{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Uues <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">eelnevas artiklis<\/a><\/noindex> Me r\u00e4\u00e4kisime, kuidas k\u00e4ivitada stabiilne versioon Suricata Ubuntu 18.04 LTS-is. IDS-i seadistamine \u00fchel s\u00f5lmel ja tasuta reeglite komplektide \u00fchendamine pole eriti keeruline. T\u00e4na uurime, kuidas kasutada virtuaalses serveris installitud Suricat ettev\u00f5tte v\u00f5rgustiku kaitsmiseks levinumate r\u00fcnnakute eest. Selleks on meil vaja VDS-i Linuxis, millel on kaks arvutusn\u00fcri. RAM-i maht s\u00f5ltub koormusest: m\u00f5nele piisab ka 2 GB-st, kuid t\u00f5sisemate \u00fclesannete jaoks v\u00f5ib olla vaja 4 v\u00f5i isegi 6. Virtuaalmasina eelised on katsetamisv\u00f5imalused: alustada saab minimaalsete seadistustega ja ressursse saab vajadusel suurendada.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>foto: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitseks<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">Snort v\u00f5i Suricata. Osa 2: Suricata installimine ja esialgne seadistamine<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>\u00dchendame v\u00f5rgud<\/h2>\n<p>\nIDS-i viimine virtuaalmasinale on esmajoones vajalik testideks. Kui te pole kunagi selliste lahendustega kokku puutunud, siis ei tasu kohe f\u00fc\u00fcsilisele riistvarale tormata ja v\u00f5rgu arhitektuuri muuta. Paremini katsetada s\u00fcsteemi ohutult ja ilma liigsete kuludeta, et m\u00e4\u00e4rata kindlaks arvutusressursside vajadused. Oluline on m\u00f5ista, et kogu ettev\u00f5tte liiklus tuleb siiski l\u00e4bi viia \u00fche ainsa v\u00e4lise s\u00f5lme: kohaliku v\u00f5rgu (v\u00f5i mitme v\u00f5rgu) \u00fchendamiseks VDS-iga, millel on installitud IDS Suricata, saab kasutada <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 lihtsasti seadistatav platvormidevaheline VPN-server, mis tagab usaldusv\u00e4\u00e4rse kr\u00fcpteerimise. Kontori interneti\u00fchendusel ei pruugi olla reaalset IP-aadressi, seet\u00f5ttu on parem see \u00fcles seada VPS-ile. Ubuntu hoidlas valmis paketid puuduvad, tarkvara tuleb alla laadida kas <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">projekti veebisaidilt<\/a><\/noindex>, v\u00f5i v\u00e4lisest hoidlast teenusest <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (kui usaldate seda):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nSaadaval olevate paketide loendit saab vaadata j\u00e4rgmise k\u00e4su abil:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMeile on vajalik softether-vpnserver (server testkonfiguratsioonis on k\u00e4ivitatud VDS-is), samuti softether-vpncmd \u2014 k\u00e4surea t\u00f6\u00f6riist selle seadistamiseks.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nServeri seadistamiseks kasutatakse spetsiaalset k\u00e4surea t\u00f6\u00f6riista:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMe ei hakka r\u00e4\u00e4kima seadistuse \u00fcksikasjadest: protseduur on \u00fcsna lihtne, see on h\u00e4sti kirjeldatud paljudes avaldustes ja ei kuulu artikli teemasse. L\u00fchidalt \u00f6eldes, peale vpncmd k\u00e4ivitamist tuleb valida punkt 1, et minna serveri halduskonsoli. Selleks tuleb sisestada localhost ja vajutada enter asemel hubi nime sisestamist. Konsolis m\u00e4\u00e4ratakse administraatori parool k\u00e4suga serverpasswordset, eemaldatakse virtuaalne hub DEFAULT (k\u00e4sk hubdelete) ja luuakse uus nimega Suricata_VPN, samuti m\u00e4\u00e4ratakse selle parool (k\u00e4sk hubcreate). Edasi tuleb minna uue hubi halduskonsolisse k\u00e4suga hub Suricata_VPN, et luua grupp ja kasutaja k\u00e4sudega groupcreate ja usercreate. Kasutaja parool m\u00e4\u00e4ratakse k\u00e4suga userpasswordset. <\/p>\n<p>SoftEther toetab kahte re\u017eiimi liikluse edastamiseks: SecureNAT ja Local Bridge. Esimene on patenteeritud tehnoloogia virtuaalse privaatv\u00f5rgu rajamiseks oma NAT ja DHCP-ga. SecureNAT ei vaja TUN\/TAP-i, samuti ei n\u00f5ua Netfilteri v\u00f5i muu tulem\u00fc\u00fcri seadistamist. Suunamine ei m\u00f5juta s\u00fcsteemi tuuma ning k\u00f5ik protsessid on virtualiseeritud ja t\u00f6\u00f6tavad igasugustes VPS\/VDS-des olenemata kasutatavast h\u00fcperviisorist. See toob kaasa suurema protsessori koormuse ja kiiruslanguse v\u00f5rreldes Local Bridge'i re\u017eiimiga, mis \u00fchendab SoftEtheri virtuaalhubi f\u00fc\u00fcsilise v\u00f5rkaadapteri v\u00f5i TAP-seadmiga. <\/p>\n<p>Seadistus on sellisel juhul keerulisem, kuna suunamine toimub tuuma tasemel Netfilteri abil. Meie VDS-id on rajatud Hyper-V-le, seega loome viimases etapis lokaalse silla ja aktiveerime TAP-seadme k\u00e4suga bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes. Hubi halduskonsolist lahkudes n\u00e4eme s\u00fcsteemis uut v\u00f5rgu liidest, millele pole veel m\u00e4\u00e4ratud IP-d:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEdasi tuleb aktiveerida paketivahetamine liideste vahel (ip forward), kui see on mitteaktiivne:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\nEemaldage j\u00e4rgmise rea kommentaar:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nSalvestame muutused failis, lahkume redigeerijast ja rakendame need j\u00e4rgmise k\u00e4suga:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nEdasi tuleb m\u00e4\u00e4rata virtuaalv\u00f5rgule alamv\u00f5rk vale IP-dega (n\u00e4iteks 10.0.10.0\/24) ja m\u00e4\u00e4rata adress liidesele:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nSiis on vaja kirjutada Netfilteri reeglid.<\/p>\n<p>1. Vajadusel lubage sissetulevaid pakette kuulatavatele portidele (SoftEtheri kohandatud protokoll kasutab HTTPS-i ja porti 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Seame NAT-i alav\u00f5rgust 10.0.10.0\/24 p\u00f5hiserveri IP-le<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Lubame sissetulevad paketid alav\u00f5rgust 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Lubame sissetulevad paketid juba seadistatud \u00fchendustele<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nJ\u00e4tame protsessi automatiseerimise s\u00fcsteemi taask\u00e4ivitamisel alglaadimise skriptide kaudu lugejate kodut\u00f6\u00f6d. <\/p>\n<p>Kui soovite klientidele IP-aadresse automaatselt jagada, peate samuti seadistama m\u00f5ne DHCP teenuse kohaliku silla jaoks. Sellega on serveri seadistamine l\u00f5petatud ja v\u00f5ime liikuda kliendi seadistuste juurde. SoftEther toetab mitmeid protokolle, mille kasutamine s\u00f5ltub kohaliku v\u00f5rgu seadmete suutlikkusest. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuna meie testimissuunaja t\u00f6\u00f6tab samuti Ubuntu all, installime sellele v\u00e4lisest repo'st paketid softether-vpnclient ja softether-vpncmd, et kasutada kohandatud protokolli. Peame kliendi k\u00e4ivitama:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nSeadistamiseks kasutame utiliiti vpncmd, valides localhost masina, kus vpnclient on k\u00e4imas. K\u00f5ik k\u00e4sud antakse konsoolis: peame looma virtuaalse liidese (NicCreate) ja kasutajakonto (AccountCreate). <\/p>\n<p>M\u00f5ningatel juhtudel tuleb m\u00e4\u00e4rata autentimise meetod k\u00e4sudega AccountAnonymousSet, AccountPasswordSet, AccountCertSet ja AccountSecureCertSet. Kuna me ei kasuta DHCP-d, m\u00e4\u00e4ratakse virtuaalse adapteri aadress k\u00e4sitsi. <\/p>\n<p>Lisaks peame lubama IP edastamise (parameeter net.ipv4.ip_forward=1 failis \/etc\/sysctl.conf) ja seadistama staatilised marsruudid. Vajadusel v\u00f5ib VDS-is koos Suricataga seadistada pordiedastust kohaliku v\u00f5rgu teenuste kasutamiseks. Sellega v\u00f5ib v\u00f5rgu \u00fchendamine lugeda l\u00f5petatuks.<\/p>\n<p>Pakutav konfiguratsioon n\u00e4eb v\u00e4lja umbes nii:<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Seadistame Suricata<\/h2>\n<p>\nUues <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">eelnevas artiklis<\/a><\/noindex> Me oleme r\u00e4\u00e4kinud kahest IDS-i t\u00f6\u00f6re\u017eiimist: NFQUEUE j\u00e4rjekorra kaudu (NFQ re\u017eiim) ja zero copy kaudu (AF_PACKET re\u017eiim). Viimane vajab kaht liidest, kuid pakub k\u00f5rgemat j\u00f5udlust \u2014 kasutame just seda. Parameeter on vaikimisi m\u00e4\u00e4ratud failis \/etc\/default\/suricata. Samuti peame redigeerima jaotist vars failis \/etc\/suricata\/suricata.yaml, m\u00e4\u00e4rates seal virtuaalv\u00f5rgu koduseks.<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIDS-i taask\u00e4ivitamiseks kasutame k\u00e4sku:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\nLahendus on valmis, n\u00fc\u00fcd v\u00f5ib tekkida vajadus kontrollida selle vastupidavust kurjategijate tegevusele.<\/p>\n<h2>Simuleerime r\u00fcnnakuid<\/h2>\n<p>\nV\u00e4lise IDS-i teenuse rakendamise stsenaariume v\u00f5ib olla mitu:<\/p>\n<p><b>Kaitse DDoS-r\u00fcnnakute eest (peamine eesm\u00e4rk)<\/b><\/p>\n<p>Sellise variandi rakendamine ettev\u00f5tte sisev\u00f5rgus on keeruline, kuna anal\u00fc\u00fcsimiseks m\u00f5eldud paketid peavad j\u00f5udma s\u00fcsteemi interneti suunatud liidesesse. Isegi kui IDS need blokeerib, v\u00f5ib kahjulik liiklus andmeedastuskanali \u00fcle koormata. Selle v\u00e4ltimiseks on vaja tellida VPS, millel on piisavalt v\u00f5imas interneti\u00fchendus, mis suudab edastada kogu kohaliku v\u00f5rgu liikluse ja kogu v\u00e4lise liikluse. Sageli on seda lihtsam ja odavam teha kui laiendada kontori \u00fchendust. Alternatiivina tasub mainida spetsialiseerunud teenuseid DDoS-i kaitseks. Nende teenuste hind on v\u00f5rreldav virtuaalserveri hinnaga, samas ei ole vajalik keeruline seadistus, kuid on ka puudusi \u2014 klient saab oma raha eest ainult DDoS-i kaitse, samas kui enda IDS-i saab seadistada kuidas iganes.<\/p>\n<p><b>Kaitse teiste liikide v\u00e4liste r\u00fcnnakute eest<\/b> <\/p>\n<p>Suricata suudab hakkama saada erinevate haavatavuste \u00e4ra kasutamise katsetega ettev\u00f5tte sisev\u00f5rgus, mis on kergesti juurdep\u00e4\u00e4setavad internetist (postiserver, veebiserver ja veebi rakendused jne). Tavaliselt installitakse IDS kohalikku v\u00f5rku p\u00e4rast kaitse seadmeid, kuid selle viimine v\u00e4ljas on samuti \u00f5igustatud.<\/p>\n<p><b>Kaitse sisemiste kurjategijate eest<\/b><\/p>\n<p>Hooliganid v\u00f5ivad proovida h\u00e4kkida ettev\u00f5tte v\u00f5rku, hoolimata s\u00fcsteemiadministraatori pingutustest. Samuti v\u00f5ivad kohalikud h\u00e4kkerid proovida teha lubamatuid toiminguid. Suricata aitab selliseid katsed blokeerida; selle parim koht on ettev\u00f5tte turvapiiride sees, koos haldusl\u00fclitiga, mis suudab liiklust \u00fches porti peegeldada. V\u00e4limine IDS ei ole kahjutu \u2014 v\u00e4hemalt suudab see tabada p\u00fc\u00fcdeid, kus pahavara, mis asub kohalikus v\u00f5rgus, p\u00fc\u00fcab \u00fchendust v\u00e4lise serveriga.<\/p>\n<p>Alustame uue testimisr\u00fcnnaku VPS-i loomisega ning seadistame kohaliku v\u00f5rgu ruuteris Apache vaikimisi konfiguratsiooniga, millele suuname 80. portaali IDS-serverilt. Edasi simuleerime DDoS-r\u00fcnnakut r\u00fcndava s\u00f5lme kaudu. Selleks laadime GitHubist alla, kompileerime ja k\u00e4ivitame r\u00fcndava s\u00f5lme peal v\u00e4ikese programmi xerxes (v\u00f5ib olla vajalik gcc paketi installimine):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nTema t\u00f6\u00f6 tulemuseks oli j\u00e4rgmine:<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata blokeerib r\u00fcndaja ning Apache vaikimisi leht avatakse, hoolimata meie improvisatsioonilisest r\u00fcnnakust ja \u00fcsna n\u00f5rgast kontori (tegelikult kodusest) v\u00f5rgu\u00fchendusest. T\u00f5sisemate \u00fclesannete jaoks tasub kasutada <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. See on m\u00f5eldud sissetungimise testimiseks ning v\u00f5imaldab simuleerida erinevaid r\u00fcnnakuid. Paigaldusjuhised on <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">on kergesti k\u00e4ttesaadav<\/a><\/noindex> projekti veebilehel. P\u00e4rast installimist on vajalik uuendus:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nKatsumiseks k\u00e4ivitame msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKahjuks ei ole viimasest versioonist sul v\u00f5imalik automaatset h\u00e4kkimist, seega peavad eksploitid olema k\u00e4sitsi valitud ja k\u00e4ivitatud k\u00e4su use abil. K\u00f5igepealt tasub m\u00e4\u00e4rata r\u00fcndatava masina avatud portsid, n\u00e4iteks nmapi abil (meie juhul v\u00f5ib selle asendada netstat r\u00fcndava s\u00f5lme kohal), seej\u00e4rel leia ja kasuta sobivad <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">Metasploit moodulid<\/a><\/noindex>.\u00a0<\/p>\n<p>Kindlasti on ka teisi IDS-i r\u00fcnnakute kontrollimise vahendeid, sealhulgas veebiteenuseid. Huvi p\u00e4rast saab stressitesti korraldada prooviversiooniga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser<\/a><\/noindex>. Paljudel juhtudel on soovitatav paigaldada spetsiaalsed t\u00f6\u00f6riistad \u00fche kohalikku v\u00f5rku kuuluvasse arvutisse, et kontrollida iseseisvate pahatahtlike isikute k\u00e4itumist. V\u00f5imalusi on palju ja neid tasub perioodiliselt rakendada mitte ainult katsepol\u00fcgoonil, vaid ka tootmiss\u00fcsteemides, kuid see on juba hoopis teine jutt.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontoriv\u00f5rku\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort v\u00f5i Suricata. Osa 3: kaitse kontoriv\u00f5rku | ProHoster","description":"Eelmises artiklis r\u00e4\u00e4kisime, kuidas k\u00e4ivitada stabiilne Suricata versioon Ubuntu 18.04 LTS-is.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2026-08-11 12:50:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}