{"id":31890,"date":"2019-10-31T21:43:45","date_gmt":"2019-10-31T18:43:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mandatnaya-model-raspredeleniya-prav-v-freebsd\/"},"modified":"2019-10-31T21:43:45","modified_gmt":"2019-10-31T18:43:45","slug":"mandatnaya-model-raspredeleniya-prav-v-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","title":{"rendered":"Modelul de distribu\u021bie a drepturilor \u00een FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Introducere<\/h2>\n

Pentru a asigura un nivel suplimentar de securitate a serverului, se poate utiliza modelul de mandat<\/a><\/noindex> pentru distribu\u021bia accesului. \u00cen aceast\u0103 publica\u021bie va fi descris cum se poate rula Apache \u00een jail cu acces doar la componentele necesare pentru func\u021bionarea corect\u0103 a Apache \u0219i PHP. Dup\u0103 acest principiu, se pot restric\u021biona nu doar Apache, ci \u0219i orice alt stack.
\n<\/a><\/noindex><\/p>\n

Preg\u0103tire<\/h2>\n

Aceast\u0103 metod\u0103 este potrivit\u0103 doar pentru sistemul de fi\u0219iere UFS; \u00een acest exemplu, \u00een sistemul principal va fi folosit ZFS, iar \u00een jail, respectiv, UFS. \u00cen primul r\u00e2nd, este necesar s\u0103 recompila\u021bi nucleul; la instalarea FreeBSD, instala\u021bi codul surs\u0103.
\nDup\u0103 ce sistemul va fi instalat, edita\u021bi fi\u0219ierul:<\/p>\n

\/usr\/src\/sys\/amd64\/conf\/GENERIC\n<\/code><\/pre>\n
\u00cen acest fi\u0219ier trebuie s\u0103 ad\u0103uga\u021bi o singur\u0103 linie:<\/p>\n
options     MAC_MLS\n<\/code><\/pre>\n
Eticheta mls\/high va avea o pozi\u021bie dominant\u0103 asupra etichetei mls\/low; aplica\u021biile care sunt lansate cu eticheta mls\/low nu vor putea accesa fi\u0219ierele care au eticheta mls\/high. Mai multe detalii despre toate etichetele disponibile \u00een sistemul FreeBSD pot fi citite \u00een aceast\u0103 ghid)<\/a><\/noindex>.
\nApoi, accesa\u021bi directorul \/usr\/src:<\/p>\n
cd \/usr\/src\n<\/code><\/pre>\n
Pentru a lanseaz\u0103 compilarea nucleului, executa\u021bi (\u00een parametru j, specifica\u021bi num\u0103rul de nuclee din sistem):<\/p>\n
make -j 4 buildkernel KERNCONF=GENERIC\n<\/code><\/pre>\n
Dup\u0103 ce nucleul a fost compilat, acesta trebuie instalat:<\/p>\n
make installkernel KERNCONF=GENERIC\n<\/code><\/pre>\n
Dup\u0103 instalarea nucleului, nu v\u0103 gr\u0103bi\u021bi s\u0103 reporni\u021bi sistemul, deoarece trebuie s\u0103 muta\u021bi utilizatorii \u00een clasa de logare, configur\u00e2nd-o mai \u00eent\u00e2i. Editeaz\u0103 fi\u0219ierul \/etc\/login.conf; \u00een acest fi\u0219ier trebuie s\u0103 edita\u021bi clasa de logare default, aduc\u00e2nd-o la urm\u0103toarea form\u0103:<\/p>\n
default:\n        :passwd_format=sha512:\n        :copyright=\/etc\/COPYRIGHT:\n        :welcome=\/etc\/motd:\n        :setenv=MAIL=\/var\/mail\/$,BLOCKSIZE=K:\n        :path=\/sbin \/bin \/usr\/sbin \/usr\/bin \/usr\/local\/sbin \/usr\/local\/bin ~\/bin:\n        :nologin=\/var\/run\/nologin:\n        :cputime=unlimited:\n        :datasize=unlimited:\n        :stacksize=unlimited:\n        :memorylocked=64K:\n        :memoryuse=unlimited:\n        :filesize=unlimited:\n        :coredumpsize=unlimited:\n        :openfiles=unlimited:\n        :maxproc=unlimited:\n        :sbsize=unlimited:\n        :vmemoryuse=unlimited:\n        :swapuse=unlimited:\n        :pseudoterminals=unlimited:\n        :kqueues=unlimited:\n        :umtxp=unlimited:\n        :priority=0:\n        :ignoretime@:\n        :umask=022:\n        :label=mls\/equal:\n<\/code><\/pre>\n
Linia :label=mls\/equal va permite utilizatorilor care fac parte din aceast\u0103 clas\u0103 s\u0103 acceseze fi\u0219ierele marcate cu orice etichet\u0103 (mls\/low, mls\/high). Dup\u0103 aceste manevre, trebuie s\u0103 recompila\u021bi baza de date \u0219i s\u0103 plasa\u021bi utilizatorul root (precum \u0219i pe cei care au nevoie) \u00een aceast\u0103 clas\u0103 de logare:<\/p>\n
cap_mkdb \/etc\/login.conf\npw usermod root -L default\n<\/code><\/pre>\n
Pentru ca politica s\u0103 se aplice doar fi\u0219ierelor, este necesar s\u0103 edita\u021bi fi\u0219ierul \/etc\/mac.conf, p\u0103str\u00e2nd \u00een el doar o singur\u0103 linie:<\/p>\n
default_labels file ?mls\n<\/code><\/pre>\n
De asemenea, este necesar s\u0103 ad\u0103uga\u021bi modulul mac_mls.ko la pornirea automat\u0103:<\/p>\n
echo 'mac_mls_load=\"YES\"' >> \/boot\/loader.conf\n<\/code><\/pre>\n
Dup\u0103 aceasta, pute\u021bi reporni sistemul f\u0103r\u0103 grij\u0103. Cum s\u0103 crea\u021bi jail<\/a><\/noindex> pute\u021bi citi \u00een una dintre publica\u021biile mele. \u00cens\u0103, \u00eenainte de a crea jail, trebuie s\u0103 ad\u0103uga\u021bi un disc dur \u0219i s\u0103 crea\u021bi pe acesta un sistem de fi\u0219iere, activ\u00e2nd multilabel; crea\u021bi un sistem de fi\u0219iere ufs2 cu dimensiunea clusterului de 64kb:<\/p>\n
newfs -O 2 -b 64kb \/dev\/ada1\ntunefs -l enable \/dev\/ada1\n<\/code><\/pre>\n
Dup\u0103 ce a\u021bi creat sistemul de fi\u0219iere \u0219i a\u021bi ad\u0103ugat multilabel, este necesar s\u0103 ad\u0103uga\u021bi discul dur \u00een \/etc\/fstab, ad\u0103uga\u021bi urm\u0103toarea linie \u00een acest fi\u0219ier:<\/p>\n
\/dev\/ada1               \/jail  ufs     rw              0       1\n<\/code><\/pre>\n
\u00cen Mountpoint indica\u021bi directorul \u00een care ve\u021bi monta discul dur, iar la Pass indica\u021bi obligatoriu 1 (\u00een ce ordine va fi verificat acest disc dur) \u2014 aceasta este necesar\u0103, deoarece sistemul de fi\u0219iere ufs este sensibil la \u00eentreruperile bruste de curent. Dup\u0103 aceste ac\u021biuni, monta\u021bi discul:<\/p>\n
mount \/dev\/ada1 \/jail\n<\/code><\/pre>\n
\u00cen acest director instala\u021bi jail. Dup\u0103 ce jail-ul va func\u021biona, trebuie efectuate acelea\u0219i manipul\u0103ri cu utilizatorii \u0219i fi\u0219ierele \/etc\/login.conf, \/etc\/mac.conf ca \u00een sistemul principal. <\/p>\n
Configurare<\/h2>\n
\u00cenainte de a stabili etichetele necesare, recomand s\u0103 instala\u021bi toate pachetele necesare; \u00een cazul meu, etichetele vor fi aplicate \u021bin\u00e2nd cont de aceste pachete:<\/p>\n
mod_php73-7.3.4_1              Limbaj de scripting PHP\nphp73-7.3.4_1                  Limbaj de scripting PHP\nphp73-ctype-7.3.4_1            Extensia ctype partajat\u0103 pentru php\nphp73-curl-7.3.4_1             Extensia curl partajat\u0103 pentru php\nphp73-dom-7.3.4_1              Extensia dom partajat\u0103 pentru php\nphp73-extensions-1.0           \"meta-port\" pentru instalarea extensiilor PHP\nphp73-filter-7.3.4_1           Extensia filter partajat\u0103 pentru php\nphp73-gd-7.3.4_1               Extensia gd partajat\u0103 pentru php\nphp73-gettext-7.3.4_1          Extensia gettext partajat\u0103 pentru php\nphp73-hash-7.3.4_1             Extensia hash partajat\u0103 pentru php\nphp73-iconv-7.3.4_1            Extensia iconv partajat\u0103 pentru php\nphp73-json-7.3.4_1             Extensia json partajat\u0103 pentru php\nphp73-mysqli-7.3.4_1           Extensia mysqli partajat\u0103 pentru php\nphp73-opcache-7.3.4_1          Extensia opcache partajat\u0103 pentru php\nphp73-openssl-7.3.4_1          Extensia openssl partajat\u0103 pentru php\nphp73-pdo-7.3.4_1              Extensia pdo partajat\u0103 pentru php\nphp73-pdo_sqlite-7.3.4_1       Extensia pdo_sqlite partajat\u0103 pentru php\nphp73-phar-7.3.4_1             Extensia phar partajat\u0103 pentru php\nphp73-posix-7.3.4_1            Extensia posix partajat\u0103 pentru php\nphp73-session-7.3.4_1          Extensia session partajat\u0103 pentru php\nphp73-simplexml-7.3.4_1        Extensia simplexml partajat\u0103 pentru php\nphp73-sqlite3-7.3.4_1          Extensia sqlite3 partajat\u0103 pentru php\nphp73-tokenizer-7.3.4_1        Extensia tokenizer partajat\u0103 pentru php\nphp73-xml-7.3.4_1              Extensia xml partajat\u0103 pentru php\nphp73-xmlreader-7.3.4_1        Extensia xmlreader partajat\u0103 pentru php\nphp73-xmlrpc-7.3.4_1           Extensia xmlrpc partajat\u0103 pentru php\nphp73-xmlwriter-7.3.4_1        Extensia xmlwriter partajat\u0103 pentru php\nphp73-xsl-7.3.4_1              Extensia xsl partajat\u0103 pentru php\nphp73-zip-7.3.4_1              Extensia zip partajat\u0103 pentru php\nphp73-zlib-7.3.4_1             Extensia zlib partajat\u0103 pentru php\napache24-2.4.39 \n<\/code><\/pre>\n
\u00cen acest exemplu, etichetele vor fi atribuite av\u00e2nd \u00een vedere dependen\u021bele acestor pachete. Desigur, ar fi mai simplu s\u0103 stabilim etichetele mls\/low pentru directorul \/usr\/local\/lib \u0219i fi\u0219ierele aflate \u00een acest director, iar pachetele instalate ulterior (de exemplu, extensiile suplimentare pentru php) vor putea accesa bibliotecile din acest director, dar cred c\u0103 este mai bine s\u0103 oferim acces doar fi\u0219ierelor necesare. Opri\u021bi jail-ul \u0219i atribui\u021bi etichete mls\/high tuturor fi\u0219ierelor:<\/p>\n
setfmac -R mls\/high \/jail\n<\/code><\/pre>\n
Atunci c\u00e2nd se stabilesc etichetele, procesul va fi oprit dac\u0103 setfmac \u00eent\u00e2lne\u0219te linkuri hard; \u00een exemplul meu, am eliminat linkurile hard din urm\u0103toarele directoare:<\/p>\n
\/var\/db\/etcupdate\/current\/\n\/var\/db\/etcupdate\/current\/etc\n\/var\/db\/etcupdate\/current\/usr\/share\/openssl\/man\/en.ISO8859-15\n\/var\/db\/etcupdate\/current\/usr\/share\/man\/en.ISO8859-15\n\/var\/db\/etcupdate\/current\/usr\/share\/man\/en.UTF-8\n\/var\/db\/etcupdate\/current\/usr\/share\/nls\n\/etc\/ssl\n\/usr\/local\/etc\n\/usr\/local\/etc\/fonts\/conf.d\n\/usr\/local\/openssl\n<\/code><\/pre>\n
Dup\u0103 ce etichetele au fost stabilite, trebuie s\u0103 atribuim etichete mls\/low pentru apache; mai \u00eent\u00e2i, trebuie s\u0103 stabilim care fi\u0219iere sunt necesare pentru func\u021bionarea apache:<\/p>\n
ldd \/usr\/local\/sbin\/httpd\n<\/code><\/pre>\n
Dup\u0103 executarea acestei comenzi, dependen\u021bele vor ap\u0103rea pe ecran, dar nu va fi suficient s\u0103 se atribuie etichetele necesare fi\u0219ierelor, deoarece directoarele \u00een care se afl\u0103 aceste fi\u0219iere au eticheta mls\/high. Prin urmare, este necesar s\u0103 se atribuie \u0219i eticheta mls\/low acestor directoare. La pornirea Apache-ului, vor fi afi\u0219ate fi\u0219ierele necesare pentru a-l rula, iar pentru PHP, aceste dependen\u021be pot fi g\u0103site \u00een logul httpd-error.log.<\/p>\n
setfmac mls\/low \/\nsetfmac mls\/low \/usr\/local\/lib\/libpcre.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libaprutil-1.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libdb-5.3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libgdbm.so.6\nsetfmac mls\/low \/usr\/local\/lib\/libexpat.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libapr-1.so.0\nsetfmac mls\/low \/lib\/libcrypt.so.5\nsetfmac mls\/low \/lib\/libthr.so.3\nsetfmac mls\/low \/lib\/libc.so.7\nsetfmac mls\/low \/usr\/local\/lib\/libintl.so.8\nsetfmac mls\/low \/var\nsetfmac mls\/low \/var\/run\nsetfmac mls\/low \/var\/log\nsetfmac mls\/low \/var\/log\/httpd-access.log\nsetfmac mls\/low \/var\/log\/httpd-error.log\nsetfmac mls\/low \/var\/run\/httpd.pid\nsetfmac mls\/low \/lib\nsetfmac mls\/low \/lib\/libcrypt.so.5\nsetfmac mls\/low \/usr\/local\/lib\/db5\/libdb-5.3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/db5\/libdb-5.3.so.0.0.0\nsetfmac mls\/low \/usr\/local\/lib\/db5\nsetfmac mls\/low \/usr\/local\/lib\nsetfmac mls\/low \/libexec\nsetfmac mls\/low \/libexec\/ld-elf.so.1\nsetfmac mls\/low \/dev\nsetfmac mls\/low \/dev\/random\nsetfmac mls\/low \/usr\/local\/libexec\nsetfmac mls\/low \/usr\/local\/libexec\/apache24\nsetfmac mls\/low \/usr\/local\/libexec\/apache24\/*\nsetfmac mls\/low \/etc\/pwd.db\nsetfmac mls\/low \/etc\/passwd\nsetfmac mls\/low \/etc\/group\nsetfmac mls\/low \/etc\/\nsetfmac mls\/low \/usr\/local\/etc\nsetfmac -R mls\/low \/usr\/local\/etc\/apache24\nsetfmac mls\/low \/usr\nsetfmac mls\/low \/usr\/local\nsetfmac mls\/low \/usr\/local\/sbin\nsetfmac mls\/low \/usr\/local\/sbin\/*\nsetfmac -R mls\/low \/usr\/local\/etc\/rc.d\/\nsetfmac mls\/low \/usr\/local\/sbin\/htcacheclean\nsetfmac mls\/low \/var\/log\/httpd-access.log\nsetfmac mls\/low \/var\/log\/httpd-error.log\nsetfmac -R mls\/low \/usr\/local\/www\nsetfmac mls\/low \/usr\/lib\nsetfmac mls\/low \/tmp\nsetfmac -R mls\/low \/usr\/local\/lib\/php\nsetfmac -R mls\/low \/usr\/local\/etc\/php\nsetfmac mls\/low \/usr\/local\/etc\/php.conf\nsetfmac mls\/low \/lib\/libelf.so.2\nsetfmac mls\/low \/lib\/libm.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libxml2.so.2\nsetfmac mls\/low \/lib\/libz.so.6\nsetfmac mls\/low \/usr\/lib\/liblzma.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libiconv.so.2\nsetfmac mls\/low \/usr\/lib\/librt.so.1\nsetfmac mls\/low \/lib\/libthr.so.3\nsetfmac mls\/low \/usr\/local\/lib\/libpng16.so.16\nsetfmac mls\/low \/usr\/lib\/libbz2.so.4\nsetfmac mls\/low \/usr\/local\/lib\/libargon2.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libpcre2-8.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libsqlite3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libgd.so.6\nsetfmac mls\/low \/usr\/local\/lib\/libjpeg.so.8\nsetfmac mls\/low \/usr\/local\/lib\/libfreetype.so\nsetfmac mls\/low \/usr\/local\/lib\/libfontconfig.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libtiff.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libwebp.so.7\nsetfmac mls\/low \/usr\/local\/lib\/libjbig.so.2\nsetfmac mls\/low \/usr\/lib\/libssl.so.8\nsetfmac mls\/low \/lib\/libcrypto.so.8\nsetfmac mls\/low \/usr\/local\/lib\/libzip.so.5\nsetfmac mls\/low \/etc\/resolv.conf\n<\/code><\/pre>\n
Aceast\u0103 list\u0103 atribuie etichete mls\/low tuturor fi\u0219ierelor necesare pentru func\u021bionarea corect\u0103 a combina\u021biei Apache \u0219i PHP (pentru pachetele instalate \u00een exemplul meu).<\/p>\n
Ultimul pas va fi configurarea lans\u0103rii jail-ului la nivelul mls\/equal \u0219i a Apache la nivelul mls\/low. Pentru a lansa jail-ul, este necesar s\u0103 face\u021bi modific\u0103ri \u00een scriptul \/etc\/rc.d\/jail, c\u0103uta\u021bi \u00een acest script func\u021bia jail_start \u0219i adapta\u021bi variabila command la urm\u0103toarea form\u0103:<\/p>\n
command=\"setpmac mls\/equal $jail_program\"\n<\/code><\/pre>\n
Comanda setpmac lanseaz\u0103 fi\u0219ierul executabil la nivelul mandatinte necesar, \u00een acest caz mls\/equal, pentru a avea acces la toate etichetele. \u00cen Apache, este necesar s\u0103 edita\u021bi scriptul de pornire \/usr\/local\/etc\/rc.d\/apache24. Face\u021bi modific\u0103rile \u00een func\u021bia apache24_prestart:<\/p>\n
apache24_prestart() {\n        apache24_checkfib\n        apache24_precmd\n        eval \"setpmac mls\/low\" ${command} ${apache24_flags}\n}\n<\/code><\/pre>\n
\u00cen oficial<\/a><\/noindex> manualul ofer\u0103 un alt exemplu, dar nu am reu\u0219it s\u0103 \u00eel folosesc deoarece am primit constant un mesaj de imposibilitate de a utiliza comanda setpmac.<\/p>\n
Ie\u0219ire<\/h2>\n
Aceast\u0103 metod\u0103 de distribuire a accesului va ad\u0103uga un nivel suplimentar de securitate Apache (de\u0219i aceast\u0103 metod\u0103 poate fi aplicat\u0103 oric\u0103rui alt stack), care, \u00een plus, este lansat \u00een jail, \u00een acela\u0219i timp fiind transparen\u021b\u0103 \u0219i neobservabil pentru administrator.<\/p>\n
Lista surselor care m-au ajutat \u00een redactarea acestei publica\u021bii:<\/b><\/p>\n
https:\/\/www.freebsd.org\/doc\/ru_RU.KOI8-R\/books\/handbook\/mac.html<\/a><\/noindex>
\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u0443\u044e \u043c\u043e\u0434\u0435\u043b\u044c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u043e \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c apache \u0432 jail \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0442\u0435\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b apache \u0438 php. \u041f\u043e \u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u043c\u043e\u0436\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e apache, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043b\u044e\u0431\u043e\u0439 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u044d\u043a. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31890","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Modelul de distribu\u021bie mandatin \u00een FreeBSD | ProHoster","description":"Introducere Pentru a asigura un nivel suplimentar de securitate serverului, se poate utiliza","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u043d\u0434\u0430\u0442\u043d\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432 \u0432 FreeBSD | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:45+00:00","article:modified_time":"2019-10-31T18:43:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31890","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:18:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:09:26","updated":"2026-01-21 08:18:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=31890"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/31890\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=31890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=31890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=31890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}