{"id":85990,"date":"2020-06-21T01:42:12","date_gmt":"2020-06-20T23:42:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata"},"modified":"2020-06-21T01:42:12","modified_gmt":"2020-06-20T23:42:12","slug":"snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","title":{"rendered":"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kui uskuda statistikat, siis v\u00f5rgu liiklus suureneb igal aastal ligikaudu 50%. See toob kaasa seadmete koormuse kasvu ja suurendab eriti IDS\/I\u0421S j\u00f5udlust n\u00f5udmisi. Saate osta kallist spetsialiseeritud riistvara, kuid on ka odavam variant \u2014 rakendada \u00fchte avatud l\u00e4htekoodiga s\u00fcsteemi. Paljud algajad administraatorid usuvad, et tasuta IPS-i seadmine ja konfigureerimine on \u00fcsna keeruline. Suricata puhul ei ole see p\u00e4ris t\u00f5si \u2014 selle paigaldamine ja t\u00fc\u00fcpiliste r\u00fcnnakute peegeldamine tasuta reeglite kogumiga v\u00f5tab vaid paar minutit.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/38b577d1359bfd99ca1f4c7510d8563b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitseks<\/a><\/noindex><\/p>\n<h2>Miks on vaja veel \u00fcht avatud IPS-i?<\/h2>\n<p>\nPikka aega standardiks peetud s\u00fcsteem Snort on v\u00e4ljat\u00f6\u00f6tamisel alates 1990-ndate algusest, mist\u00f5ttu oli alguses tegu \u00fche l\u00f5imega. Aasta jooksul on sellele lisandunud k\u00f5ik t\u00e4nap\u00e4eva funktsioonid, sealhulgas IPv6 tugi, rakendustasandi protokollide anal\u00fc\u00fcsi v\u00f5imalus v\u00f5i universaalne andmete ligip\u00e4\u00e4su moodul. <\/p>\n<p>Snort 2.X p\u00f5himootor \u00f5ppis t\u00f6\u00f6le mitme tuumaga, kuid j\u00e4i ikkagi \u00fche l\u00f5imega ja seet\u00f5ttu ei saa optimaalselt \u00e4ra kasutada kaasaegsete seadmete eeliseid. <\/p>\n<p>Probleem lahendati s\u00fcsteemi kolmandas versioonis, kuid selle ettevalmistamine v\u00f5ttis nii kaua aega, et turule ilmus t\u00e4iesti nullist kirjutatud Suricata. 2009. aastal hakati seda arendama just kui mitme l\u00f5imega alternatiivi Snortile, mis sisaldab IPS-i funktsioone otse v\u00e4lja kastist. Kood jaotatakse GPLv2 litsentsi alusel, kuid projekti rahalised partnerid p\u00e4\u00e4sevad juurde suletud versioonile. M\u00f5ned probleemid s\u00fcsteemi esialgse versiooni skaleeritavusega tekkisid, kuid need lahendati \u00fcsna kiiresti.<\/p>\n<h2>Miks Suricata?<\/h2>\n<p>\nSuricatasse on mitmeid mooduleid (nagu ka Snortis): p\u00fc\u00fcdmiseks, kogumiseks, dekodeerimiseks, avastamiseks ja v\u00e4ljundiks. Vaikimisi liigub p\u00fc\u00fctud liiklus dekodeerimise eel \u00fche vooguna, kuigi see koormab s\u00fcsteemi rohkem. Vaja korral saab voogusid seadetes jagada ja jaotada protsessorite vahel \u2014 Suricata on v\u00e4ga h\u00e4sti optimeeritud konkreetse riistvara jaoks, kuigi see ei ole enam algajatele m\u00f5eldud \u00f5petus. Samuti tasub m\u00e4rkida, et Suricatas on olemas HTP raamatukogul p\u00f5hinevad arenenud HTTP-inspektsiooni t\u00f6\u00f6riistad. Need v\u00f5ivad olla kasutatud ka liikluse logimiseks ilma avastamiseta. S\u00fcsteem toetab samuti IPv6 dekodeerimist, sealhulgas IPv4-in-IPv6, IPv6-in-IPv6 tunnelite jne. <\/p>\n<p>Liikluse p\u00fc\u00fcdmiseks v\u00f5ivad kasutada erinevaid liideseid (NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING), ning Unix Socketi re\u017eiimis saab automaatselt anal\u00fc\u00fcsida teiste sniffide p\u00fc\u00fctud PCAP-faile. Lisaks lihtsustab Suricata moodulaarne arhitektuur uute elementide lisamist liikluse p\u00fc\u00fcdmiseks, dekodeerimiseks, anal\u00fc\u00fcsimiseks ja t\u00f6\u00f6tlemiseks. Oluline on ka m\u00e4rkida, et Suricatas toimub liikluse blokeerimine operatsioonis\u00fcsteemi standardselt filtrite kaudu. GNU\/Linuxis on saadaval kaks IPS-re\u017eiimi: NFQUEUE kaudu (NFQ-re\u017eiim) ja zero copy kaudu (AF_PACKET re\u017eiim). Esimesel juhul suunatakse iptables'isse sattuv pakett NFQUEUE j\u00e4rjekorda, kus seda saab t\u00f6\u00f6delda kasutaja tasandil. Suricata kontrollib seda vastavalt oma reeglitele ja annab v\u00e4lja \u00fche kolmest otsusest: NF_ACCEPT, NF_DROP ja NF_REPEAT. Esimese kahe puhul seletust ei vaja, samas viimane v\u00f5imaldab pakette m\u00e4rgistada ja saata need tagasi praegusse iptables'i tabelisse. AF_PACKET re\u017eiim eristub k\u00f5rgema t\u00f6\u00f6kiirusest, kuid seab s\u00fcsteemile mitmeid piiranguid: see peab omama kahte v\u00f5rguliidest ja t\u00f6\u00f6tama v\u00e4ravana. Blokeeritud pakett ei edastata lihtsalt teisele liidesele. <\/p>\n<p>Suricata peamine funktsioon on Snorti t\u00f6\u00f6tamiste kasutamise v\u00f5imalus. Administraatoritele on kergesti k\u00e4ttesaadavad Sourcefire VRT ja OpenSource Emerging Threats reeglid ning ka kommertslikud Emerging Threats Pro. \u00dchtset v\u00e4ljundit saab anal\u00fc\u00fcsida populaarsete tagapindade abil, samuti toetatakse v\u00e4ljundit PCAP ja Syslog formaates. S\u00fcsteemi seaded ja reeglid salvestatakse YAML-formaadis failidesse, mis on h\u00f5lpsasti loetavad ja automatiseeritavad. Suricata mootor tuvastab palju protokolle, seega ei ole reeglites vajalik sadama numbriga sidumine. Lisaks rakendatakse Suricata reeglites aktiivselt flowbits kontseptsiooni. Tuvastamise j\u00e4lgimiseks kasutatakse sessioonimuutujaid, mis v\u00f5imaldavad luua ja rakendada erinevaid loEndure ega lippu. Paljud IDS-id k\u00e4sitlevad erinevaid TCP-\u00fchendusi eraldi \u00fcksustena ja v\u00f5ivad mitte n\u00e4ha nende vahelist seost, mis viitab r\u00fcnnaku algusele. Suricata \u00fcritab n\u00e4ha suuremat pilti ja tuvastab paljudes juhtudes jaotatud pahatahtliku liikluse erinevatesse \u00fchendustesse. Selle eeliste \u00fcle v\u00f5ib palju arutada, kuid parem on liikuda installimise ja seadistamise juurde.<\/p>\n<h2>Kuidas installida?<\/h2>\n<p>\nMe paigaldame Suricata virtuaalsele serverile, mis t\u00f6\u00f6tab Ubuntu 18.04 LTS all. K\u00f5iki k\u00e4ske tuleb t\u00e4ita superkasutaja (root) \u00f5igustes. K\u00f5ige turvalisem on serverisse \u00fchenduda SSH kaudu tavakasutaja \u00f5igustes ja seej\u00e4rel kasutada sudo utiliiti \u00f5iguste suurendamiseks. Alustuseks peame installima paketid, mida me vajame:<\/p>\n<pre><code class=\"bash\">sudo apt -y install libpcre3 libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config libnetfilter-queue-dev geoip-bin geoip-database geoipupdate apt-transport-https<\/code><\/pre>\n<p>\nLisame v\u00e4list hoidlat:<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:oisf\/suricata-stable\nsudo apt-get update<\/code><\/pre>\n<p>\nInstallime viimase stabiilse versiooni Suricata:<\/p>\n<pre><code class=\"bash\">sudo apt-get install suricata<\/code><\/pre>\n<p>\nVajadusel muutke konfigureerimisfailide nime, asendades vaikimisi kasutatava eth0 tegeliku serveri v\u00e4lise liidese nimega. Vaikeseaded on salvestatud failis \/etc\/default\/suricata ja kohandatud seaded failis \/etc\/suricata\/suricata.yaml. IDS seadistamine piirneb peamiselt selle konfigureerimisfaili muutmisega. Seal on palju parameetreid, mis nime ja otstarbe poolest sarnanevad Snorti omadega. S\u00fcnntaks on siiski t\u00e4iesti erinev, kuid faili on palju lihtsam lugeda kui Snorti konfiguraatoreid, lisaks on see h\u00e4sti kommenteeritud.<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/default\/suricata<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/17ae36d4ca58f0347b0b17f5fcb31c7b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nja<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/d2d39b52920aa2019fd2a3ec74fcab78.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00e4helepanu! Enne k\u00e4ivitamist tasub kontrollida muutujaid jaotises vars.<\/p>\n<p>Seadistuse l\u00f5petamiseks on vajalik installida suricata-update reeglite uuendamiseks ja allalaadimiseks. Selle tegemine on \u00fcsna lihtne:<\/p>\n<pre><code class=\"bash\">sudo apt install python-pip\nsudo pip install pyyaml\nsudo pip install &lt;a href=&quot;https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip&quot;&gt;https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip&lt;\/a&gt;\nsudo pip install --pre --upgrade suricata-update<\/code><\/pre>\n<p>\nJ\u00e4rgmisena peame k\u00e4ivitama k\u00e4su suricata-update, et installida Emerging Threats Open reeglite komplekt:<\/p>\n<pre><code class=\"bash\">sudo suricata-update<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/e3174089b6a2c67b8db36d2e40c50af9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nReeglite allikate loendi vaatamiseks k\u00e4ivita j\u00e4rgmine k\u00e4sk:<\/p>\n<pre><code class=\"bash\">sudo suricata-update list-sources<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/7cded45bf414c2c2e76fc0bb3e1bb65c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUuendame reeglite allikaid:<\/p>\n<pre><code class=\"bash\">sudo suricata-update update-sources<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/786f46118b87cece96e818c70662e3c4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKordame \u00fcle v\u00e4rskendatud allikad:<\/p>\n<pre><code class=\"bash\">sudo suricata-update list-sources<\/code><\/pre>\n<p>\nVajadusel saab lubada tasuta allikaid:<\/p>\n<pre><code class=\"bash\">sudo suricata-update enable-source ptresearch\/attackdetection\nsudo suricata-update enable-source oisf\/trafficid\nsudo suricata-update enable-source sslbl\/ssl-fp-blacklist<\/code><\/pre>\n<p>\nP\u00e4rast seda on vaja reeglid uuesti uuendada:<\/p>\n<pre><code class=\"bash\">sudo suricata-update<\/code><\/pre>\n<p>\nSellega v\u00f5ib Suricata installimise ja esialgse seadistamise Ubuntu 18.04 LTS jaoks lugeda l\u00f5petatuks. Edasi algab k\u00f5ige huvitavam: j\u00e4rgmises artiklis \u00fchendame virtuaalse serveri kontoriv\u00f5rku VPNi kaudu ja hakkame anal\u00fc\u00fcsima kogu sissetulevat ja v\u00e4ljaminevat liiklust. Eriti t\u00e4helepanu p\u00f6\u00f6rame DDoS r\u00fcnnakute blokeerimisele, pahavara tegevusele ja katsetele kasutada haavatavusi avalikult kergesti ligip\u00e4\u00e4setavates teenustes. Illustreerimiseks simuleerime k\u00f5ige levinumaid r\u00fcnnakut\u00fc\u00fcpe.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-2\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/8911da77f90d8843a2c0da3c1cb1d5b0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-2#order\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/f9220be24979f78c539e08d755f4257f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043a\u0443\u043f\u0430\u0442\u044c \u0434\u043e\u0440\u043e\u0433\u043e\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0436\u0435\u043b\u0435\u0437\u043e, \u043d\u043e \u0435\u0441\u0442\u044c \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u043e\u0434\u0435\u0448\u0435\u0432\u043b\u0435 \u2014 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0431\u0443\u0434\u0442\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0441\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IPS [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85991,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-20T23:42:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-20T23:42:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine | ProHoster","description":"Kui statistikat uskuda, suureneb v\u00f5rguliikluse maht igal aastal umbes 50%. See p\u00f5hjustab varustuse koormuse suurenemist ja suurendab seel\u00e4bi IDS\/IPS j\u00f5udlusn\u00f5udeid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-20T23:42:12+00:00","article:modified_time":"2020-06-20T23:42:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85990","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:26:01","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85990"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85990\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/85991"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}