{"id":31068,"date":"2019-10-31T21:39:16","date_gmt":"2019-10-31T18:39:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie\/"},"modified":"2019-10-31T21:39:16","modified_gmt":"2019-10-31T18:39:16","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie","title":{"rendered":"Ako prevzia\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola prv\u00e1. Udr\u017eanie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Tento \u010dl\u00e1nok je prv\u00fd v s\u00e9rii \u010dl\u00e1nkov \u201eAko ma\u0165 sie\u0165ov\u00fa infra\u0161trukt\u00faru pod kontrolou\u201c. Obsah v\u0161etk\u00fdch \u010dl\u00e1nkov s\u00e9rie a odkazy n\u00e1jdete <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">tu<\/a><\/noindex><\/i>.<\/p>\n<p>Celkom prip\u00fa\u0161\u0165am, \u017ee existuje dostato\u010dn\u00e9 mno\u017estvo spolo\u010dnost\u00ed, kde jednoduch\u00e1 sie\u0165 nie je kritick\u00e1 ani za hodinu ani za jeden de\u0148. Mne, \u017eia\u013e alebo na\u0161\u0165astie, sa nepodarilo pracova\u0165 v tak\u00fdchto miestach. Ale ur\u010dite s\u00fa siete r\u00f4zne, po\u017eiadavky r\u00f4zne, pr\u00edstupy r\u00f4zne a predsa, v jednom alebo inom oh\u013eade, ni\u017e\u0161ie uveden\u00fd zoznam bude vo ve\u013ea pr\u00edpadoch prakticky \u201emust-do\u201c.<\/p>\n<p>Tak\u017ee, po\u010diato\u010dn\u00e9 podmienky. <\/p>\n<p>Ste na novom pracovisku, alebo m\u00e1te pov\u00fd\u0161enie, alebo ste sa rozhodli inak pozrie\u0165 na svoje povinnosti. Sie\u0165 spolo\u010dnosti \u2013 to je va\u0161a z\u00f3na zodpovednosti. Pre v\u00e1s je to v mnoh\u00fdch oh\u013eadoch v\u00fdzva a nie\u010do nov\u00e9, \u010do do zna\u010dnej miery ospravedl\u0148uje mentoruj\u00faci t\u00f3n tohto \u010dl\u00e1nku :). Ale d\u00fafam, \u017ee \u010dl\u00e1nok m\u00f4\u017ee by\u0165 u\u017eito\u010dn\u00fd aj pre ka\u017ed\u00e9ho sie\u0165ov\u00e9ho in\u017einiera.<\/p>\n<p>V\u00e1\u0161 prv\u00fd strategick\u00fd cie\u013e je nau\u010di\u0165 sa odol\u00e1va\u0165 entropii a udr\u017eiava\u0165 \u00farove\u0148 poskytovan\u00fdch slu\u017eieb. <\/p>\n<p>Mnoh\u00e9 ni\u017e\u0161ie pop\u00edsan\u00e9 \u00falohy m\u00f4\u017eu by\u0165 rie\u0161en\u00e9 r\u00f4znymi prostriedkami. \u00damyselne sa nezameriavam na t\u00e9mu technickej realiz\u00e1cie, preto\u017ee vo v\u00e4\u010d\u0161ine pr\u00edpadov nie je a\u017e tak d\u00f4le\u017eit\u00e9, ako ste vyrie\u0161ili dan\u00fa \u00falohu, ale sk\u00f4r to, ako to vyu\u017e\u00edvate a \u010di to v\u00f4bec vyu\u017e\u00edvate. M\u00e1lo osohu, napr\u00edklad, z va\u0161ej profesion\u00e1lne vybudovanej monitorovacej s\u00fastavy, ak sa na \u0148u ned\u00edvate a nereagujete na upozornenia.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Zariadenie<\/h2>\n<p>\nNa za\u010diatku mus\u00edte porozumie\u0165, kde s\u00fa najv\u00e4\u010d\u0161ie rizik\u00e1.<\/p>\n<p>Op\u00e4\u0165 sa to m\u00f4\u017ee l\u00ed\u0161i\u0165. Prip\u00fa\u0161\u0165am, \u017ee niekde m\u00f4\u017eu by\u0165 ot\u00e1zky bezpe\u010dnosti, inde ot\u00e1zky s\u00favisiace s pokra\u010dovan\u00edm slu\u017eieb, a niekde, mo\u017eno, nie\u010do in\u00e9. Pre\u010do nie?<\/p>\n<p>Predpokladajme pre ur\u010denie, \u017ee to st\u00e1le bude pokra\u010dovanie slu\u017eieb (tak to bolo vo v\u0161etk\u00fdch spolo\u010dnostiach, kde som pracoval).<\/p>\n<p>Potom treba za\u010da\u0165 s hardv\u00e9rom. Tu je zoznam t\u00e9m, na ktor\u00e9 sa treba zamera\u0165:<\/p>\n<ul>\n<li>kategoriz\u00e1cia hardv\u00e9ru pod\u013ea miery kritickosti<\/li>\n<li>z\u00e1lohovanie kritick\u00e9ho hardv\u00e9ru<\/li>\n<li>podpora, licencie<\/li>\n<\/ul>\n<p>\nMus\u00edte zv\u00e1\u017ei\u0165 mo\u017en\u00e9 poruchy, najm\u00e4 s hardv\u00e9rom, ktor\u00fd patr\u00ed do najvy\u0161\u0161ej kateg\u00f3rie kritickosti. Zvy\u010dajne sa prehliada pravdepodobnos\u0165 dvojit\u00fdch probl\u00e9mov, inak m\u00f4\u017eu by\u0165 va\u0161e rie\u0161enia a podpora zbyto\u010dne drah\u00e9, no v pr\u00edpade naozaj kritick\u00fdch prvkov siete, ktor\u00fdch v\u00fdpadok m\u00f4\u017ee ma\u0165 zna\u010dn\u00fd vplyv na podnikanie, by ste o tom mali prem\u00fd\u0161\u013ea\u0165.<\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<p>Predpokladajme, \u017ee hovor\u00edme o hlavnom prep\u00edna\u010di v d\u00e1tovom centre. <\/p>\n<p>Ke\u010f\u017ee sme sa dohodli, \u017ee kontinuita slu\u017eby je najd\u00f4le\u017eitej\u0161\u00edm krit\u00e9riom, rozumn\u00e9 je zabezpe\u010di\u0165 \u201ehor\u00facu\u201c redundanciu tohto zariadenia. Ale to nie je v\u0161etko. Mus\u00edte tie\u017e rozhodn\u00fa\u0165, ko\u013eko \u010dasu, v pr\u00edpade poruchy prv\u00e9ho prep\u00edna\u010da, je pre v\u00e1s prijate\u013en\u00e9 fungova\u0165 len s jedn\u00fdm zost\u00e1vaj\u00facim prep\u00edna\u010dom, ve\u010f existuje riziko, \u017ee aj ten sa pokaz\u00ed.<\/p>\n<p><b>D\u00f4le\u017eit\u00e9! Nemali by ste t\u00fato ot\u00e1zku rie\u0161i\u0165 sami. Mus\u00edte op\u00edsa\u0165 rizik\u00e1, mo\u017en\u00e9 rie\u0161enia a n\u00e1klady svojmu vedeniu alebo vedeniu spolo\u010dnosti. Rozhodova\u0165 by mali oni.<\/b><\/p>\n<p>Tak\u017ee, ak bolo rozhodnut\u00e9, \u017ee pri malej pravdepodobnosti dvojitej poruchy je prev\u00e1dzka na jednom prep\u00edna\u010di po\u010das 4 hod\u00edn v z\u00e1sade prijate\u013en\u00e1, m\u00f4\u017eete si jednoducho objedna\u0165 pr\u00edslu\u0161n\u00fa podporu (pod\u013ea ktorej bude zariadenie vymenen\u00e9 do 4 hod\u00edn). <\/p>\n<p>Ale je tu riziko, \u017ee dod\u00e1vka nebude. Bohu\u017eia\u013e, raz sme sa ocitli v takej situ\u00e1cii. Namiesto \u0161tyroch hod\u00edn zariadenie cestovalo t\u00fd\u017ede\u0148!!!<\/p>\n<p>Preto je potrebn\u00e9 diskutova\u0165 aj o tomto riziku a, mo\u017eno, pre v\u00e1s bude rozumnej\u0161ie k\u00fapi\u0165 e\u0161te jeden prep\u00edna\u010d (tret\u00ed) a ma\u0165 ho v ZIP-e (\u201estuden\u00e1\u201c redundancia) alebo ho pou\u017e\u00edva\u0165 na laborat\u00f3rne \u00fa\u010dely.<\/p><\/blockquote>\n<p>\n<b>D\u00f4le\u017eit\u00e9! Vypracujte tabu\u013eku v\u0161etk\u00fdch podpor, ktor\u00e9 m\u00e1te, s d\u00e1tumami skon\u010denia, a pridajte ich do kalend\u00e1ra, aby ste minim\u00e1lne mesiac pred uplynut\u00edm dostali e-mail o tom, \u017ee by ste mali za\u010da\u0165 zh\u00e1\u0148a\u0165 pred\u013a\u017eenie podpory.<\/b><\/p>\n<p>Neodpustia v\u00e1m, ak zabudnete pred\u013a\u017ei\u0165 podporu a na druh\u00fd de\u0148 po jej skon\u010den\u00ed sa va\u0161e zariadenie pokaz\u00ed.<\/p>\n<h2>Havarijn\u00e9 pr\u00e1ce<\/h2>\n<p>\nNez\u00e1le\u017e\u00ed na tom, \u010do sa vo va\u0161ej sieti stane, ide\u00e1lne by ste mali zachova\u0165 pr\u00edstup k v\u00e1\u0161mu sie\u0165ov\u00e9mu zariadeniu. <\/p>\n<p><b>D\u00f4le\u017eit\u00e9! Mus\u00edte ma\u0165 konzolov\u00fd pr\u00edstup k cel\u00e9mu vybaveniu a tento pr\u00edstup nesmie z\u00e1visie\u0165 od funk\u010dnosti siete prenosu pou\u017e\u00edvate\u013esk\u00fdch \u00fadajov (data).<\/b><\/p>\n<p>Rovnako by ste mali vopred predpoklada\u0165 mo\u017en\u00e9 negat\u00edvne scen\u00e1re a zdokumentova\u0165 potrebn\u00e9 kroky. Dostupnos\u0165 tohto dokumentu je tie\u017e kritick\u00e1, tak\u017ee by mal by\u0165 nielen zverejnen\u00fd na spolo\u010dnom zdroji oddelenia, ale mal by by\u0165 aj ulo\u017een\u00fd lok\u00e1lne na po\u010d\u00edta\u010doch in\u017einierov.<\/p>\n<p>Povinne tam musia by\u0165 <\/p>\n<ul>\n<li>inform\u00e1cie potrebn\u00e9 na otvorenie \u017eiadosti o podporu u dod\u00e1vate\u013ea alebo integr\u00e1tora <\/li>\n<li>inform\u00e1cie o tom, ako sa dosta\u0165 k ak\u00e9muko\u013evek vybaveniu (konzola, spr\u00e1va)<\/li>\n<\/ul>\n<p>\nSamozrejme, m\u00f4\u017ee tam by\u0165 aj ak\u00e9ko\u013evek in\u00e9 u\u017eito\u010dn\u00e9 inform\u00e1cie, ako napr\u00edklad popis postupov aktualiz\u00e1cie r\u00f4zneho vybavenia a u\u017eito\u010dn\u00e9 diagnostick\u00e9 pr\u00edkazy.<\/p>\n<h2>Partneri<\/h2>\n<p>\nTeraz by ste mali zhodnoti\u0165 rizik\u00e1 spojen\u00e9 s partnermi. Zvy\u010dajne s\u00fa to<\/p>\n<ul>\n<li>internetov\u00ed poskytovatelia a body v\u00fdmeny prev\u00e1dzky (IX)<\/li>\n<li>poskytovatelia komunika\u010dn\u00fdch kan\u00e1lov <\/li>\n<\/ul>\n<p>\nAk\u00e9 ot\u00e1zky si mus\u00edte polo\u017ei\u0165? Rovnako ako v pr\u00edpade vybavenia je potrebn\u00e9 zv\u00e1\u017ei\u0165 r\u00f4zne varianty havarijn\u00fdch situ\u00e1ci\u00ed. Napr\u00edklad pre internetov\u00fdch poskytovate\u013eov, to m\u00f4\u017ee by\u0165 nie\u010do ako:<\/p>\n<ul>\n<li>\u010do sa stane, ak internetov\u00fd poskytovate\u013e X z nejak\u00e9ho d\u00f4vodu prestane poskytova\u0165 slu\u017eby? <\/li>\n<li>Bude v\u00e1m sta\u010di\u0165 \u0161\u00edrka p\u00e1sma ostatn\u00fdch poskytovate\u013eov?<\/li>\n<li>Ak\u00e1 dobr\u00e1 zostane konektivita?<\/li>\n<li>Ak\u00ed nez\u00e1visl\u00ed s\u00fa va\u0161i internetov\u00ed poskytovatelia a sp\u00f4sob\u00ed v\u00e1\u017ena hav\u00e1ria jedn\u00e9ho z nich probl\u00e9my s ostatn\u00fdmi?<\/li>\n<li>Ko\u013eko optick\u00fdch vstupov m\u00e1 v\u00e1\u0161 d\u00e1tov\u00e9 centrum? <\/li>\n<li>\u010co sa stane, ak bude jeden z vstupov \u00faplne zni\u010den\u00fd?<\/li>\n<\/ul>\n<p>\nPokia\u013e ide o vstupy, vo svojej praxi som v dvoch r\u00f4znych spolo\u010dnostiach za\u017eil, \u017ee <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/kompaniya\/data-centers\/\"   title=\"d\u00e1tov\u00fdch centr\u00e1ch\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4668\">d\u00e1tov\u00fdch centr\u00e1ch<\/a> bager zni\u010dil \u0161achty a len z\u00e1zrakom na\u0161a optika ostala nenaru\u0161en\u00e1. Nie je to a\u017e tak\u00fd zriedkav\u00fd pr\u00edpad.<\/p>\n<p>A samozrejme, mus\u00edte si nielen polo\u017ei\u0165 tieto ot\u00e1zky, ale, op\u00e4\u0165 s podporou vedenia, zabezpe\u010di\u0165 akceptovate\u013en\u00e9 rie\u0161enie v ka\u017edej situ\u00e1cii. <\/p>\n<h2>Z\u00e1lohovanie<\/h2>\n<p>\nNasleduj\u00faca priorita m\u00f4\u017ee by\u0165 z\u00e1loha konfigur\u00e1ci\u00ed vybavenia. V ka\u017edom pr\u00edpade je to ve\u013emi d\u00f4le\u017eit\u00fd moment. Nebudem uv\u00e1dza\u0165 pr\u00edpady, ke\u010f m\u00f4\u017eete strati\u0165 konfigur\u00e1ciu, lep\u0161ie je pravidelne robi\u0165 z\u00e1lohu a nemyslie\u0165 na to. Okrem toho m\u00f4\u017ee by\u0165 pravideln\u00e1 z\u00e1loha ve\u013emi u\u017eito\u010dn\u00e1 pri kontrole zmien.<\/p>\n<p><b>D\u00f4le\u017eit\u00e9! Robte ka\u017ed\u00fd de\u0148 z\u00e1lohu. Nie je to tak ve\u013ek\u00fd objem d\u00e1t, aby ste na tom \u0161etrili. R\u00e1no by mal pohotovostn\u00fd in\u017einier (alebo vy) dost\u00e1va\u0165 spr\u00e1vu od syst\u00e9mu, ktor\u00e1 jasne uv\u00e1dza, \u010di bola z\u00e1loha \u00faspe\u0161n\u00e1 alebo nie, a v pr\u00edpade ne\u00faspe\u0161nej z\u00e1lohy by sa mal probl\u00e9m vyrie\u0161i\u0165 alebo by mal by\u0165 vytvoren\u00fd tiket (pozri procesy sie\u0165ov\u00e9ho oddelenia). <\/b><\/p>\n<h2>Verzie softv\u00e9ru<\/h2>\n<p>\nOt\u00e1zka, \u010di je potrebn\u00e9 vykona\u0165 upgrade softv\u00e9ru zariadenia, nie je jednozna\u010dn\u00e1. Na jednej strane, star\u00e9 verzie maj\u00fa zn\u00e1me chyby a zranite\u013enosti, ale na druhej strane, nov\u00fd softv\u00e9r je predov\u0161etk\u00fdm, nie v\u017edy bezbolestn\u00fd proces upgradu, a po druh\u00e9, nov\u00e9 chyby a zranite\u013enosti.<\/p>\n<p>Tu je potrebn\u00e9 n\u00e1js\u0165 optim\u00e1lnu variantu. Nieko\u013eko zrejm\u00fdch odpor\u00fa\u010dan\u00ed:<\/p>\n<ul>\n<li>in\u0161talujte iba stabiln\u00e9 verzie.<\/li>\n<li>je predsa len lep\u0161ie nema\u0165 \u00faplne star\u00e9 verzie softv\u00e9ru.<\/li>\n<li>vytvorte tabu\u013eku s inform\u00e1ciami, kde je ak\u00fd softv\u00e9r nain\u0161talovan\u00fd.<\/li>\n<li>pravidelne \u010d\u00edtajte spr\u00e1vy o zranite\u013enostiach a chyb\u00e1ch vo verzi\u00e1ch softv\u00e9ru, a v pr\u00edpade kritick\u00fdch probl\u00e9mov by ste mali zv\u00e1\u017ei\u0165 upgrade.<\/li>\n<\/ul>\n<p>\nV tejto f\u00e1ze, having console access to the equipment, information about support, and a description of the upgrade procedure, you are basically ready for this step. The ideal situation is when you have lab equipment where you can test the entire procedure, but unfortunately, such cases are rare.<\/p>\n<p>V pr\u00edpade kritick\u00e9ho zariadenia sa m\u00f4\u017eete obr\u00e1ti\u0165 na podporu dod\u00e1vate\u013ea s po\u017eiadavkou na pomoc pri vykonan\u00ed upgradu.<\/p>\n<h2>Ticketov\u00fd syst\u00e9m<\/h2>\n<p>\nTeraz sa m\u00f4\u017eete obzrie\u0165 okolo seba. Mus\u00edte zorganizova\u0165 procesy interakcie s in\u00fdmi oddeleniami a v r\u00e1mci v\u00e1\u0161ho oddelenia. <\/p>\n<p>Mo\u017eno to nie je povinn\u00e9 (napr\u00edklad ak je va\u0161a spolo\u010dnos\u0165 mal\u00e1), ale ve\u013emi by som odpor\u00fa\u010dal usporiada\u0165 pr\u00e1cu tak, aby v\u0161etky extern\u00e9 a intern\u00e9 \u00falohy prech\u00e1dzali cez tiketov\u00fd syst\u00e9m.<\/p>\n<p>Tiketov\u00fd syst\u00e9m je vlastne v\u00e1\u0161 rozhranie pre intern\u00fa a extern\u00fa komunik\u00e1ciu, a mali by ste s dostato\u010dnou podrobnos\u0165ou op\u00edsa\u0165 toto rozhranie.<\/p>\n<p>Dajte sa ako pr\u00edklad pozrieme na d\u00f4le\u017eit\u00fa a \u010dasto sa vyskytuj\u00facu \u00falohu otv\u00e1rania pr\u00edstupu. Op\u00ed\u0161em algoritmus, ktor\u00fd v\u00fdborne fungoval v jednej z firiem.<\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<p>Za\u010dneme t\u00fdm, \u017ee z\u00e1kazn\u00edci \u010dasto formuluj\u00fa svoje po\u017eiadavky nezrozumite\u013en\u00fdm jazykom pre sie\u0165ov\u00fdch in\u017einierov, najm\u00e4 jazykom aplik\u00e1ci\u00ed, napr\u00edklad \u201eotvorte mi pr\u00edstup do 1C\u201c. <\/p>\n<p>Preto nikdy neprij\u00edmame po\u017eiadavky priamo od tak\u00fdch pou\u017e\u00edvate\u013eov. <br \/>\nA to bola prv\u00e1 po\u017eiadavka.<\/p>\n<ul>\n<li>Po\u017eiadavky na poskytnutie pr\u00edstupov by mali prich\u00e1dza\u0165 od technick\u00fdch oddelen\u00ed (v na\u0161om pr\u00edpade to boli unix, windows, helpdesk in\u017einieri).<\/li>\n<\/ul>\n<p>\nDruh\u00e1 po\u017eiadavka je, \u017ee <\/p>\n<ul>\n<li>tento pr\u00edstup mus\u00ed by\u0165 zaevidovan\u00fd (technick\u00fdm oddelen\u00edm, od ktor\u00e9ho sme prijali t\u00fato po\u017eiadavku) a ako po\u017eiadavku dost\u00e1vame odkaz na tento zaevidovan\u00fd pr\u00edstup. <\/li>\n<\/ul>\n<p>\nForma tejto po\u017eiadavky by mala by\u0165 pre n\u00e1s zrozumite\u013en\u00e1, to jest, <\/p>\n<ul>\n<li>po\u017eiadavka by mala obsahova\u0165 inform\u00e1cie o tom, z akej a do akej podsiete by mal by\u0165 pr\u00edstup otvoren\u00fd, ako aj o protokole a (v pr\u00edpade tcp\/udp) portoch.<\/li>\n<\/ul>\n<p>\nTakisto by tam malo by\u0165 uveden\u00e9, <\/p>\n<ul>\n<li>popis, na \u010do sa tento pr\u00edstup otv\u00e1ra,<\/li>\n<li>do\u010dasn\u00fd alebo trval\u00fd (ak do\u010dasn\u00fd, tak do ak\u00e9ho d\u00e1tumu).<\/li>\n<\/ul>\n<p>\nA ve\u013emi d\u00f4le\u017eit\u00fd bod s\u00fa schv\u00e1lenia.<\/p>\n<ul>\n<li>od ved\u00faceho oddelenia, ktor\u00e9 iniciovalo pr\u00edstup (napr\u00edklad \u00fa\u010dtovn\u00edctva),<\/li>\n<li>od ved\u00faceho technick\u00e9ho oddelenia, odkia\u013e t\u00e1to po\u017eiadavka pri\u0161la do sie\u0165ov\u00e9ho oddelenia (napr\u00edklad helpdesk).<\/li>\n<\/ul>\n<p>\nV tomto pr\u00edpade je \u201evlastn\u00edkom\u201c tohto pr\u00edstupu ved\u00faci oddelenia, ktor\u00e9 pr\u00edstup iniciovalo (\u00fa\u010dtovn\u00edctvo v na\u0161om pr\u00edklade), a je zodpovedn\u00fd za to, aby str\u00e1nka so zaevidovan\u00fdmi pr\u00edstupmi pre toto oddelenie zostala aktu\u00e1lna.\n<\/p><\/blockquote>\n<p><\/p>\n<h2>Logovanie<\/h2>\n<p>\nTo je nie\u010do, v \u010dom sa d\u00e1 utopi\u0165. Ale ak chcete zavies\u0165 proakt\u00edvny pr\u00edstup, mus\u00edte sa nau\u010di\u0165 zvl\u00e1da\u0165 tento tok d\u00e1t.<\/p>\n<blockquote><p>Tu je nieko\u013eko praktick\u00fdch odpor\u00fa\u010dan\u00ed:<\/p>\n<ul>\n<li>prezerajte logy ka\u017ed\u00fd de\u0148.<\/li>\n<li>V pr\u00edpade pl\u00e1novan\u00e9ho prezerania (a nie havarijnej situ\u00e1cie) sa m\u00f4\u017eete obmedzi\u0165 na \u00farovne kritickosti (severity) 0, 1, 2 a prida\u0165 ob\u013e\u00faben\u00e9 vzory z in\u00fdch \u00farovn\u00ed, ak to pova\u017eujete za potrebn\u00e9.<\/li>\n<li>Nap\u00ed\u0161te skript, ktor\u00fd analyzuje logy a ignoruje tie logy, ktor\u00fdch vzory ste pridali do zoznamu ignorovan\u00fdch.<\/li>\n<\/ul>\n<p>\nTento pr\u00edstup \u010dasom umo\u017en\u00ed vytvori\u0165 zoznam ignorovan\u00fdch logov, ktor\u00e9 v\u00e1s nezauj\u00edmaj\u00fa, a necha\u0165 len tie, ktor\u00e9 pova\u017eujete za naozaj d\u00f4le\u017eit\u00e9.<br \/>\nU n\u00e1s to skvele fungovalo.<\/p><\/blockquote>\n<p><\/p>\n<h2>Monitorovanie<\/h2>\n<p>\nNie je nezvy\u010dajn\u00e9, ke\u010f v spolo\u010dnosti ch\u00fdba syst\u00e9m monitorovania. M\u00f4\u017eete sa napr\u00edklad spolieha\u0165 na logy, ale hardv\u00e9r m\u00f4\u017ee jednoducho \u201ezomrie\u0165\u201c, ani\u017e by stihol \u201epoveda\u0165\u201c nie\u010do, alebo m\u00f4\u017ee d\u00f4js\u0165 k strate udp paketov syslog protokolu a tieto sa nedostan\u00fa na cie\u013e. V ka\u017edom pr\u00edpade je akt\u00edvne monitorovanie d\u00f4le\u017eit\u00e9 a potrebn\u00e9.<\/p>\n<blockquote><p>Dva naj\u017eiadanej\u0161ie pr\u00edklady z mojej praxe:<\/p>\n<ul>\n<li>monitorovanie za\u0165a\u017eenia komunika\u010dn\u00fdch kan\u00e1lov, kritick\u00fdch liniek (napr\u00edklad pripojenie k poskytovate\u013eom). Umo\u017e\u0148uj\u00fa proakt\u00edvne odhali\u0165 potenci\u00e1lny probl\u00e9m degrad\u00e1cie slu\u017eby z d\u00f4vodu straty prev\u00e1dzky a t\u00fdm sa mu vyhn\u00fa\u0165.<\/li>\n<li>grafy vytvoren\u00e9 na z\u00e1klade NetFlow. Umo\u017e\u0148uj\u00fa \u013eahko n\u00e1js\u0165 anom\u00e1lie v prev\u00e1dzke a s\u00fa ve\u013emi u\u017eito\u010dn\u00e9 pri odha\u013eovan\u00ed ur\u010dit\u00fdch jednoduch\u00fdch, ale v\u00fdznamn\u00fdch typov hackersk\u00fdch \u00fatokov.<\/li>\n<\/ul>\n<\/blockquote>\n<p>\n<b>D\u00f4le\u017eit\u00e9! Nastavte sms upozornenia pre najkritickej\u0161ie udalosti. To plat\u00ed ako pre monitorovanie, tak aj pre logovanie. Ak nem\u00e1te pohotovostn\u00fa zmenu, mali by sms spr\u00e1vy prich\u00e1dza\u0165 aj mimo pracovn\u00e9ho \u010dasu. <\/b><\/p>\n<p>Premyslite proces tak, aby nebudi\u0165 v\u0161etk\u00fdch in\u017einierov. U n\u00e1s bol na tento \u00fa\u010del pohotovostn\u00fd in\u017einier.<\/p>\n<h2>Kontrola zmien<\/h2>\n<p>\nPod\u013ea m\u00f4jho n\u00e1zoru nie je nevyhnutn\u00e9 kontrolova\u0165 v\u0161etky zmeny. No v ka\u017edom pr\u00edpade by ste mali ma\u0165 mo\u017enos\u0165 \u013eahko zisti\u0165, kto a pre\u010do vykonal ur\u010dit\u00e9 zmeny v sieti, ak to bude potrebn\u00e9. <\/p>\n<blockquote><p>Nieko\u013eko r\u00e1d:<\/p>\n<ul>\n<li>pou\u017eite ticketov\u00fd syst\u00e9m na podrobn\u00e9 op\u00edsanie toho, \u010do bolo uroben\u00e9 v r\u00e1mci tohto ticketa, napr\u00edklad skop\u00edrovan\u00edm pou\u017eitej konfigur\u00e1cie do ticketa<\/li>\n<li>vyu\u017eite mo\u017enosti koment\u00e1rov na sie\u0165ovom zariaden\u00ed (napr\u00edklad commit comment na Juniper). M\u00f4\u017eete zaznamena\u0165 \u010d\u00edslo ticketa<\/li>\n<li>vyu\u017eite diff z\u00e1loh va\u0161ich konfigur\u00e1ci\u00ed<\/li>\n<\/ul>\n<p>\nM\u00f4\u017eete to zaradi\u0165 ako proces, ka\u017ed\u00fd de\u0148 prehliadaj\u00fac v\u0161etky tickety na zmeny.<\/p><\/blockquote>\n<p><\/p>\n<h2>Procesy<\/h2>\n<p>\nMus\u00edte formalizova\u0165 a pop\u00edsa\u0165 procesy vo va\u0161om t\u00edme. Ak ste sa dostali do tejto f\u00e1zy, vo va\u0161om t\u00edme by mali u\u017e fungova\u0165 aspo\u0148 nasleduj\u00face procesy:<\/p>\n<p>Denn\u00e9 procesy:<\/p>\n<ul>\n<li>pr\u00e1ca s tiketmi<\/li>\n<li>pr\u00e1ca s logmi<\/li>\n<li>kontrola zmien<\/li>\n<li>denn\u00fd kontroln\u00fd zoznam<\/li>\n<\/ul>\n<p>\nRo\u010dn\u00e9 procesy:<\/p>\n<ul>\n<li>predl\u017eovanie z\u00e1ruk, licenci\u00ed<\/li>\n<\/ul>\n<p>\nAsynchr\u00f3nne procesy:<\/p>\n<ul>\n<li>reakcia na r\u00f4zne havarijn\u00e9 situ\u00e1cie<\/li>\n<\/ul>\n<p><\/p>\n<h2>Zhrnutie prvej \u010dasti<\/h2>\n<p>\nV\u0161imli ste si, \u017ee zatia\u013e ide o nie\u010do, \u010do sa net\u00fdka konfigur\u00e1cie siete, dizajnu, sie\u0165ov\u00fdch protokolov, smerovania ani bezpe\u010dnosti... Je to nie\u010do okolo. Ale s\u00fa to mo\u017eno nudn\u00e9, no ur\u010dite ve\u013emi d\u00f4le\u017eit\u00e9 prvky fungovania sie\u0165ov\u00e9ho oddelenia. <\/p>\n<p>K\u00fdm, ako vid\u00edte, ste vo svojej sieti ni\u010d nezlep\u0161ili. Ak boli zranite\u013enosti v bezpe\u010dnosti, tak zostali, ak bol zl\u00fd dizajn, tak ten zostal. K\u00fdm ste nevyu\u017eili svoje zru\u010dnosti a vedomosti sie\u0165ov\u00e9ho in\u017einiera, na ktor\u00e9 ste pravdepodobne vynalo\u017eili ve\u013ea \u010dasu, \u00fasilia a niekedy aj pe\u0148az\u00ed. Ale najprv je potrebn\u00e9 vytvori\u0165 (alebo posilni\u0165) z\u00e1klad a potom sa pusti\u0165 do v\u00fdstavby.<\/p>\n<p>O tom, ako h\u013eada\u0165 a odstra\u0148ova\u0165 chyby, a potom aj zlep\u0161ova\u0165 va\u0161u infra\u0161trukt\u00faru \u2013 o tom bud\u00fa nasleduj\u00face \u010dasti.<\/p>\n<p>Samozrejme, nie je potrebn\u00e9 v\u0161etko robi\u0165 postupne. \u010cas m\u00f4\u017ee by\u0165 kritick\u00fd. Robte to paralelne, ak to umo\u017e\u0148uj\u00fa zdroje.<\/p>\n<p>A d\u00f4le\u017eit\u00e1 pozn\u00e1mka. Komunikujte, p\u00fdtajte sa, radte sa so svoj\u00edm t\u00edmom. Koniec koncov, pr\u00e1ve oni to v\u0161etko bud\u00fa podporova\u0165 a robi\u0165.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/433614\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0432\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412\u043f\u043e\u043b\u043d\u0435 \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e, \u0447\u0442\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u0433\u0434\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0441\u0435\u0442\u0438 \u0432 \u043e\u0434\u0438\u043d \u0447\u0430\u0441 \u0438\u043b\u0438 \u0434\u0430\u0436\u0435 \u043e\u0434\u0438\u043d \u0434\u0435\u043d\u044c \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u044b\u043c. \u041c\u043d\u0435, \u043a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e \u0438\u043b\u0438 \u043a \u0441\u0447\u0430\u0441\u0442\u044c\u044e, \u043d\u0435 \u0434\u043e\u0432\u0435\u043b\u043e\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0432 \u0442\u0430\u043a\u0438\u0445 \u043c\u0435\u0441\u0442\u0430\u0445. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31068","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0432\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u043f\u0435\u0440\u0432\u0430\u044f. \u0423\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0432\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:16+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:16+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ako vzia\u0165 sie\u0165ov\u00fa infra\u0161trukt\u00faru pod svoj kontrolu. Kapitola prv\u00e1. Udr\u017eanie | ProHoster","description":"Tento \u010dl\u00e1nok je prv\u00fd v cykle \u010dl\u00e1nkov \"Ako vzia\u0165 sie\u0165ov\u00fa infra\u0161trukt\u00faru pod svoj kontrolu\".","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u043f\u0435\u0440\u0432\u0430\u044f. \u0423\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0432\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-pervaya-uderzhanie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:16+00:00","article:modified_time":"2019-10-31T18:39:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31068","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:23:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:13","updated":"2026-01-21 04:23:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31068","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31068"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31068\/revisions"}],"predecessor-version":[{"id":164546,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31068\/revisions\/164546"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31068"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31068"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31068"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}