{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">articolul anterior<\/a><\/noindex> Am explicat cum s\u0103 lans\u0103m o versiune stabil\u0103 a Suricata pe Ubuntu 18.04 LTS. Configurarea IDS pe un singur nod \u0219i conectarea seturilor gratuite de reguli nu este foarte complicat\u0103. Ast\u0103zi vom analiza cum s\u0103 protej\u0103m re\u021beaua corporativ\u0103 de cele mai frecvente tipuri de atacuri folosind Suricata instalat\u0103 pe un server virtual. Pentru aceasta, avem nevoie de un VDS pe Linux cu dou\u0103 nuclee de procesare. Cantitatea de memorie RAM depinde de \u00eenc\u0103rcare: unii se pot descurca cu 2 GB, \u00een timp ce pentru sarcini mai serioase pot fi necesari 4 sau chiar 6. Avantajul ma\u0219inii virtuale este posibilitatea de a experimenta: po\u021bi \u00eencepe cu o configura\u021bie minim\u0103 \u0219i s\u0103 cre\u0219ti resursele pe m\u0103sur\u0103 ce este necesar.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>foto: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort sau Suricata. Partea 1: alegerea unei IDS\/IPS gratuite pentru protejarea re\u021belei corporative<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">Snort sau Suricata. Partea 2: instalarea \u0219i configurarea ini\u021bial\u0103 a Suricata<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>Unificarea re\u021belelor<\/h2>\n<p>\nMutarea IDS pe o ma\u0219in\u0103 virtual\u0103 poate fi necesar\u0103 \u00een primul r\u00e2nd pentru teste. Dac\u0103 nu ai mai avut de-a face cu astfel de solu\u021bii, nu te gr\u0103bi s\u0103 comanzi echipamente fizice \u0219i s\u0103 schimbi arhitectura re\u021belei. Este mai bine s\u0103 testezi sistemul \u00een siguran\u021b\u0103 \u0219i f\u0103r\u0103 costuri inutile pentru a determina nevoile \u00een resursele computa\u021bionale. Este important s\u0103 \u00een\u021belegi c\u0103 tot traficul corporativ va trebui s\u0103 treac\u0103 printr-un singur nod extern: pentru a conecta re\u021beaua local\u0103 (sau mai multe re\u021bele) la VDS cu IDS Suricata instalat\u0103, po\u021bi folosi <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 un server VPN multiplatform\u0103, u\u0219or de configurat, care ofer\u0103 criptare de \u00eencredere. Conexiunea biroului la internet poate s\u0103 nu aib\u0103 un IP real, a\u0219a c\u0103 este mai bine s\u0103 o ridici pe un VPS. \u00cen depozitul Ubuntu nu sunt pachete gata, software-ul va trebui desc\u0103rcat fie de pe <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">site-ul proiectului<\/a><\/noindex>, fie dintr-un depozit extern pe serviciul <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (dac\u0103 ai \u00eencredere \u00een acesta):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nPo\u021bi vizualiza lista pachetelor disponibile folosind urm\u0103toarea comand\u0103:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVom avea nevoie de softether-vpnserver (serverul \u00een configura\u021bia de test este pornit pe VDS), precum \u0219i de softether-vpncmd \u2014 utilit\u0103\u021bi de linie de comand\u0103 pentru configurarea acestuia.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nPentru configurarea serverului se folose\u0219te o utilitate special\u0103 de linie de comand\u0103:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNu vom intra \u00een detalii despre configurare: procedura este destul de simpl\u0103 \u0219i bine descris\u0103 \u00een numeroase publica\u021bii, nemaifiind direct legat\u0103 de subiectul articolului. Pe scurt, dup\u0103 ce porni\u021bi vpncmd, trebuie s\u0103 alege\u021bi op\u021biunea 1 pentru a accesa consola de administrare a serverului. Pentru aceasta, este necesar s\u0103 introduce\u021bi numele localhost \u0219i s\u0103 ap\u0103sa\u021bi enter \u00een loc s\u0103 introduce\u021bi numele hub-ului. \u00cen consol\u0103 se seteaz\u0103 parola de administrator cu comanda serverpasswordset, se \u0219terge hub-ul virtual DEFAULT (comanda hubdelete) \u0219i se creeaz\u0103 unul nou cu numele Suricata_VPN, precum \u0219i parola sa (comanda hubcreate). Apoi trebuie s\u0103 accesa\u021bi consola de administrare a noului hub cu comanda hub Suricata_VPN pentru a crea un grup \u0219i un utilizator cu ajutorul comenzilor groupcreate \u0219i usercreate. Parola utilizatorului se seteaz\u0103 cu userpasswordset. <\/p>\n<p>SoftEther suport\u0103 dou\u0103 moduri de transmitere a traficului: SecureNAT \u0219i Local Bridge. Primul este o tehnologie proprietar\u0103 pentru construirea unei re\u021bele private virtuale cu propriul NAT \u0219i DHCP. SecureNAT nu necesit\u0103 TUN\/TAP \u0219i nici configurarea Netfilter sau a altui firewall. Rutarea nu afecteaz\u0103 nucleul sistemului, iar toate procesele sunt virtualizate \u0219i func\u021bioneaz\u0103 pe orice VPS\/VDS, indiferent de hypervisorul folosit. Acest lucru conduce la o \u00eenc\u0103rcare mai mare a procesorului \u0219i la o vitez\u0103 redus\u0103 comparativ cu modul Local Bridge, care leag\u0103 hub-ul virtual SoftEther de adaptorul de re\u021bea fizic sau de dispozitivul TAP. <\/p>\n<p>Configurarea devine mai complicat\u0103 \u00een acest caz, deoarece rutarea se realizeaz\u0103 la nivelul nucleului cu ajutorul Netfilter. VDS-urile noastre sunt construite pe Hyper-V, a\u0219a c\u0103 \u00een pasul final cre\u0103m un pod local \u0219i activ\u0103m dispozitivul TAP cu comanda bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes. Dup\u0103 ie\u0219irea din consola de administrare a hub-ului, vom observa \u00een sistem o nou\u0103 interfa\u021b\u0103 de re\u021bea, c\u0103reia nu i-a fost \u00eenc\u0103 atribuit un IP:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nApoi va trebui s\u0103 activ\u0103m rutarea pachetelor \u00eentre interfe\u021be (ip forward), dac\u0103 aceasta nu este activat\u0103:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\nDebifa\u021bi urm\u0103toarea linie:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nSalv\u0103m modific\u0103rile \u00een fi\u0219ier, ie\u0219im din editor \u0219i le aplic\u0103m cu ajutorul urm\u0103toarei comenzi:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nApoi va trebui s\u0103 definim pentru re\u021beaua virtual\u0103 o subre\u021bea cu IP-uri fictive (de exemplu, 10.0.10.0\/24) \u0219i s\u0103 atribuim o adres\u0103 interfe\u021bei:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nApoi va fi necesar s\u0103 definim regulile Netfilter.<\/p>\n<p>1. Permite\u021bi pachetele de intrare pe porturile ascultate (protocolul proprietar SoftEther folose\u0219te HTTPS \u0219i portul 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Configur\u0103m NAT din subnetul 10.0.10.0\/24 pe IP-ul principal al serverului<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Permitem pachetele trec\u0103toare din subnetul 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Permitem pachetele trec\u0103toare pentru conexiuni deja stabilite<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nAutomatizarea procesului la repornirea sistemului folosind scripturi de ini\u021bializare va r\u0103m\u00e2ne la latitudinea cititorilor ca tem\u0103 de cas\u0103. <\/p>\n<p>Dac\u0103 dori\u021bi s\u0103 aloca\u021bi IP-uri clien\u021bilor automat, va trebui s\u0103 instala\u021bi un serviciu DHCP pentru podul local. Cu asta, configura\u021bia serverului este complet\u0103 \u0219i putem trece la clien\u021bi. SoftEther suport\u0103 multe protocoale, utilizarea acestora depinz\u00e2nd de capabilit\u0103\u021bile echipamentului din re\u021beaua local\u0103. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDeoarece routerul nostru de test func\u021bioneaz\u0103 \u0219i el pe Ubuntu, vom instala dintr-un depozit extern pachetele softether-vpnclient \u0219i softether-vpncmd pentru a utiliza protocolul proprietar. Va trebui s\u0103 lans\u0103m clientul:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nPentru configurare, folosim utilitarul vpncmd, aleg\u00e2nd localhost ca ma\u0219in\u0103 pe care este lansat vpnclient. Toate comenzile se execut\u0103 \u00een consol\u0103: va fi necesar s\u0103 cre\u0103m o interfa\u021b\u0103 virtual\u0103 (NicCreate) \u0219i un cont (AccountCreate). <\/p>\n<p>\u00cen unele cazuri, este necesar s\u0103 specific\u0103m metoda de autentificare prin comenzile AccountAnonymousSet, AccountPasswordSet, AccountCertSet \u0219i AccountSecureCertSet. Deoarece nu folosim DHCP, adresa pentru adaptorul virtual se seteaz\u0103 manual. <\/p>\n<p>\u00cen plus, va trebui s\u0103 activ\u0103m ip forward (parametrul net.ipv4.ip_forward=1 \u00een fi\u0219ierul \/etc\/sysctl.conf) \u0219i s\u0103 configur\u0103m rutele statice. Dac\u0103 este necesar, pe VDS cu Suricata se pot configura redirec\u021bion\u0103ri de porturi pentru utilizarea serviciilor instalate \u00een re\u021beaua local\u0103. Astfel, fuzionarea re\u021belelor poate fi considerat\u0103 finalizat\u0103.<\/p>\n<p>Configura\u021bia pe care o propunem va ar\u0103ta cam a\u0219a:<\/p>\n<p><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Configur\u0103m Suricata<\/h2>\n<p>\n\u00cen <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">articolul anterior<\/a><\/noindex> Am vorbit despre cele dou\u0103 moduri de func\u021bionare ale IDS: prin coada NFQUEUE (modul NFQ) \u0219i prin zero copy (modul AF_PACKET). Al doilea necesit\u0103 dou\u0103 interfe\u021be, dar se distinge printr-o vitez\u0103 de reac\u021bie mai mare \u2014 pe acesta \u00eel vom folosi. Parametrul este setat implicit \u00een \/etc\/default\/suricata. De asemenea, va fi necesar s\u0103 edit\u0103m sec\u021biunea vars din \/etc\/suricata\/suricata.yaml, specific\u00e2nd subre\u021beaua virtual\u0103 ca re\u021bea local\u0103.<\/p>\n<p><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru a reporni IDS, utiliz\u0103m comanda:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\nSolu\u021bia este gata, acum poate fi necesar s\u0103 o verifica\u021bi pentru rezisten\u021ba la ac\u021biunile atacatorilor.<\/p>\n<h2>Simul\u0103m atacuri<\/h2>\n<p>\nExist\u0103 mai multe scenarii de utilizare a serviciului IDS extern:<\/p>\n<p><b>Protec\u021bie \u00eempotriva atacurilor DDoS (scop principal)<\/b><\/p>\n<p>Implementarea unei astfel de variante \u00een interiorul unei re\u021bele corporative este dificil\u0103, deoarece pachetele pentru analiz\u0103 trebuie s\u0103 ajung\u0103 la interfa\u021ba sistemului care este conectat\u0103 la internet. Chiar dac\u0103 IDS le blocheaz\u0103, traficul nedorit poate s\u0103 afecteze canalul de transmisie a datelor. Pentru a evita acest lucru, este necesar s\u0103 comanda\u021bi un VPS cu o conexiune la internet suficient de performant\u0103, capabil\u0103 s\u0103 preia tot traficul re\u021belei locale \u0219i tot traficul extern. Adesea, este mai simplu \u0219i mai ieftin dec\u00e2t s\u0103 extinde\u021bi canalul de birou. Ca alternativ\u0103, merit\u0103 men\u021bionate serviciile specializate de protec\u021bie \u00eempotriva DDoS. Costurile acestora sunt comparabile cu cele ale unui server virtual, f\u0103r\u0103 a necesita o configurare laborioas\u0103, dar exist\u0103 \u0219i dezavantaje \u2014 pentru banii lor, clientul prime\u0219te doar protec\u021bie \u00eempotriva DDoS, \u00een timp ce propriul IDS poate fi configurat \u00een moduri variate.<\/p>\n<p><b>Protec\u021bie \u00eempotriva altor tipuri de atacuri externe<\/b> <\/p>\n<p>Suricata este capabil\u0103 s\u0103 fac\u0103 fa\u021b\u0103 \u00eencerc\u0103rilor de exploatare a diferitelor vulnerabilit\u0103\u021bi \u00een serviciile accesibile din internet \u00een re\u021beaua corporativ\u0103 (server de mail, server web \u0219i aplica\u021bii web etc.). De obicei, pentru aceasta IDS-ul este instalat \u00een interiorul re\u021belei interne, dup\u0103 dispozitivele de frontier\u0103, dar \u0219i amplasarea extern\u0103 este o op\u021biune valid\u0103.<\/p>\n<p><b>Protec\u021bie \u00eempotriva atacatorilor interni<\/b><\/p>\n<p>\u00cen ciuda tuturor eforturilor administratorului de sistem, computerele din re\u021beaua corporativ\u0103 pot fi infectate cu malware. \u00cen plus, \u00een re\u021beaua local\u0103 pot ap\u0103rea uneori indivizi r\u0103u inten\u021biona\u021bi care \u00eencearc\u0103 s\u0103 efectueze anumite opera\u021biuni nelegitime. Suricata poate ajuta la blocarea acestor \u00eencerc\u0103ri, de\u0219i pentru a proteja re\u021beaua intern\u0103, este mai bine s\u0103 o instala\u021bi \u00een interiorul perimetrului \u0219i s\u0103 o folosi\u021bi \u00eempreun\u0103 cu un switch administrat capabil s\u0103 cloneze traficul pe un singur port. O IDS extern\u0103 nu este inutil\u0103 \u00een acest caz - cel pu\u021bin va putea s\u0103 detecteze \u00eencerc\u0103rile malware-urilor din re\u021beaua local\u0103 de a se conecta la un server extern.<\/p>\n<p>Pentru \u00eenceput, s\u0103 cre\u0103m \u00eenc\u0103 un VPS de atac de test \u0219i vom ridica Apache pe router-ul re\u021belei locale cu configura\u021bia implicit\u0103, dup\u0103 care vom forwarda portul 80 de pe serverul IDS c\u0103tre acesta. Apoi, vom simula un atac DDoS de pe nodul de atac. Pentru aceasta, vom desc\u0103rca de pe GitHub, vom compila \u0219i vom rula pe nodul de atac un mic program numit xerxes (poate fi necesar\u0103 instalarea pachetului gcc):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nRezultatul a fost urm\u0103torul:<\/p>\n<p><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata blocheaz\u0103 atacatorul, iar pagina Apache implicit\u0103 se deschide, \u00een ciuda atacului nostru improvizat \u0219i a canalului destul de slab al re\u021belei \u201eoficelist\u201d, care este, de fapt, o re\u021bea de acas\u0103. Pentru sarcini mai serioase, merit\u0103 s\u0103 utiliz\u0103m <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. Acesta este destinat realiz\u0103rii testelor de penetrare \u0219i permite simularea diverselor atacuri. Instruc\u021biunile pentru instalare <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">disponibil\u0103<\/a><\/noindex> sunt disponibile pe site-ul proiectului. Dup\u0103 instalare, va fi necesar\u0103 o actualizare:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nPentru testare, lans\u0103m msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDin p\u0103cate, \u00een ultimele versiuni ale framework-ului lipse\u0219te op\u021biunea de hacking automat, a\u0219a c\u0103 exploiturile trebuie s\u0103 fie parcurse manual \u0219i lansate cu comanda use. Ini\u021bial, este bine s\u0103 determin\u0103m porturile deschise pe ma\u0219ina atacat\u0103, de exemplu, folosind nmap (\u00een cazul nostru, netstat pe nodul atacat ar fi suficient), iar apoi s\u0103 select\u0103m \u0219i s\u0103 utiliz\u0103m modulele corespunz\u0103toare. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">m\u00f3dules Metasploit<\/a><\/noindex>.\u00a0<\/p>\n<p>Exist\u0103 \u0219i alte instrumente pentru verificarea rezisten\u021bei IDS la atacuri, inclusiv servicii online. Din curiozitate, se poate organiza un test de stres folosind versiunea trial <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser<\/a><\/noindex>. Pentru a verifica reac\u021bia la ac\u021biunile celor din interior, ar trebui s\u0103 instala\u021bi instrumente speciale pe una dintre ma\u0219inile din re\u021beaua local\u0103. Exist\u0103 o mul\u021bime de op\u021biuni \u0219i ar trebui s\u0103 le aplica\u021bi periodic nu doar pe un teren experimental, ci \u0219i pe sistemele de lucru, dar aceasta este o poveste complet diferit\u0103.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort sau Suricata. Partea 3: protejarea re\u021belei de birou\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort sau Suricata. Partea 3: protejarea re\u021belei de birou | ProHoster","description":"\u00cen articolul anterior, am explicat cum s\u0103 lansa\u021bi o versiune stabil\u0103 a Suricata \u00een Ubuntu 18.04 LTS.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2026-08-11 12:50:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}