{"id":85990,"date":"2020-06-21T01:42:12","date_gmt":"2020-06-20T23:42:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata"},"modified":"2020-06-21T01:42:12","modified_gmt":"2020-06-20T23:42:12","slug":"snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","title":{"rendered":"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Statistika n\u00e4itab, et v\u00f5rguliikluse maht kasvab igal aastal umbes 50%. See suurendab seadmete koormust ning seab k\u00f5rgemad n\u00f5udmised IDS\/IPS j\u00f5udlusele. Kiire ja kallis spetsiaalne riistvara on \u00fcks v\u00f5imalus, kuid on ka odavam alternatiiv \u2014 avatud l\u00e4htekoodiga s\u00fcsteemide rakendamine. Paljud algajad administraatorid arvavad, et tasuta IPS-i installimine ja konfigureerimine on keeruline. Suricata puhul see aga nii ei ole \u2014 selle paigaldamine ja t\u00fc\u00fcpvaenulike r\u00fcnnakute blokeerimine tasuta reeglite kogumi abil on v\u00f5imalik m\u00f5ne minutiga.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/38b577d1359bfd99ca1f4c7510d8563b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks<\/a><\/noindex><\/p>\n<h2>Miksi on vaja veel \u00fchte avatud l\u00e4htekoodiga IPS-i?<\/h2>\n<p>\nPikki aastaid standardiks peetud Snorti s\u00fcsteem on arendatud alates 90ndate l\u00f5pust, mist\u00f5ttu oli see algselt \u00fchekanaline. Aja jooksul on sinna lisandunud k\u00f5ik kaasaegsed funktsioonid, sealhulgas IPv6 toe, rakendusprotokollide anal\u00fc\u00fcsi v\u00f5imalus ja universaalne andmete juurdep\u00e4\u00e4su moodul. <\/p>\n<p>Snort 2.X p\u00f5himootor \u00f5ppis t\u00f6\u00f6tama mitme tuumaga, kuid j\u00e4i siiski \u00fchem\u00f5tteliseks ja seet\u00f5ttu ei suuda see kaasaegsete riistvaraplatvormide eeliseid optimaalselt kasutada. <\/p>\n<p>Probleem lahendati s\u00fcsteemi kolmandas versioonis, kuid selle ettevalmistamine kestis nii kaua, et turule ilmus nullist kirjutatud Suricata. 2009. aastal hakati seda arendama just kui mitme l\u00f5ime alternatiivi Snortile, mis pakub IPS funktsioone v\u00e4lja arvatud kastist. Kood levitatakse GPLv2 litsentsi alusel, kuid projekti rahastavatel partneritel on juurdep\u00e4\u00e4s mootori suletud versioonile. M\u00f5ned skaleeritavuse probleemid s\u00fcsteemi esimestes versioonides ilmusid, kuid need lahendati \u00fcsna kiiresti.<\/p>\n<h2>Miks Suricata?<\/h2>\n<p>\nSuricatatel on mitu moodulit (nagu ka Snortil): salvestamine, kogumine, dekodeerimine, avastamine ja v\u00e4ljund. Vaikimisi salvestatud liiklus dekodeeritakse \u00fches voos, kuigi see koormab s\u00fcsteemi rohkem. Vajadusel saab seadetes vood jagada ja jagada protsessoritele \u2014 Suricata on v\u00e4ga h\u00e4sti optimeeritud konkreetse riistvara jaoks, kuigi see pole enam algajatele m\u00f5eldud juhendis. Samuti tasub m\u00e4rkida, et Suricatas on HTP raamatukogule tuginevaid t\u00e4iustatud HTTP kontrollimise vahendeid. Need v\u00f5ivad samuti olla kasutatud liikluse logimiseks ilma avastamiseta. S\u00fcsteem toetab ka IPv6 dekodeerimist, sealhulgas IPv4-in-IPv6 tunnelite, IPv6-in-IPv6 ja teistede dekodeerimist. <\/p>\n<p>Rikkeliiklus v\u00f5ib kasutada erinevaid liidest, nagu NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET ja PF_RING. Unix Socket re\u017eiimis saab automaatselt anal\u00fc\u00fcsida teise snifferiga kinni p\u00fc\u00fcdnud PCAP-faile. Lisaks lihtsustab Suricata modulaarne arhitektuur uute elementide \u00fchendamist liikluse p\u00fc\u00fcdmise, dekodeerimise, anal\u00fc\u00fcsi ja t\u00f6\u00f6tlemise jaoks. T\u00e4htis on ka m\u00e4rkida, et Suricataga liikluse blokeerimine toimub operatsioonis\u00fcsteemi sisseehitatud filtri abil. GNU\/Linuxis on olemas kaks IPS-i t\u00f6\u00f6re\u017eiimi: NFQUEUE kaudu (NFQ re\u017eiim) ja zero copy kaudu (AF_PACKET re\u017eiim). Esimesel juhul suunatakse iptables'i pakett NFQUEUE j\u00e4rjekorda, kus seda saab t\u00f6\u00f6delda kasutaja tasemel. Suricata l\u00e4bib selle oma reeglite kaudu ja annab \u00fcht kolmest otsusest: NF_ACCEPT, NF_DROP v\u00f5i NF_REPEAT. Esimese kahe jaoks ei ole lisaselgitusi vaja, kuid viimane v\u00f5imaldab pakette markeerida ja saata need tagasi iptables'i praegusesse tabelisse. AF_PACKET re\u017eiim paistab silma oma k\u00f5rgema j\u00f5udlusega, kuid seondub s\u00fcsteemile mitmete piirangutega: see peab olema varustatud kahe v\u00f5rgu liidesega ja toimima ruuterina. Blokeeritud pakett ei edastata lihtsalt teisele liidesesse. <\/p>\n<p>Suricata peamine omadus on v\u00f5imalus kasutada Snorti t\u00f6\u00f6tlusi. Halduse jaoks on kergesti k\u00e4ttesaadavad n\u00e4iteks Sourcefire VRT ja OpenSource Emerging Threats reeglite komplektid, samuti kaubanduslikud Emerging Threats Pro. \u00dchtne v\u00e4ljund on anal\u00fc\u00fcsimiseks kergesti hallatav populaarsete tagaplaanide kaudu, samuti toetatakse v\u00e4ljundit PCAP ja Syslog formaadis. S\u00fcsteemi seaded ja reeglid salvestatakse YAML formaadis failidesse, mis on kergesti loetavad ja automaatselt t\u00f6\u00f6deldavad. Suricata mootor tuvastab mitmeid protokolle, mist\u00f5ttu reeglites ei ole vajalik siduda neid portide numbritega. Lisaks rakendatakse Suricata reeglites aktiivselt flowbits kontseptsiooni. Alarmide j\u00e4lgimiseks kasutatakse sessioonimuutujaid, mis v\u00f5imaldavad luua ja rakendada erinevaid loendureid ja lippe. Paljud IDS-id k\u00e4sitlevad erinevaid TCP-\u00fchendusi eraldi entiteetidena ja ei pruugi n\u00e4ha nende vahelisi seoseid, mis viitavad r\u00fcnnaku algusele. Suricata p\u00fc\u00fcab n\u00e4ha suurt pilti ja tuvastab paljuski erinevatesse \u00fchendustesse jagatud kahjuliku liikluse. Selle eeliste \u00fcle v\u00f5iks palju r\u00e4\u00e4kida, kuid liigutame paremini installimise ja seadistamise juurde.<\/p>\n<h2>Kuidas installida?<\/h2>\n<p>\nPaigaldame Suricata virtuaalsesse serverisse, mis t\u00f6\u00f6tab Ubuntu 18.04 LTS-l. K\u00f5iki k\u00e4ske tuleb t\u00e4ita superkasutaja (root) \u00f5igustega. K\u00f5ige ohutum valik on serverisse SSH kaudu tavalise kasutajana sisse logida ja seej\u00e4rel kasutada sudo utiliiti \u00f5iguste t\u00f5stmiseks. Alustamiseks on vaja paigaldada vajalikud paketid:<\/p>\n<pre><code class=\"bash\">sudo apt -y install libpcre3 libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config libnetfilter-queue-dev geoip-bin geoip-database geoipupdate apt-transport-https<\/code><\/pre>\n<p>\nLisame v\u00e4lise repostiitori:<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:oisf\/suricata-stable\nsudo apt-get update<\/code><\/pre>\n<p>\nPaigaldame viimase stabiilse versiooni Suricata:<\/p>\n<pre><code class=\"bash\">sudo apt-get install suricata<\/code><\/pre>\n<p>\nKui vajalik, muudetakse konfiguratsioonifailides nime, asendades vaikimisi eth0 serveri v\u00e4lise liidese tegeliku nimega. Vaikeseaded salvestatakse failis \/etc\/default\/suricata ja kasutajaseaded failis \/etc\/suricata\/suricata.yaml. IDS-i seadistamine piirneb peamiselt selle konfiguratsioonifaili muutmisega. Failis on palju parameetreid, mille nimed ja otstarbed vastavad Snorti analoogidele. S\u00fcntaks on siiski t\u00e4iesti erinev, kuid fail on palju lihtsam lugeda kui Snorti konfiguratsioonid, lisaks on see h\u00e4sti kommenteeritud.<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/default\/suricata<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/17ae36d4ca58f0347b0b17f5fcb31c7b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nja<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/d2d39b52920aa2019fd2a3ec74fcab78.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00e4helepanu! Enne k\u00e4ivitamist tuleks kontrollida vars-sektsiooni muutujate v\u00e4\u00e4rtusi.<\/p>\n<p>Seadistuse l\u00f5petamiseks tuleb installida suricata-update reeglite v\u00e4rskendamiseks ja allalaadimiseks. Selle tegemine on \u00fcsna lihtne:<\/p>\n<pre><code class=\"bash\">sudo apt install python-pip\nsudo pip install pyyaml\nsudo pip install &lt;a href=&quot;https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip&quot;&gt;https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip&lt;\/a&gt;\nsudo pip install --pre --upgrade suricata-update<\/code><\/pre>\n<p>\nEdasi peame k\u00e4ivitama k\u00e4su suricata-update Emerging Threats Open reeglite kogumi paigaldamiseks:<\/p>\n<pre><code class=\"bash\">sudo suricata-update<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/e3174089b6a2c67b8db36d2e40c50af9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nReeglite allikate loendi vaatamiseks k\u00e4ivitage j\u00e4rgmine k\u00e4sk:<\/p>\n<pre><code class=\"bash\">sudo suricata-update list-sources<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/7cded45bf414c2c2e76fc0bb3e1bb65c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV\u00e4rskendame reeglite allikaid:<\/p>\n<pre><code class=\"bash\">sudo suricata-update update-sources<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/786f46118b87cece96e818c70662e3c4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVaadake uuendatud allikaid uuesti:<\/p>\n<pre><code class=\"bash\">sudo suricata-update list-sources<\/code><\/pre>\n<p>\nVajadusel saab lubada saadaval olevaid tasuta allikaid:<\/p>\n<pre><code class=\"bash\">sudo suricata-update enable-source ptresearch\/attackdetection\nsudo suricata-update enable-source oisf\/trafficid\nsudo suricata-update enable-source sslbl\/ssl-fp-blacklist<\/code><\/pre>\n<p>\nP\u00e4rast seda tuleb reeglid veel kord uuendada:<\/p>\n<pre><code class=\"bash\">sudo suricata-update<\/code><\/pre>\n<p>\nSellega v\u00f5ib Suricata installimise ja esialgse seadistamise Ubuntu 18.04 LTS jaoks lugeda l\u00f5petatuks. Edasi algab k\u00f5ige huvitavam osa: j\u00e4rgmises artiklis \u00fchendame virtuaalse serveri kontoriv\u00f5rguga VPN-i kaudu ja alustame kogu sissetuleva ja v\u00e4ljamineva liikluse anal\u00fc\u00fcsimist. Erilist t\u00e4helepanu p\u00f6\u00f6ratakse DDoS-r\u00fcnnakute blokeerimisele, pahavara tegevusele ja katsetele kasutada \u00e4ra haavatavusi avalike v\u00f5rkude kaudu kergesti ligip\u00e4\u00e4setavates teenustes. N\u00e4itamaks simuleeritakse k\u00f5ige levinumaid r\u00fcnnaku t\u00fc\u00fcpe.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-2\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/8911da77f90d8843a2c0da3c1cb1d5b0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-2#order\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine\" src=\"\/wp-content\/uploads\/2020\/06\/f9220be24979f78c539e08d755f4257f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043a\u0443\u043f\u0430\u0442\u044c \u0434\u043e\u0440\u043e\u0433\u043e\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0436\u0435\u043b\u0435\u0437\u043e, \u043d\u043e \u0435\u0441\u0442\u044c \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u043e\u0434\u0435\u0448\u0435\u0432\u043b\u0435 \u2014 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0431\u0443\u0434\u0442\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0441\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IPS [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85991,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-20T23:42:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-20T23:42:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine | ProHoster","description":"Kui uskuda statistikat, suureneb v\u00f5rguliiklus ligikaudu 50% iga aastaga. See toob kaasa koormuse suurenemise seadmetele ja suurendab eelk\u00f5ige IDS\/IPS-i j\u00f5udlusn\u00f5udeid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-20T23:42:12+00:00","article:modified_time":"2020-06-20T23:42:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85990","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:26:01","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=85990"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/85990\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/85991"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=85990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=85990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=85990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}