{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">eelnevas artiklis<\/a><\/noindex> oleme r\u00e4\u00e4kinud, kuidas k\u00e4ivitada stabiilne versioon Suricat Ubuntu 18.04 LTS. IDS-i seadistamine \u00fchel s\u00f5lmel ja tasuta reeglikomplektide \u00fchendamine ei ole sageli keeruline. T\u00e4na uurime, kuidas kasutada virtuaalses serveris installitud Suricat, et kaitsta ettev\u00f5tte v\u00f5rku k\u00f5ige levinumate r\u00fcnnakute eest. Selleks vajame Linuxi VDS-i koos kahe protsessorituumaga. RAM-i maht s\u00f5ltub koormusest: m\u00f5nele piisab ka 2 GB-st, samas kui t\u00f5sisemate \u00fclesannete jaoks v\u00f5ib vajada 4 v\u00f5i isegi 6. Virtuaalmasina pluss on katsetamise v\u00f5imalused: alustada saab minimaalsete konfiguratsioonidega ja ressursse saab vajadusel suurendada.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>foto: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort v\u00f5i Suricata. Osa 1: valime tasuta IDS\/IPS ettev\u00f5tte v\u00f5rgu kaitsmiseks<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">Snort v\u00f5i Suricata. Osa 2: Suricata paigaldamine ja esmane seadistamine<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>\u00dchendame v\u00f5rgud<\/h2>\n<p>\nIDS-i viimistlemine virtuaalmasinale v\u00f5ib alguses olla vajalik katsesituatsioonide jaoks. Kui teil ei ole selliste lahendustega varasemalt kokkupuudet, siis ei tasu esimese asjana tellida f\u00fc\u00fcsilist riistvara ega muuta v\u00f5rgu arhitektuuri. On parem katsetada s\u00fcsteemi ohutult ja kulutuste v\u00e4ltimiseks, et m\u00e4\u00e4rata arvutusressursside vajadused. Oluline on m\u00f5ista, et kogu ettev\u00f5tte liiklus tuleb suunata l\u00e4bi \u00fche v\u00e4lise s\u00f5lme: kohaliku v\u00f5rgu (v\u00f5i mitme v\u00f5rgu) \u00fchendamiseks VDS-iga, kus on installitud IDS Suricata, saab kasutada <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 kergesti seadistatav, mitmeplatvormiline VPN-server, mis tagab usaldusv\u00e4\u00e4rse kr\u00fcpteerimise. Kontori interneti\u00fchendus ei pruugi omada reaalselt IP-aadressi, seega on m\u00f5istlik see \u00fcles seadistada VPS-is. Ubuntu pakettide hoidlas pole valmis pakette, tarkvara tuleb laadida kas <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">projekti veebilehelt<\/a><\/noindex>, v\u00f5i v\u00e4lisest hoidlast teenusest <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (kui usaldate seda):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nSaate vaadata saadavalolevate pakettide nimekirja j\u00e4rgmise k\u00e4su abil:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMe vajag softether-vpnserver (serveris ar test\u0113\u0161anas konfigur\u0101ciju darbojas VDS), k\u0101 ar\u012b softether-vpncmd \u2014 komandrindas r\u012bks t\u0101 konfigur\u0113\u0161anai.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nServera konfigur\u0113\u0161anai tiek izmantots \u012bpa\u0161s komandrindas r\u012bks:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDetaliz\u0113ti par konfigur\u0113\u0161anu m\u0113s nerun\u0101sim: proced\u016bra ir diezgan vienk\u0101r\u0161a, un t\u0101s apraksts ir pla\u0161i pieejams daudz\u0101s publik\u0101cij\u0101s, un t\u0101 tie\u0161i nesaist\u0101s ar \u0161\u0101 raksta t\u0113mu. \u012asum\u0101, p\u0113c vpncmd palai\u0161anas jums j\u0101izv\u0113las punkts 1, lai p\u0101rietu uz servera p\u0101rvald\u012bbas konsoli. Tam ir nepiecie\u0161ams ievad\u012bt localhost v\u0101rdu un nospiest enter, nevis ievad\u012bt hub v\u0101rdu. Konsol\u0113 j\u0101iestata administratora parole ar komandu serverpasswordset, j\u0101dz\u0113\u0161 virtu\u0101lais huba DEFAULT (komanda hubdelete) un j\u0101izveido jauns ar nosaukumu Suricata_VPN, k\u0101 ar\u012b j\u0101nosaka t\u0101 parole (komanda hubcreate). P\u0113c tam jums j\u0101iet uz jaun\u0101 huba p\u0101rvald\u012bbas konsoli, izmantojot komandu hub Suricata_VPN, lai izveidotu grupu un lietot\u0101ju ar komandu groupcreate un usercreate. Lietot\u0101ja parole tiek noteikta ar userpasswordset. <\/p>\n<p>SoftEther toetab kahte liiklusre\u017eiimi: SecureNAT ja Local Bridge. Esimene on patendiomaniku tehnoloogia, mis loob virtuaalse privaatv\u00f5rgu koos oma NAT-i ja DHCP-ga. SecureNAT ei vaja TUN\/TAP-i ega Netfilter'i v\u00f5i muude tulem\u00fc\u00fcride seadistamist. Suunamine ei m\u00f5juta s\u00fcsteemi kernelit, k\u00f5ik protsessid on virtualiseeritud ja t\u00f6\u00f6tavad igas VPS\/VDS-is, s\u00f5ltumata kasutatavast h\u00fcperviisorist. See toob endaga kaasa suurema protsessorikoormuse ja madalamad kiirusn\u00e4itajad v\u00f5rreldes Local Bridge'iga, mis \u00fchendab SoftEtheri virtuaalset keskuses f\u00fc\u00fcsilise v\u00f5rguadapteri v\u00f5i TAP-seadmest. <\/p>\n<p>Seadistus muutub selles osas keerukamaks, kuna suunamine toimub kernelitasandil Netfilter'i abil. Meie VDS-id on rajatud Hyper-V-le, seet\u00f5ttu loome viimases etapis kohalikku silda ja aktiveerime TAP-seadme k\u00e4su bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes abil. Kui lahkume keskuse haldamise konsoolist, n\u00e4eme s\u00fcsteemis uut v\u00f5rgu liidest, millele pole veel IP-d m\u00e4\u00e4ratud:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEdasi tuleb lubada paketisuunamine liideste vahel (ip forward), kui see ei ole aktiivne:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\nT\u00fchjendage j\u00e4rgmine rida:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nSalvestame failis tehtud muudatused, v\u00e4ljumiseks redaktorist ja rakendame need j\u00e4rgmise k\u00e4suga:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nEdasi peame m\u00e4\u00e4rama virtuaalv\u00f5rgule alav\u00f5rgu vale IP-ga (n\u00e4iteks 10.0.10.0\/24) ja m\u00e4\u00e4rama aadressi liidesesse:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nSeej\u00e4rel on vaja seadistada Netfilteri reeglid.<\/p>\n<p>1. Vajadusel lubage sissetulevad paketid kuulamisel olevatel portidel (SoftEtheri protokoll kasutab HTTPS-i ja porti 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Seadistame NAT-i alamv\u00f5rgust 10.0.10.0\/24 serveri p\u00f5hiasisendile<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Lubage sissetulevad paketid alamv\u00f5rgust 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Lubage sissetulevad paketid juba loodud \u00fchendustele<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nAutomatiseerimise protsessi s\u00fcsteemi taask\u00e4ivitamisel initsialiseerimisskriptide abil j\u00e4tame lugejate kodut\u00f6\u00f6ks. <\/p>\n<p>Kui soovite klientidele IP-aadresse automaatselt jagada, tuleb ka seadistada m\u00f5ni DHCP teenus kohalikuks sillaks. Sellega on serveri seadistus l\u00f5petatud ja saab liikuda klientide juurde. SoftEther toetab mitmeid protokolle, mille kasutamine s\u00f5ltub kohaliku v\u00f5rgu riistvara v\u00f5imekusest. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKuna meie testruuter t\u00f6\u00f6tab ka Ubuntu all, paigaldame sellele v\u00e4lisest hoidlast paketid softether-vpnclient ja softether-vpncmd, et kasutada patenteeritud protokolli. Peame klienti k\u00e4ivitama:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nSeadistamiseks kasutame utiliiti vpncmd, valides localhost masina, kuhu vpnclient on installitud. K\u00f5ik k\u00e4sud sisestatakse konsooli: tuleb luua virtuaalne liides (NicCreate) ja konto (AccountCreate). <\/p>\n<p>M\u00f5nel juhul on vajalik m\u00e4\u00e4rata autentimismeetod k\u00e4sudega AccountAnonymousSet, AccountPasswordSet, AccountCertSet ja AccountSecureCertSet. Kuna me ei kasuta DHCP-d, m\u00e4\u00e4ratakse virtuaalse adapteri aadress k\u00e4sitsi. <\/p>\n<p>Samuti peame v\u00f5imaldama IP edastamise (parameeter net.ipv4.ip_forward=1 failis \/etc\/sysctl.conf) ja seadistama staatilised marsruudid. Vajadusel saab VDS-is, millel on Suricata, seadistada portide edastamise, et kasutada kohaliku v\u00f5rgu teenuseid. Selle v\u00f5rgu\u00fchenduse loomiseks on n\u00fc\u00fcd t\u00f6\u00f6 l\u00f5petatud.<\/p>\n<p>Pakutav konfiguratsioon n\u00e4eb v\u00e4lja umbes selline:<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Seadistame Suricata<\/h2>\n<p>\nV <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">eelnevas artiklis<\/a><\/noindex> Oleme r\u00e4\u00e4kinud kahest IDS-i t\u00f6\u00f6re\u017eiimist: NFQUEUE j\u00e4rjekorra (NFQ re\u017eiim) ja zero copy (AF_PACKET re\u017eiim). Viimane n\u00f5uab kahte liidest, kuid pakub suuremat j\u00f5udlust \u2014 me kasutame just seda. Parameeter on m\u00e4\u00e4ratud vaikimisi failis \/etc\/default\/suricata. Samuti peame redigeerima vars jaotust failis \/etc\/suricata\/suricata.yaml, sisestades sinna virtuaalsubv\u00f5rgu koduseks.<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIDS-i taask\u00e4ivitamiseks kasutame k\u00e4sku:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\nLahendus on valmis, n\u00fc\u00fcd v\u00f5ib teil olla vajalik kontrollida selle vastupidavust pahatahtlike tegevuste suhtes.<\/p>\n<h2>Simuleerime r\u00fcnnakuid<\/h2>\n<p>\nIDS-i v\u00e4liste teenuste kasutamise lahinguskeeme v\u00f5ib olla mitu:<\/p>\n<p><b>DDoS r\u00fcnnakute kaitse (peamine eesm\u00e4rk)<\/b><\/p>\n<p>Selliste lahenduste rakendamine ettev\u00f5tte v\u00f5rgus on keeruline, kuna anal\u00fc\u00fcsimiseks m\u00f5eldud paketid peavad j\u00f5udma s\u00fcsteemi Interneti-poolsele liidesele. Isegi kui IDS need blokeerib, v\u00f5ib parasiitne liiklus \u00fcle koormata andmeedastuskanali. Selle v\u00e4ltimiseks on soovitatav tellida VPS, millel on piisavalt v\u00f5imas Interneti-\u00fchendus, et mahutada kogu kohaliku v\u00f5rgu ja v\u00e4lise liikluse maht. Sageli on see lihtsam ja odavam kui kontori\u00fchenduse laiendamine. Alternatiivina tasub mainida spetsialiseeritud teenuseid DDoS-i r\u00fcnnakute kaitseks. Nende teenuste maksumus on sarnane virtuaalserveri hindadega, kuid ei ole vajalik keeruline seadistamine; siiski on puuduseks see, et klient saab oma raha eest ainult DDoS-i kaitse, samas kui oma IDS-i saab konfigureerida vastavalt vajadustele.<\/p>\n<p><b>Kaitse teiste t\u00fc\u00fcpide v\u00e4listest r\u00fcnnakutest<\/b> <\/p>\n<p>Suricata suudab tegeleda erinevate haavatavuste \u00e4rakasutamise katsetega ettev\u00f5tte v\u00f5rgu avalikult k\u00e4ttesaadavates teenustes (posti server, veebiserver ja veebi rakendused jne). T\u00fc\u00fcpiliselt paigaldatakse IDS sisev\u00f5rku, kuid v\u00f5ib olla ka \u00f5igustatud selle v\u00e4lisseadmetesse paigutamine.<\/p>\n<p><b>Kaitse sisemiste kurjategijate eest<\/b><\/p>\n<p>Vaatamata k\u00f5ikidele s\u00fcsteemiadministraatori pingutustele v\u00f5ivad ettev\u00f5tte v\u00f5rgu arvutid saada pahavara r\u00fcnnaku objektiks. Lisaks v\u00f5ivad sisev\u00f5rgus esineda m\u00f5nikord h\u00e4irijad, kes p\u00fc\u00fcavad teostada ebaseaduslikke toiminguid. Suricata suudab aidata selliseid katsed blokeerida, kuigi sisev\u00f5rgu kaitsmiseks on parem paigaldada see perimeetri sisse ja kasutada koos haldatava vahetuskeskusega, mis suudab liiklust \u00fche porti peegeldada. V\u00e4lise IDS-i kasutamine ei ole ka t\u00e4iesti m\u00f5ttetu \u2014 v\u00e4hemalt suudab see tuvastada katsed, millega sisev\u00f5rgu pahavara tahab \u00fchendust luua v\u00e4lise serveriga.<\/p>\n<p>Alustame veel \u00fche testimise r\u00fcndava VPS-i loomisega ning paigaldame lokaalsesse v\u00f5rku Apache vaikekonfiguratsiooniga, millele suuname 80. portaali IDS-serverilt. Edasi simuleerime teenust\u00f5rke DDoS r\u00fcnnakut r\u00fcndavast s\u00f5lme. Selleks laadime GitHubist alla, kompileerime ja k\u00e4ivitame r\u00fcndavas s\u00f5lmes v\u00e4ikese programmi xerxes (v\u00f5ib olla vajalik gcc paketi paigaldamine):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nTema t\u00f6\u00f6 tulemuseks oli j\u00e4rgmine:<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata peatab r\u00fcndaja, samas kui Apache vaikeleht avaneb vaatamata meie improvisatsioonilisele r\u00fcnnakule ja \u00fcsna aeglasele \u00abkontori\u00bb (t\u00f5epoolest kodu) v\u00f5rgu\u00fchendusele. T\u00f5sisemate \u00fclesannete jaoks tasub kasutada <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. See on m\u00f5eldud penetratsioonitestide l\u00e4biviimiseks ja v\u00f5imaldab simuleerida mitmesuguseid r\u00fcnnakuid. Paigaldusjuhend <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">saadaval<\/a><\/noindex> on projekti veebilehelt. P\u00e4rast paigaldamist on vajalik uuendus:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nTestimiseks k\u00e4ivitame msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKahjuks ei toeta raamistik viimases versioonis automaatset \u00e4rakasutamist, seega tuleb eksploidid k\u00e4sitsi l\u00e4bi t\u00f6\u00f6tada ja k\u00e4ivitada k\u00e4suga use. Alustada tasub r\u00fcnnatud s\u00fcsteemi avatud portide m\u00e4\u00e4ramisest, n\u00e4iteks nmapi abil (meie puhul asendab seda t\u00e4iesti netstat r\u00fcnnataval s\u00f5lmel), seej\u00e4rel valida ja kasutada sobivaid <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">Metasploit'i mooduleid<\/a><\/noindex>.\u00a0<\/p>\n<p>On olemas ka teisi IDS-ide r\u00fcnnakute kestvuse kontrollimise vahendeid, sealhulgas veebiteenuseid. Uudishimu p\u00e4rast v\u00f5ib proovida stressitestimist prooviversiooni abil <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser<\/a><\/noindex>. Et kontrollida reaktsiooni sisemiste r\u00fcndajate tegevusele, tasub paigaldada spetsiaalsed t\u00f6\u00f6riistad \u00fche kohaliku v\u00f5rgu masinasse. Variante on seinast seina ja neid tuleks aeg-ajalt rakendada mitte ainult katseplatsil, vaid ka tootmiss\u00fcsteemides, kuid see on juba hoopis teine lugu.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort v\u00f5i Suricata. Osa 3: kaitseme kontorinetti\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort v\u00f5i Suricata. Osa 3: kontoriv\u00f5rgu kaitsmine | ProHoster","description":"Eelmises artiklis r\u00e4\u00e4kisime, kuidas k\u00e4ivitada Suricata stabiilne versioon Ubuntu 18.04 LTS-s. IDS-i seadistamine \u00fchele s\u00f5lmele ja tasuta reeglite komplektide \u00fchendamine on \u00fcsna lihtne. T\u00e4na k\u00e4sitleme, kuidas virtuaalses serveris installitud Suricataga kaitsta ettev\u00f5tte v\u00f5rku k\u00f5ige levinumate r\u00fcnnakute eest. Selleks vajame Linuxil p\u00f5hinevat VDS-i, millel on kaks arvutusressurssi.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2022-10-02 04:55:20"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}