{"id":31890,"date":"2019-10-31T21:43:45","date_gmt":"2019-10-31T18:43:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mandatnaya-model-raspredeleniya-prav-v-freebsd\/"},"modified":"2019-10-31T21:43:45","modified_gmt":"2019-10-31T18:43:45","slug":"mandatnaya-model-raspredeleniya-prav-v-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","title":{"rendered":"Modelo de distribui\u00e7\u00e3o de direitos em FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Introdu\u00e7\u00e3o<\/h2>\n

Para garantir um n\u00edvel adicional de seguran\u00e7a ao servidor, pode-se utilizar um modelo de mandato<\/a><\/noindex> de distribui\u00e7\u00e3o de acesso. Neste artigo, descreveremos como executar o Apache em um jail com acesso apenas aos componentes necess\u00e1rios para o funcionamento adequado do Apache e PHP. Esse princ\u00edpio pode ser aplicado n\u00e3o apenas ao Apache, mas tamb\u00e9m a qualquer outra pilha.
\n<\/a><\/noindex><\/p>\n

Prepara\u00e7\u00e3o<\/h2>\n

Este m\u00e9todo \u00e9 adequado apenas para o sistema de arquivos UFS. Neste exemplo, utilizaremos ZFS no sistema principal e UFS no jail. A primeira coisa a fazer \u00e9 recompilar o n\u00facleo; ao instalar o FreeBSD, instale o c\u00f3digo-fonte.
\nDepois que o sistema estiver instalado, edite o arquivo:<\/p>\n

\/usr\/src\/sys\/amd64\/conf\/GENERIC\n<\/code><\/pre>\n
Neste arquivo, voc\u00ea precisar\u00e1 adicionar apenas uma linha:<\/p>\n
options     MAC_MLS\n<\/code><\/pre>\n
A etiqueta mls\/high ter\u00e1 uma posi\u00e7\u00e3o dominante sobre a etiqueta mls\/low; aplica\u00e7\u00f5es que forem iniciadas com a etiqueta mls\/low n\u00e3o poder\u00e3o acessar arquivos que possuem a etiqueta mls\/high. Para mais informa\u00e7\u00f5es sobre todas as etiquetas dispon\u00edveis no sistema FreeBSD, voc\u00ea pode consultar este guia<\/a><\/noindex>.
\nEm seguida, v\u00e1 para o diret\u00f3rio \/usr\/src:<\/p>\n
cd \/usr\/src\n<\/code><\/pre>\n
Para iniciar a constru\u00e7\u00e3o do n\u00facleo, execute (na op\u00e7\u00e3o j, indique o n\u00famero de n\u00facleos do sistema):<\/p>\n
make -j 4 buildkernel KERNCONF=GENERIC\n<\/code><\/pre>\n
Depois que o n\u00facleo for compilado, voc\u00ea precisar\u00e1 instal\u00e1-lo:<\/p>\n
make installkernel KERNCONF=GENERIC\n<\/code><\/pre>\n
Ap\u00f3s a instala\u00e7\u00e3o do n\u00facleo, n\u00e3o se apresse em reiniciar o sistema, pois voc\u00ea precisar\u00e1 mover os usu\u00e1rios para a classe de login, previamente configurando-a. Edite o arquivo \/etc\/login.conf e ajuste a classe de login padr\u00e3o para o seguinte formato:<\/p>\n
default:\n        :passwd_format=sha512:\n        :copyright=\/etc\/COPYRIGHT:\n        :welcome=\/etc\/motd:\n        :setenv=MAIL=\/var\/mail\/$,BLOCKSIZE=K:\n        :path=\/sbin \/bin \/usr\/sbin \/usr\/bin \/usr\/local\/sbin \/usr\/local\/bin ~\/bin:\n        :nologin=\/var\/run\/nologin:\n        :cputime=unlimited:\n        :datasize=unlimited:\n        :stacksize=unlimited:\n        :memorylocked=64K:\n        :memoryuse=unlimited:\n        :filesize=unlimited:\n        :coredumpsize=unlimited:\n        :openfiles=unlimited:\n        :maxproc=unlimited:\n        :sbsize=unlimited:\n        :vmemoryuse=unlimited:\n        :swapuse=unlimited:\n        :pseudoterminals=unlimited:\n        :kqueues=unlimited:\n        :umtxp=unlimited:\n        :priority=0:\n        :ignoretime@:\n        :umask=022:\n        :label=mls\/equal:\n<\/code><\/pre>\n
A linha :label=mls\/equal permitir\u00e1 que usu\u00e1rios que pertencem a esta classe acessem arquivos marcados com qualquer etiqueta (mls\/low, mls\/high). Ap\u00f3s essas manipula\u00e7\u00f5es, \u00e9 necess\u00e1rio reconstruir o banco de dados e colocar o usu\u00e1rio root (assim como aqueles que precisarem) nesta classe de login:<\/p>\n
cap_mkdb \/etc\/login.conf\npw usermod root -L default\n<\/code><\/pre>\n
Para que a pol\u00edtica se aplique apenas aos arquivos, \u00e9 necess\u00e1rio editar o arquivo \/etc\/mac.conf, deixando apenas uma linha:<\/p>\n
default_labels file ?mls\n<\/code><\/pre>\n
Tamb\u00e9m \u00e9 necess\u00e1rio adicionar o m\u00f3dulo mac_mls.ko \u00e0 inicializa\u00e7\u00e3o autom\u00e1tica:<\/p>\n
echo 'mac_mls_load=\"YES\"' >> \/boot\/loader.conf\n<\/code><\/pre>\n
Ap\u00f3s isso, voc\u00ea pode reiniciar o sistema sem preocupa\u00e7\u00f5es. Como criar jail<\/a><\/noindex> pode ser lido em uma de minhas publica\u00e7\u00f5es. Mas antes de criar um jail, \u00e9 necess\u00e1rio adicionar um disco r\u00edgido e criar um sistema de arquivos, ativando o multilabel, criando um sistema de arquivos ufs2 com um tamanho de bloco de 64kb:<\/p>\n
newfs -O 2 -b 64kb \/dev\/ada1\ntunefs -l enable \/dev\/ada1\n<\/code><\/pre>\n
Ap\u00f3s criar o sistema de arquivos e adicionar multilabel, \u00e9 necess\u00e1rio adicionar o disco r\u00edgido ao \/etc\/fstab, adicione a linha a este arquivo:<\/p>\n
\/dev\/ada1               \/jail  ufs     rw              0       1\n<\/code><\/pre>\n
No Mountpoint, indique o diret\u00f3rio no qual voc\u00ea ir\u00e1 montar o disco r\u00edgido; em Pass, obrigatoriamente indique 1 (a ordem em que a verifica\u00e7\u00e3o deste disco r\u00edgido ser\u00e1 realizada) \u2014 isso \u00e9 necess\u00e1rio, pois o sistema de arquivos ufs \u00e9 sens\u00edvel a quedas s\u00fabitas de energia. Ap\u00f3s essas a\u00e7\u00f5es, monte o disco:<\/p>\n
mount \/dev\/ada1 \/jail\n<\/code><\/pre>\n
Instale o jail neste diret\u00f3rio. Ap\u00f3s o jail estar em funcionamento, devem ser feitas as mesmas manipula\u00e7\u00f5es que foram feitas no sistema principal com os usu\u00e1rios e arquivos \/etc\/login.conf, \/etc\/mac.conf. <\/p>\n
Configura\u00e7\u00e3o<\/h2>\n
Antes de definir as etiquetas necess\u00e1rias, recomendo instalar todos os pacotes necess\u00e1rios. No meu caso, as etiquetas ser\u00e3o definidas considerando os seguintes pacotes:<\/p>\n
mod_php73-7.3.4_1              Linguagem de Scripting PHP\nphp73-7.3.4_1                  Linguagem de Scripting PHP\nphp73-ctype-7.3.4_1            A extens\u00e3o compartilhada ctype para php\nphp73-curl-7.3.4_1             A extens\u00e3o compartilhada curl para php\nphp73-dom-7.3.4_1              A extens\u00e3o compartilhada dom para php\nphp73-extensions-1.0           \"meta-port\" para instalar extens\u00f5es PHP\nphp73-filter-7.3.4_1           A extens\u00e3o compartilhada filter para php\nphp73-gd-7.3.4_1               A extens\u00e3o compartilhada gd para php\nphp73-gettext-7.3.4_1          A extens\u00e3o compartilhada gettext para php\nphp73-hash-7.3.4_1             A extens\u00e3o compartilhada hash para php\nphp73-iconv-7.3.4_1            A extens\u00e3o compartilhada iconv para php\nphp73-json-7.3.4_1             A extens\u00e3o compartilhada json para php\nphp73-mysqli-7.3.4_1           A extens\u00e3o compartilhada mysqli para php\nphp73-opcache-7.3.4_1          A extens\u00e3o compartilhada opcache para php\nphp73-openssl-7.3.4_1          A extens\u00e3o compartilhada openssl para php\nphp73-pdo-7.3.4_1              A extens\u00e3o compartilhada pdo para php\nphp73-pdo_sqlite-7.3.4_1       A extens\u00e3o compartilhada pdo_sqlite para php\nphp73-phar-7.3.4_1             A extens\u00e3o compartilhada phar para php\nphp73-posix-7.3.4_1            A extens\u00e3o compartilhada posix para php\nphp73-session-7.3.4_1          A extens\u00e3o compartilhada session para php\nphp73-simplexml-7.3.4_1        A extens\u00e3o compartilhada simplexml para php\nphp73-sqlite3-7.3.4_1          A extens\u00e3o compartilhada sqlite3 para php\nphp73-tokenizer-7.3.4_1        A extens\u00e3o compartilhada tokenizer para php\nphp73-xml-7.3.4_1              A extens\u00e3o compartilhada xml para php\nphp73-xmlreader-7.3.4_1        A extens\u00e3o compartilhada xmlreader para php\nphp73-xmlrpc-7.3.4_1           A extens\u00e3o compartilhada xmlrpc para php\nphp73-xmlwriter-7.3.4_1        A extens\u00e3o compartilhada xmlwriter para php\nphp73-xsl-7.3.4_1              A extens\u00e3o compartilhada xsl para php\nphp73-zip-7.3.4_1              A extens\u00e3o compartilhada zip para php\nphp73-zlib-7.3.4_1             A extens\u00e3o compartilhada zlib para php\napache24-2.4.39 \n<\/code><\/pre>\n
Neste exemplo, as etiquetas ser\u00e3o definidas considerando as depend\u00eancias desses pacotes. Pode-se, \u00e9 claro, optar por uma abordagem mais simples, definindo etiquetas mls\/low para a pasta \/usr\/local\/lib e para os arquivos contidos neste diret\u00f3rio, permitindo que pacotes instalados posteriormente (como extens\u00f5es adicionais para php) tenham acesso \u00e0s bibliotecas desse diret\u00f3rio, mas eu acho que \u00e9 melhor fornecer acesso apenas aos arquivos necess\u00e1rios. Pare o jail e defina etiquetas mls\/high para todos os arquivos:<\/p>\n
setfmac -R mls\/high \/jail\n<\/code><\/pre>\n
Ao definir as etiquetas, o processo ser\u00e1 interrompido se o setfmac encontrar links duros; no meu exemplo, eu removi links duros dos seguintes diret\u00f3rios:<\/p>\n
\/var\/db\/etcupdate\/current\/\n\/var\/db\/etcupdate\/current\/etc\n\/var\/db\/etcupdate\/current\/usr\/share\/openssl\/man\/en.ISO8859-15\n\/var\/db\/etcupdate\/current\/usr\/share\/man\/en.ISO8859-15\n\/var\/db\/etcupdate\/current\/usr\/share\/man\/en.UTF-8\n\/var\/db\/etcupdate\/current\/usr\/share\/nls\n\/etc\/ssl\n\/usr\/local\/etc\n\/usr\/local\/etc\/fonts\/conf.d\n\/usr\/local\/openssl\n<\/code><\/pre>\n
Depois que as etiquetas forem definidas, \u00e9 necess\u00e1rio definir etiquetas mls\/low para o apache; primeiro, \u00e9 preciso descobrir quais arquivos s\u00e3o necess\u00e1rios para iniciar o apache:<\/p>\n
ldd \/usr\/local\/sbin\/httpd\n<\/code><\/pre>\n
Ap\u00f3s a execu\u00e7\u00e3o deste comando, as depend\u00eancias ser\u00e3o exibidas na tela, mas apenas marcar esses arquivos n\u00e3o ser\u00e1 suficiente, pois os diret\u00f3rios onde esses arquivos est\u00e3o localizados t\u00eam a etiqueta mls\/high; portanto, tamb\u00e9m \u00e9 necess\u00e1rio marcar esses diret\u00f3rios como mls\/low. Ao iniciar o apache, ele tamb\u00e9m listar\u00e1 os arquivos necess\u00e1rios para sua execu\u00e7\u00e3o e as depend\u00eancias do php podem ser verificadas no log httpd-error.log.<\/p>\n
setfmac mls\/low \/\nsetfmac mls\/low \/usr\/local\/lib\/libpcre.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libaprutil-1.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libdb-5.3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libgdbm.so.6\nsetfmac mls\/low \/usr\/local\/lib\/libexpat.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libapr-1.so.0\nsetfmac mls\/low \/lib\/libcrypt.so.5\nsetfmac mls\/low \/lib\/libthr.so.3\nsetfmac mls\/low \/lib\/libc.so.7\nsetfmac mls\/low \/usr\/local\/lib\/libintl.so.8\nsetfmac mls\/low \/var\nsetfmac mls\/low \/var\/run\nsetfmac mls\/low \/var\/log\nsetfmac mls\/low \/var\/log\/httpd-access.log\nsetfmac mls\/low \/var\/log\/httpd-error.log\nsetfmac mls\/low \/var\/run\/httpd.pid\nsetfmac mls\/low \/lib\nsetfmac mls\/low \/lib\/libcrypt.so.5\nsetfmac mls\/low \/usr\/local\/lib\/db5\/libdb-5.3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/db5\/libdb-5.3.so.0.0.0\nsetfmac mls\/low \/usr\/local\/lib\/db5\nsetfmac mls\/low \/usr\/local\/lib\nsetfmac mls\/low \/libexec\nsetfmac mls\/low \/libexec\/ld-elf.so.1\nsetfmac mls\/low \/dev\nsetfmac mls\/low \/dev\/random\nsetfmac mls\/low \/usr\/local\/libexec\nsetfmac mls\/low \/usr\/local\/libexec\/apache24\nsetfmac mls\/low \/usr\/local\/libexec\/apache24\/*\nsetfmac mls\/low \/etc\/pwd.db\nsetfmac mls\/low \/etc\/passwd\nsetfmac mls\/low \/etc\/group\nsetfmac mls\/low \/etc\/\nsetfmac mls\/low \/usr\/local\/etc\nsetfmac -R mls\/low \/usr\/local\/etc\/apache24\nsetfmac mls\/low \/usr\nsetfmac mls\/low \/usr\/local\nsetfmac mls\/low \/usr\/local\/sbin\nsetfmac mls\/low \/usr\/local\/sbin\/*\nsetfmac -R mls\/low \/usr\/local\/etc\/rc.d\/\nsetfmac mls\/low \/usr\/local\/sbin\/htcacheclean\nsetfmac mls\/low \/var\/log\/httpd-access.log\nsetfmac mls\/low \/var\/log\/httpd-error.log\nsetfmac -R mls\/low \/usr\/local\/www\nsetfmac mls\/low \/usr\/lib\nsetfmac mls\/low \/tmp\nsetfmac -R mls\/low \/usr\/local\/lib\/php\nsetfmac -R mls\/low \/usr\/local\/etc\/php\nsetfmac mls\/low \/usr\/local\/etc\/php.conf\nsetfmac mls\/low \/lib\/libelf.so.2\nsetfmac mls\/low \/lib\/libm.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libxml2.so.2\nsetfmac mls\/low \/lib\/libz.so.6\nsetfmac mls\/low \/usr\/lib\/liblzma.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libiconv.so.2\nsetfmac mls\/low \/usr\/lib\/librt.so.1\nsetfmac mls\/low \/lib\/libthr.so.3\nsetfmac mls\/low \/usr\/local\/lib\/libpng16.so.16\nsetfmac mls\/low \/usr\/lib\/libbz2.so.4\nsetfmac mls\/low \/usr\/local\/lib\/libargon2.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libpcre2-8.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libsqlite3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libgd.so.6\nsetfmac mls\/low \/usr\/local\/lib\/libjpeg.so.8\nsetfmac mls\/low \/usr\/local\/lib\/libfreetype.so\nsetfmac mls\/low \/usr\/local\/lib\/libfontconfig.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libtiff.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libwebp.so.7\nsetfmac mls\/low \/usr\/local\/lib\/libjbig.so.2\nsetfmac mls\/low \/usr\/lib\/libssl.so.8\nsetfmac mls\/low \/lib\/libcrypto.so.8\nsetfmac mls\/low \/usr\/local\/lib\/libzip.so.5\nsetfmac mls\/low \/etc\/resolv.conf\n<\/code><\/pre>\n
Nesta lista, s\u00e3o atribu\u00eddas etiquetas mls\/low a todos os arquivos necess\u00e1rios para o funcionamento adequado da combina\u00e7\u00e3o apache e php (para os pacotes que est\u00e3o instalados no meu exemplo).<\/p>\n
A \u00faltima etapa ser\u00e1 configurar a execu\u00e7\u00e3o do jail no n\u00edvel mls\/equal e o apache no n\u00edvel mls\/low. Para iniciar o jail, \u00e9 necess\u00e1rio fazer altera\u00e7\u00f5es no script \/etc\/rc.d\/jail, encontre neste script a fun\u00e7\u00e3o jail_start e ajuste a vari\u00e1vel command para:<\/p>\n
command=\"setpmac mls\/equal $jail_program\"\n<\/code><\/pre>\n
O comando setpmac executa o arquivo execut\u00e1vel no n\u00edvel de mandato necess\u00e1rio, neste caso mls\/equal, para ter acesso a todos os r\u00f3tulos. No apache, \u00e9 necess\u00e1rio editar o script de inicializa\u00e7\u00e3o \/usr\/local\/etc\/rc.d\/apache24. Fa\u00e7a altera\u00e7\u00f5es na fun\u00e7\u00e3o apache24_prestart:<\/p>\n
apache24_prestart() {\n        apache24_checkfib\n        apache24_precmd\n        eval \"setpmac mls\/low\" ${command} ${apache24_flags}\n}\n<\/code><\/pre>\n
Em oficial<\/a><\/noindex> O guia fornece outro exemplo, mas n\u00e3o consegui utiliz\u00e1-lo pois constantemente aparecia a mensagem de que n\u00e3o era poss\u00edvel usar o comando setpmac.<\/p>\n
Sa\u00edda<\/h2>\n
Esse m\u00e9todo de distribui\u00e7\u00e3o de acesso adicionar\u00e1 um n\u00edvel extra de seguran\u00e7a ao apache (embora esse m\u00e9todo possa ser aplicado a qualquer outro stack), que al\u00e9m disso \u00e9 executado em jail, ao mesmo tempo em que para o administrador tudo isso ocorrer\u00e1 de forma transparente e impercept\u00edvel.<\/p>\n
A lista de fontes que me ajudaram na elabora\u00e7\u00e3o desta publica\u00e7\u00e3o:<\/b><\/p>\n
https:\/\/www.freebsd.org\/doc\/ru_RU.KOI8-R\/books\/handbook\/mac.html<\/a><\/noindex>
\n
Fonte: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u0443\u044e \u043c\u043e\u0434\u0435\u043b\u044c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u043e \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c apache \u0432 jail \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0442\u0435\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b apache \u0438 php. \u041f\u043e \u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u043c\u043e\u0436\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e apache, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043b\u044e\u0431\u043e\u0439 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u044d\u043a. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31890","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Modelo de Distribui\u00e7\u00e3o de Direitos Mandat\u00e1rio no FreeBSD | ProHoster","description":"Introdu\u00e7\u00e3o Para garantir um n\u00edvel adicional de seguran\u00e7a ao servidor, pode-se usar","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u043d\u0434\u0430\u0442\u043d\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432 \u0432 FreeBSD | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c","og:url":"https:\/\/prohoster.info\/pt\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:45+00:00","article:modified_time":"2019-10-31T18:43:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31890","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:18:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:09:26","updated":"2026-01-21 08:18:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/31890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=31890"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/31890\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=31890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=31890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=31890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}