{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort or Suricata. Part 3: Securing the Office Network","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>In <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">the previous article<\/a><\/noindex> We explained how to launch a stable version of Suricata on Ubuntu 18.04 LTS. Setting up an IDS on a single node and connecting free rule sets is quite simple. Today, we will discuss how to protect a corporate network against the most common types of attacks using Suricata installed on a virtual server. We will need a Linux VDS with two CPU cores. The amount of RAM depends on the load: some may get by with 2 GB, while more serious tasks may require 4 or even 6. The advantage of a virtual machine is the possibility of experimentation: you can start with a minimal configuration and scale resources as needed.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>Photo: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort or Suricata. Part 1: Choosing a Free IDS\/IPS to Protect Corporate Networks<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">Snort or Suricata. Part 2: installing and initial configuring Suricata<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>Merging Networks<\/h2>\n<p>\nMoving the IDS to a virtual machine is primarily necessary for testing. If you have never dealt with such solutions, it would not be wise to rush into ordering physical hardware and changing the network architecture. It is better to safely and economically test the system to identify computational resource needs. It is important to understand that all corporate traffic will need to pass through a single external node: to connect the local network (or several networks) to the VDS with the installed Suricata IDS, you can use <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 an easy-to-configure cross-platform VPN server that provides reliable encryption. The office internet connection may not have a real IP, so it's better to set it up on a VPS. There are no ready-made packages in the Ubuntu repository; you\u2019ll need to download the software either from <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">the project site<\/a><\/noindex>, or from an external repository on the service <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (if you trust it):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nYou can view the list of available packages with the following command:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWe will need softether-vpnserver (the server in the test configuration is running on the VDS), as well as softether-vpncmd \u2014 command-line utilities for its configuration.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nA special command-line utility is used to configure the server:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWe won't go into detail about the setup: the procedure is quite simple and is well described in numerous publications, so it doesn't relate directly to the article topic. Briefly, after launching vpncmd, you need to select option 1 to enter the server management console. To do this, enter the name localhost and press enter instead of entering the hub name. In the console, set the administrator password with the command serverpasswordset, delete the virtual hub DEFAULT with the command hubdelete, and create a new hub named Suricata_VPN, also specifying its password (command hubcreate). Next, switch to the management console of the new hub using the command hub Suricata_VPN to create a group and user with the commands groupcreate and usercreate. Set the user password with userpasswordset. <\/p>\n<p>SoftEther supports two traffic transmission modes: SecureNAT and Local Bridge. The first is a proprietary technology for building a virtual private network with its own NAT and DHCP. SecureNAT does not require TUN\/TAP or configuring Netfilter or any other firewall. Routing does not affect the system's kernel, and all processes are virtualized and run on any VPS\/VDS regardless of the hypervisor used. This leads to increased CPU load and reduced speed compared to Local Bridge mode, which connects the SoftEther virtual hub to a physical network adapter or TAP device. <\/p>\n<p>In this case, the setup is more complicated because routing occurs at the kernel level using Netfilter. Our VDS is built on Hyper-V, so in the last step, we create a local bridge and activate the TAP device with the command bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes. After exiting the hub management console, we will see a new network interface in the system that has not yet been assigned an IP:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNext, you will need to enable packet forwarding between interfaces (ip forward) if it is not active:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\nUncomment the following line:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nSave the changes to the file, exit the editor, and apply them with the following command:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nNext, we need to define a subnet for the virtual network with dummy IPs (for example, 10.0.10.0\/24) and assign an address to the interface:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nThen you will need to specify Netfilter rules.<\/p>\n<p>1. If necessary, allow incoming packets on the listening ports (the SoftEther proprietary protocol uses HTTPS and port 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Configure NAT from the subnet 10.0.10.0\/24 to the server's main IP<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Allow passing packets from the subnet 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Allow passing packets for already established connections<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nWe will leave the automation of the process during system restart using initialization scripts as homework for the readers. <\/p>\n<p>If you want to issue IPs to clients automatically, you will also need to install some DHCP service for the local bridge. With that, the server configuration is complete and you can move on to the clients. SoftEther supports multiple protocols, the use of which depends on the capabilities of the local network hardware. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSince our test router also runs on Ubuntu, we will install the packages softether-vpnclient and softether-vpncmd from an external repository to use the proprietary protocol. The client will need to be started:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nFor configuration, we will use the vpncmd utility, selecting localhost as the machine where vpnclient is running. All commands are executed in the console: it will be necessary to create a virtual interface (NicCreate) and an account (AccountCreate). <\/p>\n<p>In some cases, it is necessary to specify the authentication method using the commands AccountAnonymousSet, AccountPasswordSet, AccountCertSet, and AccountSecureCertSet. Since we are not using DHCP, the address for the virtual adapter is assigned manually. <\/p>\n<p>Additionally, we will need to enable IP forwarding (the parameter net.ipv4.ip_forward=1 in the \/etc\/sysctl.conf file) and configure static routes. If necessary, port forwarding can be configured on the VDS with Suricata to use the services installed in the local network. At this point, the network merging can be considered complete.<\/p>\n<p>The proposed configuration will look something like this:<\/p>\n<p><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Configuring Suricata<\/h2>\n<p>\nIn <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">the previous article<\/a><\/noindex> We discussed two modes of IDS operation: through the NFQUEUE (NFQ mode) and through zero copy (AF_PACKET mode). The latter requires two interfaces but offers better performance \u2014 we will use this one. The parameter is set by default in \/etc\/default\/suricata. We will also need to edit the vars section in \/etc\/suricata\/suricata.yaml, specifying the virtual subnet as the home network.<\/p>\n<p><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTo restart the IDS, use the command:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\nThe solution is ready; now you may need to test its resilience against malicious actions.<\/p>\n<h2>Modeling attacks<\/h2>\n<p>\nThere can be several scenarios for the operational use of an external IDS service:<\/p>\n<p><b>Protection against DDoS attacks (primary purpose)<\/b><\/p>\n<p>Implementing such an option within a corporate network is challenging since packets for analysis must reach the interface facing the internet. Even if the IDS blocks them, parasitic traffic can overwhelm the data transmission channel. To avoid this, it is advisable to order a VPS with a sufficiently powerful internet connection capable of handling all local network traffic and all external traffic. This is often easier and cheaper than upgrading the office bandwidth. Alternatively, there are specialized services for DDoS protection. The cost of their services is comparable to that of a virtual server, and there is no need for labor-intensive setup, although there are downsides \u2014 for their fee, the client receives only DDoS protection, whereas their own IDS can be configured freely.<\/p>\n<p><b>Protection against external attacks of other types<\/b> <\/p>\n<p>Suricata is capable of handling attempts to exploit various vulnerabilities in services accessible from the internet in the corporate network (mail server, web server, web applications, etc.). Typically, IDS is installed inside the local network after the perimeter devices, but external deployment is also valid.<\/p>\n<p><b>Protection against internal threats<\/b><\/p>\n<p>Despite all efforts by the system administrator, computers in the corporate network can be infected with malware. Moreover, local troublemakers sometimes attempt to carry out unauthorized operations. Suricata can help block such attempts, although for internal network protection, it is better to install it inside the perimeter and use it in conjunction with a managed switch capable of mirroring traffic to a single port. An external IDS is also not useless in this case \u2014 at least it can catch attempts by malicious software residing in the local network to contact an external server.<\/p>\n<p>First, let's create another test attack VPS and set up Apache with the default configuration on the local network router, after which we will forward port 80 from the IDS server to it. Next, we will simulate a DDoS attack from the attacking node. For this, we will download, compile, and run a small program called xerxes from GitHub on the attacking node (you may need to install the gcc package):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nThe result of its execution was as follows:<\/p>\n<p><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata intercepts the attacker, and the default Apache page opens despite our improvised attack and the rather poor bandwidth of the 'office' (actually home) network. For more serious tasks, it is worth using <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. It is intended for penetration testing and can simulate a variety of attacks. Installation instructions can be found <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">is available<\/a><\/noindex> on the project site. After installation, an update will be required:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nTo test, we launch msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUnfortunately, the latest versions of the framework lack the ability for automatic hacking, so exploits have to be selected manually and launched with the use command. First, it\u2019s worth determining the open ports on the target machine, for example, using nmap (in our case, netstat on the target node will suffice), and then selecting and using the appropriate <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">Metasploit modules.<\/a><\/noindex>.\u00a0<\/p>\n<p>There are also other tools to test the resilience of IDS to attacks, including online services. Out of curiosity, one can conduct stress testing using a trial version of <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser.<\/a><\/noindex>To check the reaction to actions by internal attackers, it's advisable to install specialized tools on one of the machines in the local network. There are many options, and they should periodically be applied not only to the experimental environment but also to operational systems, though that's a different story altogether.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort or Suricata. Part 3: Securing the Office Network\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort or Suricata. Part 3: Protecting the Office Network | ProHoster","description":"In the previous article, we discussed how to launch a stable version of Suricata on Ubuntu 18.04 LTS.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2026-08-11 12:50:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}