ho software s extern\u00edm serverem, kter\u00e9 \u017eij\u00ed v LAN.<\/p>\n<p>Nejprve vytvo\u0159\u00edme dal\u0161\u00ed testovac\u00ed \u00fato\u010dn\u00fd VPS, a na routeru m\u00edstn\u00ed s\u00edt\u011b nastav\u00edme Apache s v\u00fdchoz\u00ed konfigurac\u00ed, po \u010dem\u017e p\u0159esm\u011brujeme port 80 na server IDS. D\u00e1le budeme simulovat DDoS \u00fatok z \u00fato\u010dn\u00e9ho uzlu. K tomu si st\u00e1hneme z GitHubu, zkompilujeme a spust\u00edme na \u00fato\u010dn\u00e9m uzlu mal\u00fd program xerxes (m\u016f\u017ee b\u00fdt pot\u0159eba nainstalovat bal\u00ed\u010dek gcc):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nV\u00fdsledek jej\u00ed pr\u00e1ce byl n\u00e1sleduj\u00edc\u00ed:<\/p>\n<p><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata zablokovala \u00fato\u010dn\u00edka a v\u00fdchoz\u00ed str\u00e1nka Apache se otev\u0159ela, i p\u0159es n\u00e1\u0161 improvizovan\u00fd \u00fatok a dost slab\u00fd kan\u00e1l \"kancel\u00e1\u0159sk\u00e9\" (ve skute\u010dnosti dom\u00e1c\u00ed) s\u00edt\u011b. Pro v\u00e1\u017en\u011bj\u0161\u00ed \u00fakoly stoj\u00ed za to pou\u017e\u00edt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. Je ur\u010den pro prov\u00e1d\u011bn\u00ed penetra\u010dn\u00edch test\u016f a umo\u017e\u0148uje simulovat r\u016fzn\u00e9 \u00fatoky. N\u00e1vod k instalaci <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">je k dispozici<\/a><\/noindex> je na str\u00e1nk\u00e1ch projektu. Po instalaci bude pot\u0159eba aktualizace:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nPro testov\u00e1n\u00ed spust\u00edme msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBohu\u017eel, v posledn\u00edch verz\u00edch frameworku chyb\u00ed mo\u017enost automatick\u00e9ho hackov\u00e1n\u00ed, a tak bude pot\u0159eba exploidy proch\u00e1zet ru\u010dn\u011b a spou\u0161t\u011bt je pomoc\u00ed p\u0159\u00edkazu use. Nejprve je dobr\u00e9 zjistit otev\u0159en\u00e9 porty na napaden\u00e9m stroji, nap\u0159\u00edklad pomoc\u00ed nmap (v na\u0161em p\u0159\u00edpad\u011b ho dostate\u010dn\u011b nahrad\u00ed netstat na napaden\u00e9m uzlu), a pot\u00e9 vybrat a pou\u017e\u00edt vhodn\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">moduly Metasploit<\/a><\/noindex>.\u00a0<\/p>\n<p>Existuj\u00ed i dal\u0161\u00ed n\u00e1stroje pro testov\u00e1n\u00ed odolnosti IDS v\u016f\u010di \u00fatok\u016fm, v\u010detn\u011b online slu\u017eeb. Z ryze zv\u011bdavosti je mo\u017en\u00e9 prov\u00e9st stresov\u00e9 testov\u00e1n\u00ed pomoc\u00ed zku\u0161ebn\u00ed verze <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser<\/a><\/noindex>. Chcete-li otestovat reakci na akce vnit\u0159n\u00edch \u00fato\u010dn\u00edk\u016f, m\u011bli byste nainstalovat speci\u00e1ln\u00ed n\u00e1stroje na jeden z po\u010d\u00edta\u010d\u016f v lok\u00e1ln\u00ed s\u00edti. Mo\u017enost\u00ed je mnoho a ob\u010das byste je m\u011bli pou\u017e\u00edt nejen na experiment\u00e1ln\u00edm za\u0159\u00edzen\u00ed, ale i na pracovn\u00edch syst\u00e9mech, i kdy\u017e to u\u017e je \u00fapln\u011b jin\u00fd p\u0159\u00edb\u011bh.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme firemn\u00ed s\u00ed\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort nebo Suricata. \u010c\u00e1st 3: chr\u00e1n\u00edme kancel\u00e1\u0159skou s\u00ed\u0165 | ProHoster","description":"V p\u0159edchoz\u00edm \u010dl\u00e1nku jsme v\u00e1m uk\u00e1zali, jak spustit stabiln\u00ed verzi Suricata na Ubuntu 18.04 LTS.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2026-08-11 12:50:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}