{"id":85475,"date":"2020-06-16T13:42:55","date_gmt":"2020-06-16T11:42:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti"},"modified":"2020-06-16T13:42:55","modified_gmt":"2020-06-16T11:42:55","slug":"snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","title":{"rendered":"Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kunagi piisab kohalikus v\u00f5rgus kaitsmiseks lihtsalt tulekahjust ja viiruset\u00f5rjeprogrammidest, kuid kaasaegsete h\u00e4kkerite r\u00fcnnakute ja viimastel aastatel suureneva pahavara vastu ei piisa enam sellest komplektist. Vanamoodne tulem\u00fc\u00fcr anal\u00fc\u00fcsib ainult pakettide p\u00e4iseid, lubades v\u00f5i blokeerides neid vastavalt formaalsete reeglite kogumile. Pakettide sisu kohta ei tea ta midagi ja seet\u00f5ttu ei suuda ta tuvastada v\u00e4liselt seaduslikke tegevusi kurjategijatelt. Viiruset\u00f5rjeprogrammid ei p\u00fc\u00fca alati pahavara kinni, seega seisab administraatoril silmitsi vajadus j\u00e4lgida anomaalset tegevust ja \u00f5igeaegselt isoleerida nakatunud hostid. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks\" src=\"\/wp-content\/uploads\/2020\/06\/e5bf2d1eeec4b350c9a3b89fdf2a2475.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>IT-infrastruktuuri kaitsmiseks on mitmeid edasij\u00f5udnud vahendeid. T\u00e4na r\u00e4\u00e4gime avatud l\u00e4htekoodiga sissetungide avastamise ja ennetamise s\u00fcsteemidest, mida saab rakendada ilma kulukate seadmete ja litsentside ostmiseta.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>IDS\/IPS klassifikatsioon<\/h2>\n<p>\nIDS (Intrusion Detection System) \u2014 s\u00fcsteem, mille eesm\u00e4rk on registreerida kahtlasi tegevusi v\u00f5rgus v\u00f5i eraldi arvutis. See hoiab s\u00fcndmuste logisid ja teavitab vastutavat teabe turva spetsialisti. IDS-i koosseisu kuuluvad j\u00e4rgmised elemendid:<\/p>\n<ul>\n<li>sensori seadmed, mis j\u00e4lgivad v\u00f5rguliiklust, erinevaid logisid jne.\u00a0<\/li>\n<li>anal\u00fc\u00fcsialam, mis tuvastab saadud andmetes kahjuliku m\u00f5ju tunnuseid;<\/li>\n<li>ladustamine esmaste s\u00fcndmuste ja anal\u00fc\u00fcsi tulemuste kogumiseks;<\/li>\n<li>juhtimiskonsool.<\/li>\n<\/ul>\n<p>\nAlguses klassifitseeriti IDS-i nende asukoha alusel: need v\u00f5isid olla suunatud \u00fcksikute nodede kaitsmiseks (host-based ehk Host Intrusion Detection System \u2014 HIDS) v\u00f5i kaitsta kogu ettev\u00f5tte v\u00f5rku (network-based ehk Network Intrusion Detection System \u2014 NIDS). Tasub mainida nn APIDS-i (rakendusprotokollide p\u00f5hised IDS-id): need j\u00e4lgivad piiratud hulka rakendusprotokolle konkreetsete r\u00fcnnakute tuvastamiseks ning ei tegele s\u00fcvaanal\u00fc\u00fcsiga v\u00f5rgu paketides. Sellised tooted meenutavad sageli proksi ja neid kasutatakse konkreetsete teenuste kaitsmiseks: veebiserverite ja veebirakenduste (n\u00e4iteks PHP-s kirjutatud), andmebaasiserverite jne. T\u00fc\u00fcpiline esindaja sellest klassist on mod_security veebiserverile Apache. <\/p>\n<p>Meie huvi keskendub rohkem universaalsetele NIDS-idele, mis toetavad laia valikut sideprotokolle ja s\u00fcvitsi mineku anal\u00fc\u00fcsi tehnoloogiaid (DPI). Need j\u00e4lgivad kogu liiklust alates kanali tasemest ja tuvastavad laia spektri v\u00f5rgu r\u00fcnnakuid ning katsed volitamata juurde p\u00e4\u00e4seda teabele. Sageli erinevad sellised s\u00fcsteemid jaotatud arhitektuuri poolest ning saavad suhelda erinevate aktiivsete v\u00f5rguseadmetega. Tuleb m\u00e4rkida, et paljud kaasaegsed NIDS-id on h\u00fcbriidid ja \u00fchendavad mitmeid l\u00e4henemisviise. Vastavalt seadistustele ja seadistustele saavad nad lahendada erinevaid \u00fclesandeid \u2013 n\u00e4iteks \u00fche s\u00f5lme v\u00f5i kogu v\u00f5rgu kaitsmist. Lisaks on t\u00f6\u00f6jaamade IDS-funktsioonid \u00fcle v\u00f5tnud viiruset\u00f5rje paketid, mis on muutunud multifunktsionaalseteks tulem\u00fc\u00fcrideks, mis tegelevad sealhulgas kahtlase liikluse tuvastamise ja blokeerimisega. <\/p>\n<p>Esialgu suudsid IDS-id ainult tuvastada pahavara tegevust, portide skannerite t\u00f6\u00f6 ja ettev\u00f5tte turvapoliitikate rikkumisi. Teatud s\u00fcndmuse toimumisel teavitati administraatorit, kuid \u00fcsna kiiresti m\u00f5istus, et r\u00fcnnaku lihtsalt tuvastamine ei ole piisav \u2014 see tuleb blokeerida. Nii transformeerusid IDS-id IPS-ideks (Intrusion Prevention Systems) \u2014 sissetungi ennetamise s\u00fcsteemideks, mis suudavad suhelda v\u00f5rgufilteritega.<\/p>\n<h2>Tuvastamismeetodid<\/h2>\n<p>\nKaasaegsed sissetungi tuvastamise ja ennetamise lahendused kasutavad erinevaid pahatahtliku tegevuse m\u00e4\u00e4ratlemise meetodeid, mida saab jagada kolme kategooriasse. See annab meile veel \u00fche s\u00fcsteemide klassifitseerimise v\u00f5imaluse:<\/p>\n<ul>\n<li>Signatuurilised IDS\/IPS tuvastavad liikluses teatud mustreid v\u00f5i j\u00e4lgivad s\u00fcsteemide seisundi muutusi, et m\u00e4\u00e4rata v\u00f5rgur\u00fcnnaku v\u00f5i nakatumise katse. Need ei anna praktiliselt valeh\u00e4ireid ega valepositiivseid tulemusi, kuid ei suuda tuvastada tundmatuid ohte;<\/li>\n<li>Anomaaliate tuvastavad IDS-id ei kasuta r\u00fcnnakute signatuure. Need tuvastavad informatsioonis\u00fcsteemide normaalsest erineva k\u00e4itumise (sealhulgas anomaaliad v\u00f5rgu liikluses) ning v\u00f5ivad tuvastada isegi tundmatud r\u00fcnnakud. Sellised s\u00fcsteemid annavad \u00fcsna palju valeh\u00e4ireid ja v\u00f5ivad ebapiisava kasutamise korral kohaliku v\u00f5rgu t\u00f6\u00f6d t\u00e4ielikult peatada;<\/li>\n<li>Reeglite p\u00f5hised IDS-id t\u00f6\u00f6tavad p\u00f5him\u00f5ttel: if FAKT then TEGEVUS. Sisuliselt on need ekspert s\u00fcsteemid teadmistebaasidega \u2014 faktide ja loogilise j\u00e4reldamise reeglite kogum. Sellised lahendused on seadistamise osas ajamahukad ning n\u00f5uavad administraatorilt p\u00f5hjalikku arusaamist v\u00f5rgu toimimisest.\u00a0<\/li>\n<\/ul>\n<p><\/p>\n<h2>IDS-i arengulugu<\/h2>\n<p>\nInternet ja ettev\u00f5tte v\u00f5rkude kiire areng algas 90ndatel, kuid arenenud v\u00f5rguohutustehnolooge hakkasid spetsialistid uurima juba varem. 1986. aastal avaldasid Dorothy Denning ja Peter Neumann IDES (Intrusion Detection Expert System) mudeli, mis sai aluseks enamikule t\u00e4nap\u00e4evastest sissetungi avastamise s\u00fcsteemidest. See kasutas ekspert-s\u00fcsteemi tuntud r\u00fcnnakute m\u00e4\u00e4ramiseks, samuti statistilisi meetodeid ja kasutajate\/systemi profiile. IDES t\u00f6\u00f6tas Sun t\u00f6\u00f6jaamadel, kontrollides v\u00f5rguarhiive ja rakenduste andmeid. 1993. aastal ilmus NIDES (Next-generation Intrusion Detection Expert System) \u2014 uus generatsiooni sissetungi avastamise ekspert-s\u00fcsteem.<\/p>\n<p>Denning ja Neimani t\u00f6\u00f6de alusel loodi 1988. aastal ekspert s\u00fcsteem MIDAS (Multics intrusion detection and alerting system), mis kasutas P-BEST-i ja LISP-i. Samuti loodi toona statistilistel meetoditel p\u00f5hinev s\u00fcsteem Haystack. Veel \u00fcks statistiline anomaaliate tuvastaja W&amp;S (Wisdom &amp; Sense) t\u00f6\u00f6tati v\u00e4lja Los Alamoses asuvas Riiklikus Laboratooriumis aasta hiljem. T\u00f6\u00f6stus arenes kiirelt. N\u00e4iteks 1990. aastal rakendati s\u00fcsteemis TIM (Time-based inductive machine) juba anomaaliate tuvastamist, kasutades induktiivset \u00f5ppimist kasutaja j\u00e4rjestikustes mustrites (keel Common LISP). NSM (Network Security Monitor) tuvastas anomaaliaid, v\u00f5rreldes juurdep\u00e4\u00e4su maatrikseid, samas kui ISOA (Information Security Officer\u2019s Assistant) toetab erinevaid tuvastamisstrateegiaid: statistilised meetodid, profiliseerimine ja ekspert s\u00fcsteem. AT&amp;T Bell Labs loodud s\u00fcsteem ComputerWatch kasutas kontrollimiseks nii statistilisi meetodeid kui ka reegleid, samas kui esimese jaotatud IDS protot\u00fc\u00fcbi said California \u00dclikooli arendajad juba 1991. aastal \u2014 DIDS (Distributed intrusion detection system) oli samal ajal ka ekspert s\u00fcsteem.<\/p>\n<p>Alguses olid IDS identsed, kuid juba 1998. aastal vabastas Berkeley Lawrence'i riiklik laboratoorium Bro (2018. aastal muudeti selle nimi Zeekiks) \u2014 avatud l\u00e4htekoodiga s\u00fcsteemi, mis kasutab oma reeglite keelt libpcap andmete anal\u00fc\u00fcsimiseks. Samal novembril ilmus libpcap'i kasutav paketinuuskija APE, mis kuu aja p\u00e4rast muudeti Snortiks ja hiljem muutus t\u00e4ielikuks IDS\/IPS-ks. Samal ajal hakati turule tooma ka palju erinevaid propageeritud lahendusi. <\/p>\n<h2>Snort ja Suricata<\/h2>\n<p>\nPaljuski ettev\u00f5tted eelistavad tasuta avatud l\u00e4htekoodiga IDS\/IPS lahendusi. Pikalt peeti standardlahenduseks juba mainitud Snorti, kuid praegu on selle asemele t\u00f5usnud Suricata s\u00fcsteem. Tutvume nende eeliste ja puudustega pisut l\u00e4hemalt. Snort kombineerib allkirjal p\u00f5hineva meetodi eelised reaalajas anomaaliate avastamise v\u00f5imalusega. Suricata v\u00f5imaldab samuti kasutada muid meetodeid peale r\u00fcnnakute tuvastamise allkirjade abil. S\u00fcsteem loodi Snorti projektist eraldunud arendajate r\u00fchma poolt ja toetab IPS funktsioone alates versioonist 1.4, samas kui Snorti v\u00f5imalus sissetungide ennetamiseks ilmus hiljem. <\/p>\n<p>Peamine erinevus kahe populaarse toote vahel on see, et Suricat on v\u00f5imalik kasutada GPU-d IDS-re\u017eiimis, samuti on selle IPS funktsioonid arenenumad. S\u00fcsteem on algselt loodud mitme l\u00f5ime jaoks, samas kui Snort on \u00fchesuunaline toode. Oma pikaajalise ajaloo ja p\u00e4randkoodi t\u00f5ttu ei kasuta see mitme protsessori \/ multicore riistvaraplatvorme optimaalselt, samas kui Suricata v\u00f5imaldab tavap\u00e4rastes arvutites t\u00f6\u00f6delda liiklust kuni 10 Gbit\/s. Kahte s\u00fcsteemi saab pikaajaliselt v\u00f5rrelda, kuid kuigi Suricata mootor t\u00f6\u00f6tab kiiremini, ei oma see mitte liiga laiaribaliste kanalite puhul olulist t\u00e4htsust.<\/p>\n<h2>Paigaldusv\u00f5imalused<\/h2>\n<p>\nIPS peab olema paigutatud nii, et s\u00fcsteem saaks j\u00e4lgida oma kontrollitavaid v\u00f5rgu segmente. K\u00f5ige sagedamini on see eraldi arvuti, mille \u00fcks liides on \u00fchendatud piiril olevate seadmetega ja \"vaatab\" nende kaudu kaitsetute avalike v\u00f5rkude (Internet) poole. Teine IPS liides on \u00fchendatud kaitstava segmendi sissep\u00e4\u00e4su juures, et kogu liiklus l\u00e4heks s\u00fcsteemi kaudu ja seda anal\u00fc\u00fcsitaks. Keerukamates juhtumites v\u00f5ib kaitstavaid segmente olla mitu: n\u00e4iteks ettev\u00f5tte v\u00f5rkudes on sageli v\u00e4lja jagatud demilitariseeritud tsoon (DMZ) Interneti kaudu ligip\u00e4\u00e4setavate teenustega. <\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks\" src=\"\/wp-content\/uploads\/2020\/06\/15e2e449a81eedea09032718ff4a1bc9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSelline IPS suudab ennetada portide skaneerimise v\u00f5i paroolide j\u00f5hkr\u00fcnnakute katseid, e-posti serveri, veebiserveri v\u00f5i skriptide haavatavuste kasutamist ning muid v\u00e4liseid r\u00fcnnakute vorme. Kui kohaliku v\u00f5rgu arvutid on nakatunud pahavara, ei luba IDS neil suhelda v\u00e4liste botnet-serveritega. T\u00f5sisemat kaitset sisemistele v\u00f5rkudele v\u00f5idakse vaja l\u00e4heb keerulist seadistust ja mitteodavaid hallatavaid l\u00fcliteid, mis suudavad peegeldada liiklust IDS-interfeisi \u00fche porti jaoks.<\/p>\n<p>Eriti sageli on ettev\u00f5tte v\u00f5rgud hajutatud teenuset\u00f5kestamise (DDoS) r\u00fcnnakute sihtm\u00e4rgiks. Kuigi t\u00e4nap\u00e4eva IDS-id suudavad sellega toime tulla, ei aita \u00fclaltoodud kasutuselev\u00f5tu variant siin just palju. S\u00fcsteem tuvastab pahatahtliku tegevuse ja blokeerib parasiitv\u00f5rgu liikluse, kuid selleks peavad paketid l\u00e4bima v\u00e4lise interneti\u00fchenduse ja j\u00f5udma tema v\u00f5rgu liidesesse. R\u00fcnnaku intensiivsusest s\u00f5ltuvalt ei pruugi andmeedastuskanal koormusega toime tulla ja r\u00fcndajate eesm\u00e4rk saavutatakse. Selliste juhtumite jaoks soovitame IDS-i juurutada virtuaalsel serveril, millel on eelnevalt t\u00f5husam interneti\u00fchendus. VPS-i saab kohaliku v\u00f5rgu k\u00fclge \u00fchendada VPN-i kaudu ning siis tuleb seadistada kaudu kogu v\u00e4line liiklus. Siis, DDoS-r\u00fcnnaku korral ei pea pakette edastama teenusepakkuja kaudu, need blokeeritakse v\u00e4lises s\u00f5lmes.<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks\" src=\"\/wp-content\/uploads\/2020\/06\/7ced164023bf2aa37e676d460804d6da.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Valikuprobleem<\/h2>\n<p>\nTasub tasuta s\u00fcsteemide seas liidrit otsides olla ettevaatlik. IDS\/IPS-i valik s\u00f5ltub v\u00f5rgu topoloogiast, vajalikest kaitsefunktsioonidest ning ka administraatori isiklikest eelistustest ja valmisolekust seadistustega vaeva n\u00e4ha. Snort'il on pikem ajalugu ja see on paremini dokumenteeritud, kuigi ka Suricata kohta on Internetis kerge teavet leida. Igal juhul n\u00f5uab s\u00fcsteemi omandamine teatud pingutusi, mis tasuvad end l\u00f5puks \u00e4ra \u2014 kommertshardware ja riist- ja tarkvaraline IDS\/IPS on \u00fcsna kallid ning ei mahu alati eelarvesse. Aega ei tasu kahetsema j\u00e4\u00e4da, sest hea administraator t\u00f5stab alati oma kvalifikatsiooni t\u00f6\u00f6andja arvelt. Sel juhul j\u00e4\u00e4vad k\u00f5ik v\u00f5itjaks. J\u00e4rgmises artiklis vaatleme m\u00f5ningaid Suricata rakendamise variante ning v\u00f5rdleme praktikas kaasaegsemat s\u00fcsteemi klassikalise IDS\/IPS Snort'iga.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks\" src=\"\/wp-content\/uploads\/2020\/06\/19f0fd87faf30e31d34e2a10421514da.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata#order\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks\" src=\"\/wp-content\/uploads\/2020\/06\/a5fe3bac97102322110b9d0e33f3919c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85476,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ametialase v\u00f5rgu kaitseks | ProHoster","description":"Kuna aega tagasi oli kohaliku v\u00f5rgu kaitseks piisav tavaline tulem\u00fc\u00fcr ja viiruset\u00f5rje programmid, kuid kaasaegsete h\u00e4kkerite r\u00fcnnakute ja hiljuti levinud pahavara vastu on see komplekt enam mitte piisav. Vanad head tulem\u00fc\u00fcrid anal\u00fc\u00fcsivad ainult pakettide p\u00e4iseid, lubades v\u00f5i blokeerides neid vastavalt reeglite kogumile. Pakettide sisu kohta ei tea nad midagi, seep\u00e4rast ei","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-16T11:42:55+00:00","article:modified_time":"2020-06-16T11:42:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85475","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:36:28","updated":"2022-09-29 16:21:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85475"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85475\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/85476"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}