{"id":85990,"date":"2020-06-21T01:42:12","date_gmt":"2020-06-20T23:42:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata"},"modified":"2020-06-21T01:42:12","modified_gmt":"2020-06-20T23:42:12","slug":"snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","title":{"rendered":"Snort ili Suricata. Dio 2: instalacija i osnovna konfiguracija Suricate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ako vjerovati statistikama, volumen mre\u017enog prometa raste otprilike 50% svake godine. To dovodi do pove\u0107anja optere\u0107enja na opremi i, posebno, pove\u0107ava zahtjeve za performanse IDS\/IPS-a. Mo\u017eete kupiti skupi specijalizirani hardver, ali postoji jeftinija opcija \u2014 implementacija jednog od sustava s otvorenim kodom. Mnogi mladi administratori smatraju da je instalacija i konfiguracija besplatnog IPS-a prili\u010dno te\u0161ka. U slu\u010daju Suricate, to nije sasvim to\u010dno \u2014 mogu\u0107e je instalirati ju i zapo\u010deti otkrivanje tipi\u010dnih napada s paketom besplatnih pravila za nekoliko minuta.<\/p>\n

\"Snort<\/a><\/noindex><\/a><\/noindex>
\nSnort ili Suricata. Dio 1: biramo besplatni IDS\/IPS za za\u0161titu korporativne mre\u017ee<\/a><\/noindex><\/p>\n

Za\u0161to je potrebna jo\u0161 jedna otvorena IPS?<\/h2>\n

\nDugo vremena, sustav Snort, koji se smatra standardom, razvija se od kraja devedesetih, stoga je prvotno bio jednoprotokolan. Tijekom godina, opremljen je svim modernim zna\u010dajkama, poput podr\u0161ke za IPv6, mogu\u0107nosti analize aplikacijskih protokola i univerzalnog modula za pristup podacima. <\/p>\n

Osnovni motor Snort 2.X nau\u010dio je raditi s nekoliko jezgri, ali je ostao jednoprotokolan i stoga ne mo\u017ee optimalno iskoristiti prednosti modernih hardverskih platformi. <\/p>\n

Problem je rije\u0161en u tre\u0107oj verziji sustava, no pripremala se toliko dugo da je na tr\u017ei\u0161tu ve\u0107 nastala Suricata, napisana od nule. Godine 2009. po\u010dela se razvijati kao multithread alternativa Snortu, koja je imala funkcionalnosti IPS-a iz kutije. Kod se distribuira pod GPLv2 licencom, ali financijski partneri projekta imaju pristup zatvorenoj verziji motora. Neki problemi s skalabilno\u0161\u0107u u prvim verzijama sustava pojavili su se, ali su brzo rije\u0161eni.<\/p>\n

Za\u0161to Suricata?<\/h2>\n

\nU Suricati postoji nekoliko modula (kao i u Snortu): za hvatanje, prikupljanje, dekodiranje, otkrivanje i isporuku. Prema zadanim postavkama, uhva\u0107en promet ide do dekodiranja jednim tokom, iako to vi\u0161e optere\u0107uje sustav. Po potrebi, tokove je mogu\u0107e podijeliti u postavkama i rasporediti po procesorima \u2014 Suricata se vrlo dobro optimizira za specifi\u010dan hardver, iako to vi\u0161e nije razina HOWTO za po\u010detnike. Tako\u0111er, valja napomenuti prisutnost u Suricati naprednih sredstava za inspekciju HTTP-a temeljenih na biblioteci HTP. Ona se tako\u0111er mo\u017ee koristiti za logiranje prometa bez otkrivanja. Sustav tako\u0111er podr\u017eava dekodiranje IPv6, uklju\u010duju\u0107i tuneliranje IPv4-u-u-IPv6, IPv6-u-u-IPv6 i drugo. <\/p>\n

Razli\u010diti su su\u010delja mogu se koristiti za presretanje prometa (NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING), a u Unix Socket na\u010dinu mo\u017ee se automatski analizirati promet uhva\u0107en drugim snifferom iz PCAP datoteka. Osim toga, modularna arhitektura Suricate pojednostavljuje povezivanje novih elemenata za hvatanje, dekodiranje, analizu i obradu mre\u017enih paketa. Tako\u0111er je va\u017eno napomenuti da se u Suricati blokada prometa vr\u0161i sredstvima ugra\u0111enog filtra operativnog sustava. U GNU\/Linuxu su dostupne dvije opcije za rad IPS-a: preko NFQUEUE reda (NFQ na\u010din) i preko zero copy (AF_PACKET na\u010din). U prvom slu\u010daju, paket koji zavr\u0161i u iptables preusmjerava se u NFQUEUE red, gdje se mo\u017ee obraditi na korisni\u010dkoj razini. Suricata ga prolazi kroz svoja pravila i donosi jedan od tri presude: NF_ACCEPT, NF_DROP i NF_REPEAT. Prva dva ne zahtijevaju poja\u0161njenje, dok posljednji omogu\u0107uje ozna\u010davanje paketa i slanje natrag na po\u010detak trenutne tablice iptables. AF_PACKET na\u010din se odlikuje vi\u0161im performansama, ali name\u0107e sustavu niz ograni\u010denja: mora imati dva mre\u017ena su\u010delja i raditi kao prolaznik. Zbog toga se blokirani paket jednostavno ne proslije\u0111uje na drugo su\u010delje. <\/p>\n

Va\u017ena karakteristika Suricate je mogu\u0107nost kori\u0161tenja resursa za Snort. Administratoru su dostupni, izme\u0111u ostalog, setovi pravila Sourcefire VRT i OpenSource Emerging Threats, kao i komercijalni Emerging Threats Pro. Unified output se mo\u017ee analizirati pomo\u0107u popularnih backendova, a tako\u0111er se podr\u017eava izlaz u PCAP i Syslog. Postavke sistema i pravila se \u010duvaju u YAML datotekama, koje su lako \u010ditljive i mogu se automatski obra\u0111ivati. Suricata prepoznaje mnoge protokole, pa nije potrebno vezivati pravila za broj porta. Tako\u0111er, u pravilima Suricate se aktivno koristi koncept flowbits. Za pra\u0107enje aktivacije koriste se sesijske varijable, koje omogu\u0107uju kreiranje i primjenu razli\u010ditih broja\u010da i zastavica. Mnogi IDS sustavi smatraju razli\u010dite TCP veze kao odvojene entitete i mogu ne primijetiti veze me\u0111u njima, \u0161to ukazuje na po\u010detak napada. Suricata nastoji vidjeti \u0161iru sliku i u mnogim slu\u010dajevima prepoznaje zlo\u0107udni promet raspore\u0111en preko razli\u010ditih veza. O njezinim prednostima se mo\u017ee dugo raspravljati, bolje je da se prebacimo na instalaciju i postavku.<\/p>\n

Kako instalirati?<\/h2>\n

\nInstalirat \u0107emo Suricatu na virtualni server koji radi pod Ubuntu 18.04 LTS. Sve komande potrebno je izvr\u0161avati u ime superkorisnika (root). Najsigurnija opcija je da se pove\u017eete sa serverom putem SSH kao obi\u010dni korisnik, a zatim upotrijebite sudo za pove\u0107anje privilegija. Na po\u010detku, potrebno je instalirati pakete koji \u0107e nam biti potrebni:<\/p>\n

sudo apt -y install libpcre3 libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config libnetfilter-queue-dev geoip-bin geoip-database geoipupdate apt-transport-https<\/code><\/pre>\n
\nPovezujemo vanjski repozitorij:<\/p>\n
sudo add-apt-repository ppa:oisf\/suricata-stable\nsudo apt-get update<\/code><\/pre>\n
\nInstaliramo najnoviju stabilnu verziju Suricate:<\/p>\n
sudo apt-get install suricata<\/code><\/pre>\n
\nAko je potrebno, ispravite konfiguracijske datoteke, zamjenjuju\u0107i zadani eth0 stvarnim imenom vanjskog su\u010delja poslu\u017eitelja. Zadane postavke \u010duvaju se u datoteci \/etc\/default\/suricata, a korisni\u010dke u \/etc\/suricata\/suricata.yaml. Konfiguracija IDS-a ve\u0107inom se svodi na izmjenu ove konfiguracijske datoteke. Sadr\u017ei brojne parametre koji nazivom i namjenom odgovaraju onima iz Snorta. Ipak, sintaksa je potpuno druga\u010dija, no datoteku je puno lak\u0161e \u010ditati nego Snortove konfiguracije, a osim toga, dobro je komentirana.<\/p>\n
sudo nano \/etc\/default\/suricata<\/code><\/pre>\n
\n\"Snort
\n
\ni<\/p>\n
sudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n
\n\"Snort
\n
\nPozor! Prije pokretanja potrebno je provjeriti vrijednosti varijabli iz odjeljka vars.<\/p>\n
Za dovr\u0161etak postavke bit \u0107e potrebno instalirati suricata-update za a\u017euriranje i preuzimanje pravila. To je prili\u010dno jednostavno:<\/p>\n
sudo apt install python-pip\nsudo pip install pyyaml\nsudo pip install <a href="https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip">https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip<\/a>\nsudo pip install --pre --upgrade suricata-update<\/code><\/pre>\n
\nDalje, trebamo pokrenuti naredbu suricata-update za instalaciju paketa pravila Emerging Threats Open:<\/p>\n
sudo suricata-update<\/code><\/pre>\n
\n\"Snort
\n
\nZa pregled popisa izvora pravila izvr\u0161ite sljede\u0107u naredbu:<\/p>\n
sudo suricata-update list-sources<\/code><\/pre>\n
\n\"Snort
\n
\nA\u017euriramo izvore pravila:<\/p>\n
sudo suricata-update update-sources<\/code><\/pre>\n
\n\"Snort
\n
\nPonovno pregledavamo a\u017eurirane izvore:<\/p>\n
sudo suricata-update list-sources<\/code><\/pre>\n
\nAko je potrebno, mo\u017eete omogu\u0107iti dostupne besplatne izvore:<\/p>\n
sudo suricata-update enable-source ptresearch\/attackdetection\nsudo suricata-update enable-source oisf\/trafficid\nsudo suricata-update enable-source sslbl\/ssl-fp-blacklist<\/code><\/pre>\n
\nNakon toga potrebno je ponovno a\u017eurirati pravila:<\/p>\n
sudo suricata-update<\/code><\/pre>\n
\nTime se instalacija i osnovna konfiguracija Suricate u Ubuntu 18.04 LTS mogu smatrati zavr\u0161enima. Slijedi najzanimljiviji dio: u sljede\u0107em \u010dlanku povezujemo virtualni poslu\u017eitelj s uredskom mre\u017eom putem VPN-a i po\u010dinjemo analizirati cjelokupan ulazni i izlazni promet. Posebna pa\u017enja posvetit \u0107e se blokiranju DDoS napada, aktivnostima zlonamjernog softvera i poku\u0161ajima iskori\u0161tavanja ranjivosti u uslugama dostupnim iz javno dostupnih mre\u017ea. Za ilustraciju, simulirat \u0107emo napade naj\u010de\u0161\u0107ih tipova.<\/p>\n
\"Snort<\/a><\/noindex><\/p>\n
\"Snort<\/a><\/noindex>
\n
Izvor: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043a\u0443\u043f\u0430\u0442\u044c \u0434\u043e\u0440\u043e\u0433\u043e\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0436\u0435\u043b\u0435\u0437\u043e, \u043d\u043e \u0435\u0441\u0442\u044c \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u043e\u0434\u0435\u0448\u0435\u0432\u043b\u0435 \u2014 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0431\u0443\u0434\u0442\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0441\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IPS […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85991,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort ili Suricata. Dio 2: instalacija i osnovna konfiguracija Suricate | ProHoster","description":"Ako je vjerovati statistikama, koli\u010dina mre\u017enog prometa pove\u0107ava se pribli\u017eno za 50% svake godine. To dovodi do pove\u0107anja optere\u0107enja na opremi i, posebno, pove\u0107ava zahtjeve za performansama IDS\/IPSa.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.","og:url":"https:\/\/prohoster.info\/hr\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-20T23:42:12+00:00","article:modified_time":"2020-06-20T23:42:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85990","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:26:01","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/85990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=85990"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/85990\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/85991"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=85990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=85990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=85990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}