{"id":85475,"date":"2020-06-16T13:42:55","date_gmt":"2020-06-16T11:42:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti"},"modified":"2020-06-16T13:42:55","modified_gmt":"2020-06-16T11:42:55","slug":"snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","title":{"rendered":"Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>C\u00e2ndva, pentru protec\u021bia unei re\u021bele locale, era suficient un simplu firewall \u0219i programe antivirus, dar \u00eempotriva atacurilor hackerilor moderni \u0219i a malware-ului proliferat \u00een ultima vreme, acest set devine din ce \u00een ce mai pu\u021bin eficient. Firewall-ul clasic analizeaz\u0103 doar anteturile pachetelor, permit\u00e2ndu-le sau bloc\u00e2ndu-le conform unui set de reguli formale. Nu \u0219tie nimic despre con\u021binutul pachetelor, astfel c\u0103 nu poate recunoa\u0219te ac\u021biunile aparent legitime ale atacatorilor. Programele antivirus nu reu\u0219esc \u00eentotdeauna s\u0103 identifice software-ul mali\u021bios, a\u0219a c\u0103 provocarea pentru administrator devine urm\u0103rirea activit\u0103\u021bilor anormale \u0219i izolarea la timp a gazdelor infectate. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\"><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative\" src=\"\/wp-content\/uploads\/2020\/06\/e5bf2d1eeec4b350c9a3b89fdf2a2475.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Exist\u0103 numeroase solu\u021bii avansate care permit protejarea infrastructurii IT a companiei. Ast\u0103zi vom discuta despre sistemele de detectare \u0219i prevenire a intruziunilor cu cod surs\u0103 deschis, care pot fi implementate f\u0103r\u0103 achizi\u021bionarea de echipamente costisitoare sau licen\u021be software.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Clasificarea IDS\/IPS<\/h2>\n<p>\nIDS (Sistem de Detectare a Intruziunilor) este destinat \u00eenregistr\u0103rii ac\u021biunilor suspecte \u00een re\u021bea sau pe un computer individual. Acesta \u021bine eviden\u021ba evenimentelor \u0219i notific\u0103 angajatul responsabil de securitatea informa\u021biilor. \u00cen cadrul IDS pot fi identificate urm\u0103toarele elemente:<\/p>\n<ul>\n<li>senzori pentru monitorizarea traficului de re\u021bea, a diferitelor jurnale etc.\u00a0<\/li>\n<li>o subsistem\u0103 de analiz\u0103, care identific\u0103 \u00een datele primite semne de atac mali\u021bios;<\/li>\n<li>o stocare pentru acumularea evenimentelor ini\u021biale \u0219i a rezultatelor analizei;<\/li>\n<li>o consol\u0103 de gestionare.<\/li>\n<\/ul>\n<p>\nIni\u021bial, IDS-urile au fost clasificate dup\u0103 locul de amplasare: acestea puteau fi axate pe protejarea unor noduri individuale (host-based sau Host Intrusion Detection System \u2014 HIDS) sau s\u0103 protejeze \u00eentreaga re\u021bea corporativ\u0103 (network-based sau Network Intrusion Detection System \u2014 NIDS). Merit\u0103 men\u021bionate a\u0219a-numitele APIDS (IDS-uri bazate pe protocol de aplica\u021bie): acestea monitorizeaz\u0103 un set limitat de protocoale la nivel de aplica\u021bie pentru a identifica atacuri specifice \u0219i nu efectueaz\u0103 o analiz\u0103 profund\u0103 a pachetelor de re\u021bea. Aceste produse seam\u0103n\u0103 de obicei cu un proxy \u0219i sunt utilizate pentru protejarea unor servicii specifice: servere web \u0219i aplica\u021bii web (de exemplu, scrise \u00een PHP), servere de baze de date etc. Un reprezentant tipic al acestei clase este mod_security pentru serverul web Apache. <\/p>\n<p>Ne intereseaz\u0103 mai mult NIDS-urile universale, care suport\u0103 un set larg de protocoale de comunica\u021bie \u0219i tehnologia de analiz\u0103 profund\u0103 a pachetelor DPI (Deep Packet Inspection). Acestea monitorizeaz\u0103 tot traficul care trece, \u00eencep\u00e2nd cu nivelul canalului, \u0219i identific\u0103 o gam\u0103 larg\u0103 de atacuri de re\u021bea, precum \u0219i tentativele de acces neautorizat la informa\u021bii. Adesea, aceste sisteme se disting printr-o arhitectur\u0103 distribuit\u0103 \u0219i pot interac\u021biona cu diverse echipamente de re\u021bea active. Merit\u0103 men\u021bionat c\u0103 multe NIDS-uri moderne sunt hibride \u0219i combin\u0103 mai multe abord\u0103ri. \u00cen func\u021bie de configura\u021bie \u0219i set\u0103ri, ele pot rezolva diverse sarcini \u2014 de exemplu, protec\u021bia unui singur nod sau a \u00eentregii re\u021bele. \u00cen plus, func\u021biile IDS pentru sta\u021biile de lucru au fost preluate de pachetele antivirus, care, din cauza r\u0103sp\u00e2ndirii troianilor orienta\u021bi spre furtul de informa\u021bii, s-au transformat \u00een firewall-uri multifunc\u021bionale, care \u00eendeplinesc, de asemenea, sarcini de recunoa\u0219tere \u0219i blocare a traficului suspect. <\/p>\n<p>Ini\u021bial, IDS-urile puteau doar s\u0103 detecteze ac\u021biuni ale malware-ului, func\u021bionarea scanerelor de porturi sau, s\u0103 zicem, \u00eenc\u0103lc\u0103rile de c\u0103tre utilizatori ale politicilor de securitate corporativ\u0103. La apari\u021bia unui anumit eveniment, ele notificau administratorul, dar destul de repede a devenit clar c\u0103 doar recunoa\u0219terea unui atac nu este suficient\u0103 \u2014 acesta trebuie blocat. Astfel, IDS-urile s-au transformat \u00een IPS (Sisteme de Prevenire a Intruzilor) \u2014 sisteme capabile s\u0103 interac\u021bioneze cu firewalls-urile de re\u021bea.<\/p>\n<h2>Metode de detectare<\/h2>\n<p>\nSolu\u021biile moderne pentru detectarea \u0219i prevenirea intruziunilor utilizeaz\u0103 diverse metode de identificare a activit\u0103\u021bii mali\u021bioase, care pot fi \u00eemp\u0103r\u021bite \u00een trei categorii. Acest lucru ne ofer\u0103 \u00eenc\u0103 o variant\u0103 de clasificare a sistemelor:<\/p>\n<ul>\n<li>IDS\/IPS-urile pe baz\u0103 de semn\u0103turi identific\u0103 \u00een trafic anumite modele sau urm\u0103resc modific\u0103rile st\u0103rii sistemelor pentru a determina o atac de re\u021bea sau o tentativ\u0103 de infectare. Ele aproape nu au false pozitive \u0219i erori, dar nu sunt capabile s\u0103 identifice amenin\u021b\u0103rile necunoscute;<\/li>\n<li>Sistemele IDS de detectare a anomaliilor nu folosesc semn\u0103turi de atac. Ele recunosc comportamentele care deviaz\u0103 de la normal \u00een sistemele informa\u021bionale (inclusiv anomalii \u00een traficul de re\u021bea) \u0219i pot detecta chiar \u0219i atacuri necunoscute. Aceste sisteme genereaz\u0103 un num\u0103r semnificativ de alarme false \u0219i, dac\u0103 sunt folosite gre\u0219it, pot paraliza func\u021bionarea re\u021belei locale;<\/li>\n<li>Sistemele IDS bazate pe reguli func\u021bioneaz\u0103 pe principiul: if FACT then ACTION. Practic, acestea sunt sisteme expert bazate pe cuno\u0219tin\u021be \u2014 o acumulare de fapte \u0219i reguli de deduc\u021bie logic\u0103. Aceste solu\u021bii sunt laborioase din punct de vedere al configur\u0103rii \u0219i necesit\u0103 un \u00een\u021beles detaliat al func\u021bion\u0103rii re\u021belei din partea administratorului.\u00a0<\/li>\n<\/ul>\n<p><\/p>\n<h2>Istoricul dezvolt\u0103rii IDS<\/h2>\n<p>\nEpoca de expansiune rapid\u0103 a internetului \u0219i a re\u021belelor corporative a \u00eenceput \u00een anii '90, dar speciali\u0219tii s-au preocupat de tehnologiile avansate de securitate a re\u021belei pu\u021bin mai devreme. \u00cen 1986, Dorothy Denning \u0219i Peter Neumann au publicat modelul IDES (Intrusion Detection Expert System), care a devenit fundamentul celor mai multe sisteme moderne de detectare a intruziunilor. Acesta folosea un sistem expert pentru a identifica tipuri cunoscute de atacuri, precum \u0219i metode statistice \u0219i profiluri de utilizatori\/sisteme. IDES era rulat pe sta\u021bii de lucru Sun, verific\u00e2nd traficul de re\u021bea \u0219i datele aplica\u021biilor. \u00cen 1993 a fost lansat NIDES (Next-generation Intrusion Detection Expert System) \u2014 un sistem expert de detectare a intruziunilor de nou\u0103 genera\u021bie.<\/p>\n<p>Pe baza lucr\u0103rilor lui Denning \u0219i Neumann, \u00een 1988 a ap\u0103rut sistemul expert MIDAS (Multics intrusion detection and alerting system), utiliz\u00e2nd P-BEST \u0219i LISP. Tot atunci a fost creat un sistem bazat pe metode statistice numit Haystack. Un alt detector statistic de anomalii, W&amp;S (Wisdom &amp; Sense), a fost dezvoltat un an mai t\u00e2rziu la Laboratorul Na\u021bional Los Alamos. Dezvoltarea domeniului a avansat rapid. De exemplu, \u00een 1990, \u00een sistemul TIM (Time-based inductive machine) a fost implementat\u0103 deja detectarea anomaliilor folosind \u00eenv\u0103\u021barea inductiv\u0103 pe modele de utilizare secven\u021biale (limbajul Common LISP). NSM (Network Security Monitor) pentru detectarea anomaliilor compara matricele de acces, iar ISOA (Information Security Officer\u2019s Assistant) sus\u021binea diverse strategii de detectare: metode statistice, verificarea profilului \u0219i un sistem expert. Sistemul ComputerWatch creat la AT&amp;T Bell Labs utiliza at\u00e2t metode statistice, c\u00e2t \u0219i reguli pentru verificare, iar primul prototip de IDS distribuit, dezvoltat de cercet\u0103torii Universit\u0103\u021bii California, a fost creat \u00eenc\u0103 din 1991 \u2014 DIDS (Distributed intrusion detection system), care era, de asemenea, un sistem expert.<\/p>\n<p>Ini\u021bial, IDS-urile erau proprietare, dar \u00een 1998, Laboratorul Na\u021bional Lawrence din Berkeley a lansat Bro (renumit Zeek \u00een 2018) \u2014 un sistem open-source, care folosea un limbaj propriu de reguli pentru analiza datelor libpcap. \u00cen noiembrie acelui an a ap\u0103rut un sniffer de pachete bazat pe libpcap numit APE, care, dup\u0103 o lun\u0103, a fost redenumit Snort \u0219i mai t\u00e2rziu a devenit un IDS\/IPS complet func\u021bional. De asemenea, atunci au \u00eenceput s\u0103 apar\u0103 numeroase solu\u021bii proprietare. <\/p>\n<h2>Snort \u0219i Suricata<\/h2>\n<p>\nMulte companii prefer\u0103 IDS\/IPS-uri gratuite \u0219i open-source. O perioad\u0103 lung\u0103 de timp, solu\u021bia standard a fost men\u021bionata anterior Snort, dar acum a fost \u00eenlocuit\u0103 de sistemul Suricata. S\u0103 analiz\u0103m avantajele \u0219i dezavantajele acestora mai \u00een detaliu. Snort combin\u0103 avantajele metodei bazate pe semn\u0103turi cu capacitatea de detectare a anomaliilor \u00een timp real. Suricata permite, de asemenea, utilizarea altor metode \u00een plus fa\u021b\u0103 de recunoa\u0219terea atacurilor prin semn\u0103turi. Sistemul a fost creat de un grup de dezvoltatori care s-au desprins de proiectul Snort \u0219i sus\u021bine func\u021bii IPS \u00eencep\u00e2nd cu versiunea 1.4, iar \u00een Snort capacitatea de prevenire a intruziunilor a ap\u0103rut mai t\u00e2rziu. <\/p>\n<p>Principala diferen\u021b\u0103 \u00eentre cele dou\u0103 produse populare const\u0103 \u00een faptul c\u0103 Suricata are capacitatea de a utiliza GPU pentru calcul \u00een modul IDS, precum \u0219i \u00eentr-un IPS mai avansat. Sistemul este proiectat ini\u021bial pentru a suporta multithreading, \u00een timp ce Snort este un produs single-thread. Datorit\u0103 istoricului s\u0103u \u00eendelungat \u0219i codului mo\u0219tenit, nu utilizeaz\u0103 optim platformele hardware multiprocesor\/multicore, pe c\u00e2nd Suricata, pe computerele obi\u0219nuite, permite procesarea traficului de p\u00e2n\u0103 la 10 Gbit\/s. Despre asem\u0103n\u0103rile \u0219i diferen\u021bele dintre cele dou\u0103 sisteme se poate discuta mult timp, dar de\u0219i motorul Suricata func\u021bioneaz\u0103 mai rapid, acest lucru nu are o importan\u021b\u0103 semnificativ\u0103 pentru canalele care nu sunt foarte largi.<\/p>\n<h2>Op\u021biuni de desf\u0103\u0219urare<\/h2>\n<p>\nIPS-ul trebuie s\u0103 fie plasat astfel \u00eenc\u00e2t sistemul s\u0103 poat\u0103 monitoriza segmentele de re\u021bea aflate sub controlul s\u0103u. De cele mai multe ori, acesta este un computer dedicat, un singur interfa\u021b\u0103 a c\u0103ruia este conectat\u0103 dup\u0103 dispozitivele de frontier\u0103 \u0219i \u00abprive\u0219te\u00bb prin ele c\u0103tre re\u021belele publice neprotejate (Internet). Cealalt\u0103 interfa\u021b\u0103 a IPS-ului este conectat\u0103 la intrarea segmentului protejat, astfel \u00eenc\u00e2t tot traficul s\u0103 treac\u0103 prin sistem \u0219i s\u0103 fie analizat. \u00cen cazuri mai complexe, pot exista mai multe segmente protejate: de exemplu, \u00een re\u021belele corporative, se creeaz\u0103 frecvent o zon\u0103 demilitarizat\u0103 (DMZ) cu servicii accesibile din Internet. <\/p>\n<p><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative\" src=\"\/wp-content\/uploads\/2020\/06\/15e2e449a81eedea09032718ff4a1bc9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAcest IPS poate preveni \u00eencerc\u0103rile de scanare a porturilor sau de atacuri prin for\u021b\u0103 brut\u0103, exploatarea vulnerabilit\u0103\u021bilor din serverele de po\u0219t\u0103, serverele web sau scripturi, precum \u0219i alte tipuri de atacuri externe. \u00cen cazul \u00een care computerele din re\u021beaua local\u0103 sunt infectate cu malware, IDS-ul nu va permite acestora s\u0103 se conecteze la serverele botnet-ului aflate \u00een exterior. Pentru o protec\u021bie mai serioas\u0103 a re\u021belei interne, va fi necesar\u0103 probabil o configura\u021bie complex\u0103 cu un sistem distribuit \u0219i switch-uri gestionate nu tocmai ieftine, capabile s\u0103 oglindeasc\u0103 traficul pentru interfa\u021ba IDS conectat\u0103 la unul din porturi.<\/p>\n<p>Adesea, re\u021belele corporative sunt supuse atacurilor distribuite de tip deny-of-service (DDoS). De\u0219i IDS-urile moderne pot face fa\u021b\u0103 acestor atacuri, implementarea de mai sus va fi cu siguran\u021b\u0103 ineficient\u0103 aici. Sistemul recunoa\u0219te activitatea d\u0103un\u0103toare \u0219i blocheaz\u0103 traficul parazitar, dar pentru aceasta, pachetele trebuie s\u0103 treac\u0103 printr-o conexiune extern\u0103 la internet \u0219i s\u0103 ajung\u0103 pe interfa\u021ba sa de re\u021bea. \u00cen func\u021bie de intensitatea atacului, banda de transfer poate s\u0103 nu fac\u0103 fa\u021b\u0103 \u00eenc\u0103rc\u0103turii, iar scopul atacatorilor va fi atins. \u00cen astfel de cazuri, recomand\u0103m implementarea IDS-ului pe un server virtual cu o conexiune la internet considerabil mai performant\u0103. VPS-ul poate fi conectat la re\u021beaua local\u0103 prin VPN, iar apoi va trebui configurat\u0103 rutarea \u00eentregului trafic extern prin acesta. Astfel, \u00een cazul unui atac DDoS, nu va fi necesar s\u0103 trece\u021bi pachetele prin conexiunea cu furnizorul, ele vor fi blocate pe nodul extern.<\/p>\n<p><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative\" src=\"\/wp-content\/uploads\/2020\/06\/7ced164023bf2aa37e676d460804d6da.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Problema alegerii<\/h2>\n<p>\nIdentificarea unui lider printre sistemele gratuite este foarte complicat\u0103. Alegerea IDS\/IPS-ului depinde de topologia re\u021belei, de func\u021biile de protec\u021bie necesare, precum \u0219i de preferin\u021bele personale ale administratorului \u0219i de dorin\u021ba acestuia de a se ocupa de configur\u0103ri. Snort are o istorie mai lung\u0103 \u0219i este mai bine documentat, de\u0219i \u0219i despre Suricata se poate g\u0103si informa\u021bie cu u\u0219urin\u021b\u0103 online. \u00cen orice caz, pentru a \u00eenv\u0103\u021ba sistemul, va trebui s\u0103 depune\u021bi un anumit efort, care se va recupera \u00een final - IDS\/IPS-urile comerciale hardware \u0219i hardware-software sunt destul de scumpe \u0219i nu \u00eentotdeauna se \u00eencadreaz\u0103 \u00een buget. Nu trebuie s\u0103 regreta\u021bi timpul petrecut, deoarece un administrator bun \u00ee\u0219i \u00eembun\u0103t\u0103\u021be\u0219te \u00eentotdeauna abilit\u0103\u021bile cu ajutorul angajatorului. \u00cen aceast\u0103 situa\u021bie, toat\u0103 lumea c\u00e2\u0219tig\u0103. \u00cen urm\u0103torul articol, vom explora unele op\u021biuni de implementare a Suricata \u0219i vom compara practic un sistem mai modern cu IDS\/IPS-ul clasic Snort.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata\"><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative\" src=\"\/wp-content\/uploads\/2020\/06\/19f0fd87faf30e31d34e2a10421514da.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata#order\"><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative\" src=\"\/wp-content\/uploads\/2020\/06\/a5fe3bac97102322110b9d0e33f3919c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85476,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protec\u021bia re\u021belei corporative | ProHoster","description":"C\u00e2ndva, pentru a proteja o re\u021bea local\u0103 era suficient\u0103 o simpl\u0103 ap\u0103rare prin firewall \u0219i programe antivirus, dar \u00eempotriva atacurilor hackerilor moderni \u0219i prolifer\u0103rii recente a malware-ului, aceast\u0103 combina\u021bie nu mai este suficient\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-16T11:42:55+00:00","article:modified_time":"2020-06-16T11:42:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85475","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:36:28","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=85475"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/85475\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/85476"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=85475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=85475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=85475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}