{"id":31057,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","title":{"rendered":"Cum s\u0103 \u00ee\u021bi iei controlul asupra infrastructurii de re\u021bea. Capitolul trei. Securitatea re\u021belei. Partea a doua","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Acest articol este al patrulea dintr-o serie de articole intitulate \u201eCum s\u0103 preiei controlul asupra infrastructurii re\u021belei\u201d. Con\u021binutul tuturor articolelor din serie \u0219i linkurile pot fi g\u0103site <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">aici<\/a><\/noindex><\/i>.<\/p>\n<p>\u00cen <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">prima parte<\/a><\/noindex> \u00een acest capitol am examinat unele aspecte ale securit\u0103\u021bii re\u021belei din segmentul \u201eData Center\u201d. Aceast\u0103 parte va fi dedicat\u0103 segmentului \u201eInternet Access\u201d. <\/p>\n<p><img decoding=\"async\" alt=\"Cum s\u0103 \u00ee\u021bi iei controlul asupra infrastructurii de re\u021bea. Capitolul trei. Securitatea re\u021belei. Partea a doua\" src=\"\/wp-content\/uploads\/2019\/04\/10b33f9b02e3a7562d9e7cf023cbc197.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>Acces la internet<\/h1>\n<p>\nTema securit\u0103\u021bii este cu siguran\u021b\u0103 una dintre cele mai complexe teme din lumea re\u021belelor de date. Ca \u0219i \u00een cazurile anterioare, f\u0103r\u0103 a pretinde la ad\u00e2ncime \u0219i exhaustivitate, voi aborda aici \u00eentreb\u0103ri destul de simple, dar, \u00een opinia mea, importante, ale c\u0103ror r\u0103spunsuri, sper, vor ajuta la cre\u0219terea nivelului de protec\u021bie al re\u021belei dumneavoastr\u0103.<\/p>\n<p>Atunci c\u00e2nd audita\u021bi acest segment, fi\u021bi aten\u021bi la urm\u0103toarele aspecte:<\/p>\n<ul>\n<li>design<\/li>\n<li>configur\u0103rile BGP <\/li>\n<li>Protec\u021bia DOS\/DDOS<\/li>\n<li>filtrarea traficului pe firewall<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Design<\/h3>\n<p>\nCa exemplu de design pentru acest segment al re\u021belei de \u00eentreprindere, a\u0219 recomanda <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-pin-secure-internet-edge.pdf\">ghid<\/a><\/noindex> de la Cisco \u00een cadrul <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">modelului SAFE<\/a><\/noindex>.<\/p>\n<p>Desigur, este posibil ca solu\u021biile altor furnizori s\u0103 vi se par\u0103 mai atractive (vezi <noindex><a rel=\"nofollow\" href=\"https:\/\/researchcenter.paloaltonetworks.com\/2018\/10\/palo-alto-networks-seven-time-gartner-magic-quadrant-leader\/\">quadrantul Gartner din 2018<\/a><\/noindex>), dar, f\u0103r\u0103 a v\u0103 \u00eendemna s\u0103 urma\u021bi acest design \u00een detaliu, consider \u00een continuare util s\u0103 \u00een\u021belege\u021bi principiile \u0219i ideile care stau la baza acestuia.<\/p>\n<blockquote><p><b>Observa\u021bie<\/b><\/p>\n<p>\u00cen modelul SAFE, segmentul \u201eRemote Access\u201d face parte din \u201eInternet Access\u201d. Dar \u00een aceast\u0103 serie de articole vom examina acest subiect separat.<\/p><\/blockquote>\n<p>Setul standard de echipamente din acest segment pentru re\u021beaua de \u00eentreprindere (enterprise network) cuprinde <\/p>\n<ul>\n<li>routere de frontier\u0103 (border routers)<\/li>\n<li>firewall-uri<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Observa\u021bie 1<\/b><\/p>\n<p>\u00cen aceast\u0103 serie de articole, atunci c\u00e2nd vorbesc despre firewall-uri, m\u0103 refer la <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Next-generation_firewall\">NGFW<\/a><\/noindex>.<\/p><\/blockquote>\n<blockquote><p><b>Observa\u021bie 2<\/b><\/p>\n<p>Renun\u021b s\u0103 discut diverse tipuri de solu\u021bii L2\/L1 sau solu\u021bii overlay L2 peste L3 necesare pentru a asigura conectivitatea L1\/L2 \u0219i m\u0103 limitez doar la problemele de nivel L3 \u0219i peste. Par\u021bial, problemele L1\/L2 au fost abordate \u00een capitolul &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">Cur\u0103\u021barea \u0219i documentarea<\/a><\/noindex>&#171;.<\/p><\/blockquote>\n<p> Dac\u0103 nu a\u021bi descoperit un firewall \u00een acest segment, nu v\u0103 gr\u0103bi\u021bi s\u0103 trage\u021bi concluzii.<\/p>\n<p>S\u0103 \u00eencepem, ca \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">partea anterioar\u0103<\/a><\/noindex>, cu \u00eentrebarea, este necesar\u0103 utilizarea unui firewall \u00een acest segment \u00een cazul dumneavoastr\u0103?<\/p>\n<p>Pot spune c\u0103, aparent, acesta este cel mai justificat loc pentru utilizarea firewall-urilor \u0219i aplicarea unor algoritmi complexi de filtrare a traficului. \u00cen <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">partea 1<\/a><\/noindex> am men\u021bionat 4 factori care pot \u00eempiedica utilizarea firewall-urilor \u00een segmentul datacenter. Dar aici ace\u0219tia nu sunt at\u00e2t de semnificativi.<\/p>\n<blockquote><p>Exemplul 1. <b>\u00cent\u00e2rziere<\/b><\/p>\n<p>C\u00e2nd vine vorba de internet, nu are sens s\u0103 discut\u0103m despre \u00eent\u00e2rzieri de chiar 1 milisecund\u0103. Prin urmare, \u00eent\u00e2rzierile \u00een acest segment nu pot fi un factor care s\u0103 limiteze utilizarea firewall-ului.<\/p><\/blockquote>\n<blockquote><p>Exemplul 2. <b>Performan\u021b\u0103<\/b><\/p>\n<p>\u00cen unele cazuri, acest factor poate fi totu\u0219i semnificativ. Prin urmare, este posibil ca o parte din trafic (de exemplu, traficul echilibrarelor de sarcin\u0103) s\u0103 trebuiasc\u0103 s\u0103 ocoli\u021bi firewall-ul.<\/p><\/blockquote>\n<blockquote><p>Exemplul 3. <b>Fiabilitate<\/b><\/p>\n<p>Acest factor trebuie \u00een continuare luat \u00een considerare, dar av\u00e2nd \u00een vedere nestabilitatea internetului, importan\u021ba sa pentru acest segment nu este la fel de semnificativ\u0103 ca \u00een cazul centrului de date. <\/p>\n<p>S\u0103 presupunem c\u0103 serviciul dvs. func\u021bioneaz\u0103 pe http\/https (cu sesiuni scurte). \u00cen acest caz, pute\u021bi folosi dou\u0103 boxe independente (f\u0103r\u0103 HA) \u0219i, \u00een caz de problem\u0103 cu una dintre ele din cauza rut\u0103rii, s\u0103 redirec\u021biona\u021bi tot traficul c\u0103tre cealalt\u0103. <\/p>\n<p>Sau pute\u021bi utiliza firewall-uri \u00een mod transparent \u0219i, \u00een cazul defect\u0103rii lor, s\u0103 redirec\u021biona\u021bi temporar traficul pe ocolirea firewall-urilor.<\/p><\/blockquote>\n<p> A\u0219adar, este mai degrab\u0103 acesta <b>pre\u021bul<\/b> poate fi acel factor care v\u0103 va face s\u0103 renun\u021ba\u021bi la utilizarea firewall-urilor \u00een acest segment.<\/p>\n<blockquote><p><b>Important!<\/b><\/p>\n<p>Exist\u0103 tenta\u021bia de a combina acest firewall cu firewall-ul centrului de date (s\u0103 folosi\u021bi un singur firewall pentru aceste segmente). O solu\u021bie, \u00een principiu, posibil\u0103, dar trebuie s\u0103 \u00een\u021belege\u021bi c\u0103, deoarece firewall-ul \u201eAcces la Internet\u201d se afl\u0103 \u00een prima linie a ap\u0103r\u0103rii dumneavoastr\u0103 \u0219i \u201eprinde\u201d, cel pu\u021bin, o parte din traficul d\u0103un\u0103tor, trebuie s\u0103 \u021bine\u021bi cont de riscul crescut ca acest firewall s\u0103 fie dezactivat. Adic\u0103, folosind acelea\u0219i dispozitive \u00een ambele segmente, ve\u021bi reduce semnificativ disponibilitatea segmentului centrului de date.<\/p><\/blockquote>\n<p> Ca de obicei, trebuie s\u0103 \u00een\u021belege\u021bi c\u0103, \u00een func\u021bie de serviciul pe care compania \u00eel ofer\u0103, designul acestui segment poate varia foarte mult. Pute\u021bi alege, ca de obicei, diferite abord\u0103ri \u00een func\u021bie de cerin\u021be. <\/p>\n<blockquote><p><b>Exemplu<\/b><\/p>\n<p>Dac\u0103 sunte\u021bi un furnizor de con\u021binut, cu o re\u021bea CDN (vezi, de exemplu, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/ramax\/posts\/\">o serie de articole<\/a><\/noindex>), atunci s-ar putea s\u0103 nu dori\u021bi s\u0103 crea\u021bi o infrastructur\u0103 \u00een zeci sau chiar sute de puncte de prezen\u021b\u0103 cu utilizarea de dispozitive separate pentru rutare \u0219i filtrare a traficului. Acest lucru ar fi costisitor \u0219i poate fi pur \u0219i simplu excesiv. <\/p>\n<p>Pentru BGP nu este deloc necesar s\u0103 ave\u021bi routere dedicate, pute\u021bi folosi instrumente open-source, cum ar fi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quagga.net\">Quagga<\/a><\/noindex>. A\u0219adar, poate tot ce ave\u021bi nevoie sunt un server sau c\u00e2teva servere, un switch \u0219i BGP.<\/p>\n<p>\u00cen acest caz, serverul sau serverele dumneavoastr\u0103 pot juca rolul nu doar de server CDN, ci \u0219i de router. Cu siguran\u021b\u0103 exist\u0103 multe detalii (de exemplu, cum s\u0103 asigura\u021bi balance-ul), dar este realizabil, iar aceast\u0103 abordare a fost aplicat\u0103 cu succes pentru unul dintre partenerii no\u0219tri.<\/p>\n<p>Pute\u021bi avea mai multe centre de date cu protec\u021bie complet\u0103 (firewall-uri, servicii de protec\u021bie \u00eempotriva DDoS furnizate de furnizorii de internet) \u0219i zeci sau sute de puncte simplificate de prezen\u021b\u0103 doar cu switch-uri L2 \u0219i servere.<\/p>\n<p>\u0218i ce se \u00eent\u00e2mpl\u0103 cu protec\u021bia \u00een acest caz?<\/p>\n<p>S\u0103 lu\u0103m, de exemplu, atacul de tip <noindex>DNS Amplification DDoS<\/noindex>. Pericolul acestuia const\u0103 \u00een faptul c\u0103 se genereaz\u0103 o cantitate mare de trafic, care pur \u0219i simplu \"blocheaz\u0103\" 100% din toate uplink-urile dumneavoastr\u0103. <\/p>\n<p>Ce avem \u00een cazul designului nostru.<\/p>\n<ul>\n<li>dac\u0103 folosi\u021bi AnyCast, atunci traficul este distribuit \u00eentre punctele de prezen\u021b\u0103. Dac\u0103 l\u0103\u021bimea de band\u0103 total\u0103 este de terabi\u021bi, atunci acest lucru \u00een sine (cu toate c\u0103 au existat recent c\u00e2teva atacuri cu trafic mali\u021bios de ordinea terabitului) v\u0103 protejeaz\u0103 de \"supra\u00eenc\u0103rcarea\" uplink-urilor.<\/li>\n<li>dac\u0103 totu\u0219i unele uplink-uri s-au \"blocat\", pur \u0219i simplu scoate\u021bi acest loc din func\u021biune (opri\u021bi anun\u021barea prefixului).<\/li>\n<li>de asemenea, pute\u021bi cre\u0219te propor\u021bia de trafic livrat din centrele dumneavoastr\u0103 de date \"complete\" (\u0219i, prin urmare, protejate), astfel \u00eendep\u0103rt\u00e2nd o parte semnificativ\u0103 din traficul mali\u021bios de la punctele de prezen\u021b\u0103 neprotejate.<\/li>\n<\/ul>\n<p>\n\u0218i un mic comentariu pentru acest exemplu. Dac\u0103 o cantitate suficient\u0103 de trafic o livra\u021bi prin IX-uri, atunci acest lucru reduce, de asemenea, predispozi\u021bia dumneavoastr\u0103 la astfel de atacuri.<\/p><\/blockquote>\n<h3>Configurarea BGP<\/h3>\n<p>\nAici sunt dou\u0103 subiecte.<\/p>\n<ul>\n<li>Conectivitate<\/li>\n<li>Configurarea BGP<\/li>\n<\/ul>\n<p>\nDespre conectivitate am mai discutat pu\u021bin \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">partea 1<\/a><\/noindex>. Esen\u021ba este ca traficul c\u0103tre clien\u021bii dumneavoastr\u0103 s\u0103 circule pe calea optim\u0103. De\u0219i optimizarea nu se refer\u0103 \u00eentotdeauna doar la laten\u021b\u0103, de obicei, laten\u021ba sc\u0103zut\u0103 este principala m\u0103sur\u0103 a optimiz\u0103rii. Pentru unele companii, acest aspect este mai important, pentru altele - mai pu\u021bin. Totul depinde de serviciul pe care \u00eel oferi\u021bi.<\/p>\n<blockquote><p><b>Exemplu 1<\/b><\/p>\n<p>Dac\u0103 sunte\u021bi o burs\u0103 \u0219i pentru clien\u021bii dvs. sunt importante intervalele de timp mai mici de o milisecund\u0103, atunci este clar c\u0103 nu poate fi vorba despre internet \u00een general.<\/p><\/blockquote>\n<blockquote><p><b>Exemplu 2<\/b><\/p>\n<p>Dac\u0103 sunte\u021bi o companie de jocuri \u0219i pentru dvs. sunt importante zeci de milisecunde, atunci, desigur, conectivitatea este foarte important\u0103 pentru dvs.<\/p><\/blockquote>\n<blockquote><p><b>Exemplul 3<\/b><\/p>\n<p>De asemenea, trebuie s\u0103 \u00een\u021belegem c\u0103, din cauza propriet\u0103\u021bilor protocolului TCP, viteza de transfer a datelor \u00eentr-o singur\u0103 sesiune TCP depinde \u0219i de RTT (Round Trip Time). Re\u021belele CDN sunt construite, printre altele, pentru a rezolva aceast\u0103 problem\u0103, apropiind serverele de livrare a con\u021binutului de consumatorul acestuia.<\/p><\/blockquote>\n<p> Cercetarea conectivit\u0103\u021bii este un subiect interesant, demn de o articolee separat\u0103 sau de o serie de articole \u0219i necesit\u0103 o bun\u0103 \u00een\u021belegere a modului \u00een care este \"construit\" internetul.<\/p>\n<p>Resurse utile:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/ripe.net\">ripe.net<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex><\/p>\n<blockquote><p><b>Exemplu<\/b><\/p>\n<p>Voi aduce doar un mic exemplu.<\/p>\n<p>S\u0103 presupunem c\u0103 data center-ul dvs. este situat \u00een Moscova \u0219i ave\u021bi o singur\u0103 leg\u0103tur\u0103 \u2013 Rostelecom (AS12389). \u00cen acest caz (single homed), BGP nu v\u0103 este necesar, iar ca adrese publice, cel mai probabil, folosi\u021bi un pool de adrese de la Rostelecom. <\/p>\n<p>S\u0103 presupunem c\u0103 oferi\u021bi un anumit serviciu \u0219i ave\u021bi un num\u0103r suficient de clien\u021bi din Ucraina, iar ace\u0219tia se pl\u00e2ng de \u00eent\u00e2rzieri mari. Dup\u0103 o cercetare, a\u021bi descoperit c\u0103 adresele IP ale unor clien\u021bi se afl\u0103 \u00een re\u021beaua 37.52.0.0\/21. <\/p>\n<p>Execut\u00e2nd un traceroute, a\u021bi observat c\u0103 traficul trece prin AS1299 (Telia), iar execut\u00e2nd un ping, a\u021bi ob\u021binut un RTT mediu de 70 \u2013 80 de milisecunde. Pute\u021bi vedea acest lucru \u0219i pe <noindex><a rel=\"nofollow\" href=\"http:\/\/lg.ip.rt.ru\">looking glass-ul Rostelecom-ului<\/a><\/noindex>.<\/p>\n<p>Folosind utilitarul whois (pe site-ul ripe.net sau pe un utilitar local), pute\u021bi determina cu u\u0219urin\u021b\u0103 c\u0103 blocul 37.52.0.0\/21 apar\u021bine AS6849 (Ukrtelecom).<\/p>\n<p>Mai departe, acces\u00e2nd <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex> ve\u021bi vedea c\u0103 AS6849 nu are rela\u021bii cu AS12389 (ace\u0219tia nu sunt nici clien\u021bi, nici leg\u0103turi \u00eentre ei, de asemenea, nu au nici pirat). Dar dac\u0103 v\u0103 uita\u021bi la <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\/AS6849#_peers\">lista de perechi<\/a><\/noindex> pentru AS6849, ve\u021bi vedea, de exemplu, AS29226 (Mastertel) \u0219i AS31133 (Megafon). <\/p>\n<p>G\u0103sind looking glass-ul acestor furnizori, pute\u021bi compara calea \u0219i RTT. De exemplu, pentru Mastertel RTT va fi deja de aproximativ 30 de milisecunde. <\/p>\n<p>A\u0219adar, dac\u0103 diferen\u021ba dintre 80 \u0219i 30 de milisecunde este semnificativ\u0103 pentru serviciul dvs., atunci, poate, ar trebui s\u0103 v\u0103 g\u00e2ndi\u021bi la conectivitate, s\u0103 ob\u021bine\u021bi un num\u0103r AS de la RIPE, un pool de adrese \u0219i s\u0103 conecta\u021bi leg\u0103turi suplimentare \u0219i\/sau s\u0103 crea\u021bi puncte de prezen\u021b\u0103 pe IX-uri.<\/p><\/blockquote>\n<p>\nPrin utilizarea BGP, nu numai c\u0103 ave\u021bi oportunitatea de a \u00eembun\u0103t\u0103\u021bi conectivitatea, dar v\u0103 rezerva\u021bi \u0219i conexiunea la internet.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ssi.gouv.fr\/uploads\/2016\/03\/bgp-configuration-best-practices.pdf\">Acest document<\/a><\/noindex> con\u021bine recomand\u0103ri pentru configurarea BGP. De\u0219i aceste recomand\u0103ri au fost elaborate pe baza \u00abcelor mai bune practici\u00bb ale furnizorilor, ele sunt cu siguran\u021b\u0103 utile \u0219i ar trebui s\u0103 fac\u0103 parte din hardening-ul pe care l-am discutat \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">prima parte<\/a><\/noindex>.<\/p>\n<h3>Protec\u021bia DOS\/DDOS<\/h3>\n<p>\n\u00cen prezent, atacurile DOS\/DDOS au devenit o realitate cotidian\u0103 pentru multe companii. De fapt, \u00eentr-o form\u0103 sau alta, sunte\u021bi ataca\u021bi destul de des. Faptul c\u0103 nu observa\u021bi acest lucru arat\u0103 doar c\u0103 nu a fost organizat \u00eenc\u0103 un atac direc\u021bionat \u00eempotriva dvs. \u0219i c\u0103 m\u0103surile de protec\u021bie pe care le folosi\u021bi, chiar \u0219i f\u0103r\u0103 s\u0103 v\u0103 da\u021bi seama de ele (diferitele protec\u021bii \u00eencorporate ale sistemelor de operare), sunt suficiente pentru a minimiza degradarea serviciului oferit pentru dvs. \u0219i clien\u021bii dvs.<\/p>\n<p>Exist\u0103 resurse online care, pe baza jurnalelor de la echipamente, deseneaz\u0103 \u00een timp real h\u0103r\u021bi frumoase ale atacurilor.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3217944\/security\/8-top-cyber-attack-maps-and-how-to-use-them.html\">Aici<\/a><\/noindex> pute\u021bi g\u0103si linkuri c\u0103tre acestea.<\/p>\n<p>Harta mea preferat\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/threatmap.checkpoint.com\/ThreatPortal\/livemap.html\">de la CheckPoint.<\/a><\/noindex> Protec\u021bia \u00eempotriva DDOS\/DOS este de obicei stratificat\u0103. Pentru a \u00een\u021belege de ce, trebuie s\u0103 \u00een\u021belege\u021bi ce tipuri de atacuri DOS\/DDOS exist\u0103 (vede\u021bi, de exemplu,<\/p>\n<p>Adic\u0103 avem trei tipuri de atacuri: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3222095\/network-security\/ddos-explained-how-denial-of-service-attacks-are-evolving.html\">aici <\/a><\/noindex> sau <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.thousandeyes.com\/three-types-ddos-attacks\/\">aici<\/a><\/noindex>)<\/p>\n<p>atacuri volumetrice<\/p>\n<ul>\n<li>atacuri de protocol<\/li>\n<li>atacuri de aplica\u021bie<\/li>\n<li>Dac\u0103 v\u0103 pute\u021bi proteja singuri \u00eempotriva ultimelor dou\u0103 tipuri de atacuri, folosind, de exemplu, firewall-uri, de atacurile care vizeaz\u0103 \u00absupra\u00eenc\u0103rcarea\u00bb uplink-urilor dvs. nu v\u0103 pute\u021bi proteja singuri (bine\u00een\u021beles, dac\u0103 capacitatea total\u0103 a canalelor dvs. de internet nu se m\u0103soar\u0103 \u00een terabi\u021bi, \u0219i mai bine, \u00een zeci de terabi\u021bi).<\/li>\n<\/ul>\n<p>\nPrin urmare, prima linie de ap\u0103rare este protec\u021bia \u00eempotriva atacurilor \u00abvolumetrice\u00bb \u0219i aceast\u0103 protec\u021bie ar trebui s\u0103 v\u0103 fie asigurat\u0103 de furnizorul sau furnizorii dvs. Dac\u0103 nu a\u021bi realizat \u00eenc\u0103 acest lucru, atunci pur \u0219i simplu ave\u021bi noroc.<\/p>\n<p>S\u0103 presupunem c\u0103 ave\u021bi mai multe uplink-uri, dar doar unul dintre furnizori poate s\u0103 v\u0103 ofere aceast\u0103 protec\u021bie. Dar dac\u0103 tot traficul va trece printr-un singur furnizor, atunci cum r\u0103m\u00e2ne cu conectivitatea, pe care am discutat-o pe scurt mai devreme?<\/p>\n<blockquote><p><b>Exemplu<\/b><\/p>\n<p>\u00cen timpul atacului, va trebui \u00een acest caz s\u0103 sacrifica\u021bi par\u021bial conectivitatea.<\/p>\n<p>Dar<\/p>\n<ul>\n<li>acest lucru este doar temporar \u00een cazul unui atac. Pute\u021bi, \u00een cazul unui atac, s\u0103 reconfigura\u021bi manual sau automat BGP, astfel \u00eenc\u00e2t traficul s\u0103 fie dirijat doar prin furnizorul care v\u0103 ofer\u0103 \u201eumbrela\u201d. Dup\u0103 \u00eencheierea atacului, pute\u021bi restabili rutarea \u00een starea anterioar\u0103.<\/li>\n<li>nu este obligatoriu s\u0103 traduce\u021bi tot traficul. De exemplu, dac\u0103 observa\u021bi c\u0103 prin anumite uplink-uri sau prin peer-ing nu exist\u0103 atacuri (sau traficul este nesemnificativ), pute\u021bi continua s\u0103 anun\u021ba\u021bi prefixelor cu atribute competitive c\u0103tre ace\u0219ti vecini BGP.<\/li>\n<\/ul>\n<\/blockquote>\n<p>\nProtec\u021bia \u00eempotriva \u201eatacurilor de protocol\u201d \u0219i \u201eatacurilor de aplica\u021bie\u201d o pute\u021bi \u00eencredin\u021ba partenerilor.<br \/>\nIat\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/geekflare.com\/ddos-protection-service\/\">aici<\/a><\/noindex> pute\u021bi citi o cercetare bun\u0103 (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/company\/hosting-cafe\/blog\/324848\/\">traducere<\/a><\/noindex>). De\u0219i este un articol de acum doi ani, v\u0103 va oferi o idee despre abord\u0103rile pe care le pute\u021bi adopta pentru a v\u0103 proteja \u00eempotriva atacurilor DDOS.<\/p>\n<p>\u00cen principiu, pute\u021bi s\u0103 v\u0103 limita\u021bi la aceasta, l\u0103s\u00e2ndu-v\u0103 complet protec\u021bia \u00een m\u00e2inile unui furnizor extern. Exist\u0103 avantaje \u00een aceast\u0103 solu\u021bie, dar \u0219i un dezavantaj evident. Este vorba, din nou, \u00een func\u021bie de ce se ocup\u0103 compania dumneavoastr\u0103, de supravie\u021buirea afacerii. \u0218i a \u00eencredin\u021ba astfel de lucruri unor organiza\u021bii externe\u2026<\/p>\n<p>Prin urmare, s\u0103 vedem cum putem organiza a doua \u0219i a treia linie de ap\u0103rare (ca supliment la protec\u021bia furnizorului).<\/p>\n<p>A\u0219adar, a doua linie de ap\u0103rare este filtrarea \u0219i limitatoarele de trafic (policers) la intrarea \u00een re\u021beaua dumneavoastr\u0103. <\/p>\n<blockquote><p><b>Exemplu 1<\/b><\/p>\n<p>S\u0103 presupunem c\u0103 v-a\u021bi \u201e\u00eenchis sub umbrel\u0103\u201d de DDOS cu ajutorul unuia dintre furnizori. S\u0103 presupunem c\u0103 acest furnizor folose\u0219te Arbor pentru filtrarea traficului \u0219i filtre la limita re\u021belei sale. <\/p>\n<p>L\u0103\u021bimea de band\u0103 pe care Arbor o poate \u201eprocesa\u201d este limitat\u0103, iar furnizorul, desigur, nu poate permite constant traficul tuturor partenerilor s\u0103i care au comandat acest serviciu prin echipamentul de filtrare. Prin urmare, \u00een condi\u021bii normale, traficul nu este filtrat.<\/p>\n<p>S\u0103 presupunem c\u0103 se desf\u0103\u0219oar\u0103 un atac SYN flood. Chiar dac\u0103 a\u021bi comandat un serviciu prin care, \u00een cazul unui atac, traficul este redirec\u021bionat automat pentru filtrare, acest lucru nu se \u00eent\u00e2mpl\u0103 imediat. Pe parcursul unui minut sau mai mult, r\u0103m\u00e2ne\u021bi sub atac. \u0218i acest lucru poate duce la defectarea echipamentului dvs. sau la degradarea serviciului. \u00cen acest caz, limitarea traficului la nivelul rut\u0103rii de frontier\u0103, de\u0219i va face ca unele sesiuni TCP s\u0103 nu se stabileasc\u0103 \u00een acest timp, va salva infrastructura dumneavoastr\u0103 de probleme \u0219i mai mari.<\/p><\/blockquote>\n<blockquote><p><b>Exemplu 2<\/b><\/p>\n<p>Un num\u0103r anormal de mare de pachete SYN poate fi nu doar rezultatul unui atac SYN flood. S\u0103 presupunem c\u0103 oferi\u021bi un serviciu \u00een care pute\u021bi avea simultan aproximativ 100.000 de conexiuni TCP (\u00eentr-un singur data center).<\/p>\n<p>S\u0103 presupunem c\u0103, ca urmare a unei probleme scurte cu unul dintre principalii dvs. furnizori, a fost \u00eentrerupt\u0103 jum\u0103tate din sesiuni. Dac\u0103 aplica\u021bia dvs. este proiectat\u0103 astfel \u00eenc\u00e2t s\u0103 \u00eencerce imediat (sau dup\u0103 un interval de timp uniform pentru toate sesiunile) s\u0103 restabileasc\u0103 conexiunea, atunci ve\u021bi primi simultan cel pu\u021bin 50.000 de pachete SYN. <\/p>\n<p>Dac\u0103, deasupra acestor sesiuni, de exemplu, ar trebui s\u0103 func\u021bioneze un ssl\/tls handshake, care presupune schimbul de certificate, din punctul de vedere al epuiz\u0103rii resurselor pentru echilibratorul dvs. de sarcin\u0103, acest lucru va fi un 'DDoS' mult mai puternic dec\u00e2t un simplu SYN flood. S-ar p\u0103rea c\u0103 echilibratoarele ar trebui s\u0103 gestioneze astfel de evenimente, dar\u2026 din p\u0103cate, ne-am confruntat cu aceast\u0103 problem\u0103 \u00een mod direct.<\/p>\n<p>\u0218i, desigur, un policer pe routerul de frontier\u0103 v\u0103 va salva echipamentul \u0219i \u00een acest caz.<\/p><\/blockquote>\n<p>Nivelul trei de protec\u021bie \u00eempotriva DDoS\/DOS este set\u0103rile unei firewall.<\/p>\n<p>Aici pute\u021bi limita atacurile de tipul doi \u0219i trei. \u00cen general, tot ceea ce ajunge la firewall poate fi filtrat aici. <\/p>\n<blockquote><p><b>Sfaturi<\/b><\/p>\n<p>\u00cencerca\u021bi s\u0103 oferi\u021bi firewall-ului c\u00e2t mai pu\u021bin\u0103 munc\u0103, filtr\u00e2nd c\u00e2t mai mult \u00een primele dou\u0103 linii de ap\u0103rare. \u0218i iat\u0103 de ce.<\/p>\n<p>A\u021bi avut vreodat\u0103 situa\u021bia \u00een care, \u00een timp ce genera\u021bi trafic pentru a verifica, de exemplu, c\u00e2t de rezistent\u0103 este sistemul de operare al serverelor dvs. la atacuri DDOS, a\u021bi \"ucis\" firewall-ul \u00eenc\u0103rc\u00e2ndu-l la 100%, folosind un trafic de intensitate normal\u0103? Dac\u0103 nu, poate c\u0103 este doar pentru c\u0103 nu a\u021bi \u00eencercat?<\/p>\n<p>\u00cen general, firewall-ul, a\u0219a cum am men\u021bionat, este ceva complex \u0219i func\u021bioneaz\u0103 bine cu vulnerabilit\u0103\u021bile cunoscute \u0219i solu\u021biile testate, dar dac\u0103 trimite\u021bi ceva neobi\u0219nuit, un fel de gunoi sau pachete cu antete incorecte, ave\u021bi o probabilitate semnificativ\u0103 (av\u00e2nd \u00een vedere experien\u021ba mea) de a bloca chiar \u0219i echipamente de top. De aceea, \u00een etapa 2, folosi\u021bi doar traficul care trebuie s\u0103 intre \u00een re\u021beaua dvs. prin intermediul ACL-urilor obi\u0219nuite (la nivel L3\/L4).<\/p><\/blockquote>\n<h3>Filtrarea traficului pe firewall<\/h3>\n<p>\nContinu\u0103m discu\u021bia despre firewall. Trebuie s\u0103 \u00een\u021belegem c\u0103 atacurile DOS\/DDOS sunt doar una dintre formele de atacuri cibernetice. <\/p>\n<p>Pe l\u00e2ng\u0103 protec\u021bia \u00eempotriva atacurilor DOS\/DDOS, putem avea un fel de list\u0103 de capabilit\u0103\u021bi asemenea celei de mai jos:<\/p>\n<ul>\n<li>firewalling de aplica\u021bii<\/li>\n<li>prevenirea amenin\u021b\u0103rilor (antivirus, anti-spyware \u0219i vulnerabilitate)<\/li>\n<li>filtrarea URL-urilor<\/li>\n<li>filtrarea datelor (filtrarea con\u021binutului)<\/li>\n<li>blocarea fi\u0219ierelor (blocarea tipurilor de fi\u0219iere)<\/li>\n<\/ul>\n<p>\nDecizia v\u0103 apar\u021bine ce alege\u021bi din aceast\u0103 list\u0103.<\/p>\n<p><i>Continuarea urmeaz\u0103<\/i><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436230\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23032,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Cum s\u0103 prelua\u021bi controlul asupra infrastructurii de re\u021bea. Capitolul trei. Securitatea re\u021belei. Partea a doua | ProHoster","description":"Acest articol este al patrulea dintr-o serie de articole \"Cum s\u0103 prelua\u021bi controlul asupra infrastructurii de re\u021bea.\"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/23032"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}