{"id":31890,"date":"2019-10-31T21:43:45","date_gmt":"2019-10-31T18:43:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mandatnaya-model-raspredeleniya-prav-v-freebsd\/"},"modified":"2019-10-31T21:43:45","modified_gmt":"2019-10-31T18:43:45","slug":"mandatnaya-model-raspredeleniya-prav-v-freebsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","title":{"rendered":"Mand\u00e1tov\u00fd model rozdelenia pr\u00e1v vo FreeBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00davod<\/h2>\n

Na zabezpe\u010denie \u010fal\u0161ej \u00farovne bezpe\u010dnosti servera je mo\u017en\u00e9 pou\u017ei\u0165 mand\u00e1tov\u00fd model<\/a><\/noindex> distrib\u00facie pr\u00edstupu. V tomto \u010dl\u00e1nku bude op\u00edsan\u00e9, ako je mo\u017en\u00e9 sp\u00fa\u0161\u0165a\u0165 apache v jail s pr\u00edstupom len k t\u00fdm komponentom, ku ktor\u00fdm je potrebn\u00fd pr\u00edstup na korektn\u00fa pr\u00e1cu apache a php. Na tento princ\u00edp je mo\u017en\u00e9 obmedzi\u0165 nielen apache, ale aj ak\u00fdko\u013evek in\u00fd stack.
\n<\/a><\/noindex><\/p>\n

Pr\u00edprava<\/h2>\n

T\u00e1to met\u00f3da je vhodn\u00e1 len pre s\u00faborov\u00fd syst\u00e9m ufs, v tomto pr\u00edklade bude v hlavnom syst\u00e9me pou\u017eit\u00fd zfs a v jail pr\u00edslu\u0161ne ufs. Najprv je potrebn\u00e9 prekompilova\u0165 jadro, pri in\u0161tal\u00e1cii FreeBSD si nain\u0161talujte zdrojov\u00fd k\u00f3d.
\nPo tom, ako bude syst\u00e9m nain\u0161talovan\u00fd, editujte s\u00fabor:<\/p>\n

\/usr\/src\/sys\/amd64\/conf\/GENERIC\n<\/code><\/pre>\n
Do tohto s\u00faboru je potrebn\u00e9 prida\u0165 len jeden riadok:<\/p>\n
options     MAC_MLS\n<\/code><\/pre>\n
\u0160t\u00edtok mls\/high bude ma\u0165 dominuj\u00face postavenie nad \u0161t\u00edtkom mls\/low, aplik\u00e1cie, ktor\u00e9 bud\u00fa spusten\u00e9 so \u0161t\u00edtkom mls\/low, sa nebud\u00fa m\u00f4c\u0165 dosta\u0165 k s\u00faborom, ktor\u00e9 maj\u00fa \u0161t\u00edtok mls\/high. Podrobnej\u0161ie inform\u00e1cie o v\u0161etk\u00fdch dostupn\u00fdch \u0161t\u00edtkoch v syst\u00e9me FreeBSD si m\u00f4\u017eete pre\u010d\u00edta\u0165 v tomto pr\u00edru\u010dke<\/a><\/noindex>.
\n\u010ealej prejdite do adres\u00e1ra \/usr\/src:<\/p>\n
cd \/usr\/src\n<\/code><\/pre>\n
Na spustenie zostavenia jadra vykonajte (v k\u013e\u00fa\u010di j uve\u010fte po\u010det jadier v syst\u00e9me):<\/p>\n
make -j 4 buildkernel KERNCONF=GENERIC\n<\/code><\/pre>\n
Po tom, ako bude jadro zostaven\u00e9, je potrebn\u00e9 ho nain\u0161talova\u0165:<\/p>\n
make installkernel KERNCONF=GENERIC\n<\/code><\/pre>\n
Po in\u0161tal\u00e1cii jadra sa nepok\u00fa\u0161ajte ihne\u010f re\u0161tartova\u0165 syst\u00e9m, preto\u017ee je potrebn\u00e9 prelo\u017ei\u0165 pou\u017e\u00edvate\u013eov do prihlasovacej triedy, predt\u00fdm ju nastavte. Editujte s\u00fabor \/etc\/login.conf, v tomto s\u00fabore je potrebn\u00e9 editova\u0165 prihlasovaciu triedu default a upravi\u0165 ju na:<\/p>\n
default:\n        :passwd_format=sha512:\n        :copyright=\/etc\/COPYRIGHT:\n        :welcome=\/etc\/motd:\n        :setenv=MAIL=\/var\/mail\/$,BLOCKSIZE=K:\n        :path=\/sbin \/bin \/usr\/sbin \/usr\/bin \/usr\/local\/sbin \/usr\/local\/bin ~\/bin:\n        :nologin=\/var\/run\/nologin:\n        :cputime=unlimited:\n        :datasize=unlimited:\n        :stacksize=unlimited:\n        :memorylocked=64K:\n        :memoryuse=unlimited:\n        :filesize=unlimited:\n        :coredumpsize=unlimited:\n        :openfiles=unlimited:\n        :maxproc=unlimited:\n        :sbsize=unlimited:\n        :vmemoryuse=unlimited:\n        :swapuse=unlimited:\n        :pseudoterminals=unlimited:\n        :kqueues=unlimited:\n        :umtxp=unlimited:\n        :priority=0:\n        :ignoretime@:\n        :umask=022:\n        :label=mls\/equal:\n<\/code><\/pre>\n
Riadok :label=mls\/equal umo\u017en\u00ed pou\u017e\u00edvate\u013eom, ktor\u00ed s\u00fa v tejto triede, z\u00edska\u0165 pr\u00edstup k s\u00faborom, ktor\u00e9 s\u00fa ozna\u010den\u00e9 ak\u00fdmko\u013evek \u0161t\u00edtkom (mls\/low, mls\/high). Po t\u00fdchto manipul\u00e1ci\u00e1ch je potrebn\u00e9 prekompilova\u0165 datab\u00e1zu a prenies\u0165 pou\u017e\u00edvate\u013ea root (ako aj t\u00fdch, ktor\u00fdm je to potrebn\u00e9) do tejto prihlasovacej triedy:<\/p>\n
cap_mkdb \/etc\/login.conf\npw usermod root -L default\n<\/code><\/pre>\n
Aby t\u00e1to politika platila iba pre s\u00fabory, je potrebn\u00e9 upravi\u0165 s\u00fabor \/etc\/mac.conf a ponecha\u0165 v \u0148om iba jeden riadok:<\/p>\n
default_labels file ?mls\n<\/code><\/pre>\n
Je tie\u017e potrebn\u00e9 prida\u0165 modul mac_mls.ko do automatick\u00e9ho sp\u00fa\u0161\u0165ania:<\/p>\n
echo 'mac_mls_load=\"YES\"' >> \/boot\/loader.conf\n<\/code><\/pre>\n
Po tom m\u00f4\u017eete bezstarostne re\u0161tartova\u0165 syst\u00e9m. Ako vytvori\u0165 jail<\/a><\/noindex> si m\u00f4\u017eete pre\u010d\u00edta\u0165 v jednom z m\u00fdch publik\u00e1ci\u00ed. Ale predt\u00fdm, ako vytvor\u00edte jail, je potrebn\u00e9 prida\u0165 pr\u00edsny disk a vytvori\u0165 na \u0148om s\u00faborov\u00fd syst\u00e9m a povoli\u0165 multilabel, vytvorte s\u00faborov\u00fd syst\u00e9m ufs2 s ve\u013ekos\u0165ou bloku 64kb:<\/p>\n
newfs -O 2 -b 64kb \/dev\/ada1\ntunefs -l enable \/dev\/ada1\n<\/code><\/pre>\n
Po vytvoren\u00ed s\u00faborov\u00e9ho syst\u00e9mu a pridan\u00ed multilabel je potrebn\u00e9 prida\u0165 pr\u00edsny disk do \/etc\/fstab, pridajte riadok do tohto s\u00faboru:<\/p>\n
\/dev\/ada1               \/jail  ufs     rw              0       1\n<\/code><\/pre>\n
V Mountpoint uve\u010fte adres\u00e1r, do ktor\u00e9ho budete montova\u0165 pr\u00edsny disk, v Pass ur\u010dite uve\u010fte 1 (v akej sekvencii sa bude kontrolova\u0165 tento pr\u00edsny disk) \u2014 to je potrebn\u00e9, preto\u017ee s\u00faborov\u00fd syst\u00e9m ufs je citliv\u00fd na n\u00e1hle v\u00fdpadky nap\u00e1jania. Po t\u00fdchto krokoch namontujte disk:<\/p>\n
mount \/dev\/ada1 \/jail\n<\/code><\/pre>\n
Do tohto adres\u00e1ra nain\u0161talujte jail. Po tom, ako jail za\u010dne fungova\u0165, je potrebn\u00e9 vykona\u0165 v \u0148om rovnak\u00e9 \u00fakony, ako v hlavnom syst\u00e9me s pou\u017e\u00edvate\u013emi a s\u00fabormi \/etc\/login.conf, \/etc\/mac.conf. <\/p>\n
Nastavenie<\/h2>\n
Predt\u00fdm, ako nastav\u00edte potrebn\u00e9 zna\u010dky, odpor\u00fa\u010dam nain\u0161talova\u0165 v\u0161etky potrebn\u00e9 bal\u00edky, v mojom pr\u00edpade bud\u00fa zna\u010dky nastaven\u00e9 so zoh\u013eadnen\u00edm t\u00fdchto bal\u00edkov:<\/p>\n
mod_php73-7.3.4_1              PHP Skriptovac\u00ed jazyk\nphp73-7.3.4_1                  PHP Skriptovac\u00ed jazyk\nphp73-ctype-7.3.4_1            Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed ctype pro php\nphp73-curl-7.3.4_1             Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed curl pro php\nphp73-dom-7.3.4_1              Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed dom pro php\nphp73-extensions-1.0           \"meta-port\" pro instalaci PHP roz\u0161\u00ed\u0159en\u00ed\nphp73-filter-7.3.4_1           Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed filter pro php\nphp73-gd-7.3.4_1               Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed gd pro php\nphp73-gettext-7.3.4_1          Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed gettext pro php\nphp73-hash-7.3.4_1             Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed hash pro php\nphp73-iconv-7.3.4_1            Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed iconv pro php\nphp73-json-7.3.4_1             Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed json pro php\nphp73-mysqli-7.3.4_1           Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed mysqli pro php\nphp73-opcache-7.3.4_1          Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed opcache pro php\nphp73-openssl-7.3.4_1          Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed openssl pro php\nphp73-pdo-7.3.4_1              Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed pdo pro php\nphp73-pdo_sqlite-7.3.4_1       Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed pdo_sqlite pro php\nphp73-phar-7.3.4_1             Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed phar pro php\nphp73-posix-7.3.4_1            Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed posix pro php\nphp73-session-7.3.4_1          Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed session pro php\nphp73-simplexml-7.3.4_1        Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed simplexml pro php\nphp73-sqlite3-7.3.4_1          Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed sqlite3 pro php\nphp73-tokenizer-7.3.4_1        Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed tokenizer pro php\nphp73-xml-7.3.4_1              Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed xml pro php\nphp73-xmlreader-7.3.4_1        Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed xmlreader pro php\nphp73-xmlrpc-7.3.4_1           Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed xmlrpc pro php\nphp73-xmlwriter-7.3.4_1        Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed xmlwriter pro php\nphp73-xsl-7.3.4_1              Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed xsl pro php\nphp73-zip-7.3.4_1              Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed zip pro php\nphp73-zlib-7.3.4_1             Sd\u00edlen\u00e9 roz\u0161\u00ed\u0159en\u00ed zlib pro php\napache24-2.4.39 \n<\/code><\/pre>\n
V tomto p\u0159\u00edkladu budou \u0161t\u00edtky nastaveny s ohledem na z\u00e1vislosti dan\u00fdch bal\u00ed\u010dk\u016f. M\u016f\u017eete to samoz\u0159ejm\u011b ud\u011blat jednodu\u0161eji, nastavit \u0161t\u00edtky mls\/low pro adres\u00e1\u0159 \/usr\/local\/lib a soubory, kter\u00e9 se nach\u00e1zej\u00ed v tomto adres\u00e1\u0159i, ale mysl\u00edm, \u017ee je lep\u0161\u00ed poskytnout p\u0159\u00edstup pouze k t\u011bm soubor\u016fm, kter\u00e9 jsou nezbytn\u00e9. Zastavte jail a nastavte \u0161t\u00edtky mls\/high pro v\u0161echny soubory:<\/p>\n
setfmac -R mls\/high \/jail\n<\/code><\/pre>\n
P\u0159i nastavov\u00e1n\u00ed \u0161t\u00edtk\u016f se proces zastav\u00ed, pokud se setfmac setk\u00e1 s tvrd\u00fdmi odkazy; v m\u00e9m p\u0159\u00edkladu jsem odstra\u0148oval tvrd\u00e9 odkazy v n\u00e1sleduj\u00edc\u00edch adres\u00e1\u0159\u00edch:<\/p>\n
\/var\/db\/etcupdate\/current\/\n\/var\/db\/etcupdate\/current\/etc\n\/var\/db\/etcupdate\/current\/usr\/share\/openssl\/man\/en.ISO8859-15\n\/var\/db\/etcupdate\/current\/usr\/share\/man\/en.ISO8859-15\n\/var\/db\/etcupdate\/current\/usr\/share\/man\/en.UTF-8\n\/var\/db\/etcupdate\/current\/usr\/share\/nls\n\/etc\/ssl\n\/usr\/local\/etc\n\/usr\/local\/etc\/fonts\/conf.d\n\/usr\/local\/openssl\n<\/code><\/pre>\n
Po nastavov\u00e1n\u00ed \u0161t\u00edtk\u016f je nutn\u00e9 nastavit \u0161t\u00edtky mls\/low pro apache, nejprve je pot\u0159eba zjistit, kter\u00e9 soubory jsou nezbytn\u00e9 pro spu\u0161t\u011bn\u00ed apache:<\/p>\n
ldd \/usr\/local\/sbin\/httpd\n<\/code><\/pre>\n
Po vykonan\u00ed tejto pr\u00edkazovej sekvencie sa na obrazovke zobrazia z\u00e1vislosti, ale na pre dan\u00e9 s\u00fabory bude potrebn\u00e9 nastavi\u0165 po\u017eadovan\u00e9 zna\u010dky, preto\u017ee adres\u00e1re, v ktor\u00fdch sa tieto s\u00fabory nach\u00e1dzaj\u00fa, maj\u00fa zna\u010dku mls\/high, a preto je potrebn\u00e9 nastavi\u0165 zna\u010dku mls\/low aj pre tieto adres\u00e1re. Pri spusten\u00ed apache sa tie\u017e zobrazia s\u00fabory potrebn\u00e9 na jeho spustenie, a pre php je mo\u017en\u00e9 tieto z\u00e1vislosti zisti\u0165 v logu httpd-error.log.<\/p>\n
setfmac mls\/low \/\nsetfmac mls\/low \/usr\/local\/lib\/libpcre.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libaprutil-1.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libdb-5.3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libgdbm.so.6\nsetfmac mls\/low \/usr\/local\/lib\/libexpat.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libapr-1.so.0\nsetfmac mls\/low \/lib\/libcrypt.so.5\nsetfmac mls\/low \/lib\/libthr.so.3\nsetfmac mls\/low \/lib\/libc.so.7\nsetfmac mls\/low \/usr\/local\/lib\/libintl.so.8\nsetfmac mls\/low \/var\nsetfmac mls\/low \/var\/run\nsetfmac mls\/low \/var\/log\nsetfmac mls\/low \/var\/log\/httpd-access.log\nsetfmac mls\/low \/var\/log\/httpd-error.log\nsetfmac mls\/low \/var\/run\/httpd.pid\nsetfmac mls\/low \/lib\nsetfmac mls\/low \/lib\/libcrypt.so.5\nsetfmac mls\/low \/usr\/local\/lib\/db5\/libdb-5.3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/db5\/libdb-5.3.so.0.0.0\nsetfmac mls\/low \/usr\/local\/lib\/db5\nsetfmac mls\/low \/usr\/local\/lib\nsetfmac mls\/low \/libexec\nsetfmac mls\/low \/libexec\/ld-elf.so.1\nsetfmac  mls\/low \/dev\nsetfmac  mls\/low \/dev\/random\nsetfmac  mls\/low \/usr\/local\/libexec\nsetfmac  mls\/low \/usr\/local\/libexec\/apache24\nsetfmac  mls\/low \/usr\/local\/libexec\/apache24\/*\nsetfmac  mls\/low \/etc\/pwd.db\nsetfmac  mls\/low \/etc\/passwd\nsetfmac  mls\/low \/etc\/group\nsetfmac  mls\/low \/etc\/\nsetfmac  mls\/low \/usr\/local\/etc\nsetfmac -R mls\/low \/usr\/local\/etc\/apache24\nsetfmac mls\/low \/usr\nsetfmac mls\/low \/usr\/local\nsetfmac mls\/low \/usr\/local\/sbin\nsetfmac mls\/low \/usr\/local\/sbin\/*\nsetfmac -R mls\/low \/usr\/local\/etc\/rc.d\/\nsetfmac mls\/low \/usr\/local\/sbin\/htcacheclean\nsetfmac mls\/low \/var\/log\/httpd-access.log\nsetfmac mls\/low \/var\/log\/httpd-error.log\nsetfmac -R mls\/low \/usr\/local\/www\nsetfmac mls\/low \/usr\/lib\nsetfmac mls\/low \/tmp\nsetfmac -R mls\/low \/usr\/local\/lib\/php\nsetfmac -R mls\/low \/usr\/local\/etc\/php\nsetfmac mls\/low \/usr\/local\/etc\/php.conf\nsetfmac mls\/low \/lib\/libelf.so.2\nsetfmac mls\/low \/lib\/libm.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libxml2.so.2\nsetfmac mls\/low \/lib\/libz.so.6\nsetfmac mls\/low \/usr\/lib\/liblzma.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libiconv.so.2\nsetfmac mls\/low \/usr\/lib\/librt.so.1\nsetfmac mls\/low \/lib\/libthr.so.3\nsetfmac mls\/low \/usr\/local\/lib\/libpng16.so.16\nsetfmac mls\/low \/usr\/lib\/libbz2.so.4\nsetfmac mls\/low \/usr\/local\/lib\/libargon2.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libpcre2-8.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libsqlite3.so.0\nsetfmac mls\/low \/usr\/local\/lib\/libgd.so.6\nsetfmac mls\/low \/usr\/local\/lib\/libjpeg.so.8\nsetfmac mls\/low \/usr\/local\/lib\/libfreetype.so\nsetfmac mls\/low \/usr\/local\/lib\/libfontconfig.so.1\nsetfmac mls\/low \/usr\/local\/lib\/libtiff.so.5\nsetfmac mls\/low \/usr\/local\/lib\/libwebp.so.7\nsetfmac mls\/low \/usr\/local\/lib\/libjbig.so.2\nsetfmac mls\/low \/usr\/lib\/libssl.so.8\nsetfmac mls\/low \/lib\/libcrypto.so.8\nsetfmac mls\/low \/usr\/local\/lib\/libzip.so.5\nsetfmac mls\/low \/etc\/resolv.conf\n<\/code><\/pre>\n
V tomto zozname sa nastavuj\u00fa zna\u010dky mls\/low na v\u0161etky s\u00fabory, ktor\u00e9 s\u00fa nevyhnutn\u00e9 pre spr\u00e1vnu funkciu v\u00e4zby medzi apache a php (pre tie bal\u00ed\u010dky, ktor\u00e9 s\u00fa nain\u0161talovan\u00e9 v mojom pr\u00edklade).<\/p>\n
Posledn\u00fdm krokom bude nastavenie spustenia jail na \u00farovni mls\/equal a apache na \u00farovni mls\/low. Na spustenie jail je potrebn\u00e9 vykona\u0165 zmeny v skripte \/etc\/rc.d\/jail, n\u00e1jdite v tomto skripte funkcie jail_start a premenn\u00fa command upravte na nasleduj\u00facu podobu:<\/p>\n
command=\"setpmac mls\/equal $jail_program\"\n<\/code><\/pre>\n
Pr\u00edkaz setpmac sp\u00fa\u0161\u0165a vykonate\u013en\u00fd s\u00fabor na potrebnej mand\u00e1tnej \u00farovni, v tomto pr\u00edpade mls\/equal, aby mal pr\u00edstup ku v\u0161etk\u00fdm ozna\u010deniam. V apache je potrebn\u00e9 upravi\u0165 \u0161tartovac\u00ed skript \/usr\/local\/etc\/rc.d\/apache24. Urobte zmeny vo funkcii apache24_prestart:<\/p>\n
apache24_prestart() {\n        apache24_checkfib\n        apache24_precmd\n        eval \"setpmac mls\/low\" ${command} ${apache24_flags}\n}\n<\/code><\/pre>\n
V ofici\u00e1lnom<\/a><\/noindex> V pr\u00edru\u010dke je uveden\u00fd in\u00fd pr\u00edklad, ale nemohol som ho pou\u017ei\u0165, preto\u017ee som neust\u00e1le dost\u00e1val spr\u00e1vu o nemo\u017enosti pou\u017ei\u0165 pr\u00edkaz setpmac.<\/p>\n
Z\u00e1ver<\/h2>\n
Tento sp\u00f4sob distrib\u00facie pr\u00edstupu prid\u00e1 \u010fal\u0161iu \u00farove\u0148 ochrany apache (aj ke\u010f tento pr\u00edstup je vhodn\u00fd pre ak\u00fdko\u013evek in\u00fd stack), ktor\u00fd sa navy\u0161e sp\u00fa\u0161\u0165a v jail, zatia\u013e \u010do pre spr\u00e1vcu sa to v\u0161etko bude dia\u0165 prieh\u013eadne a nevidite\u013ene.<\/p>\n
Zoznam zdrojov, ktor\u00e9 mi pomohli pri p\u00edsan\u00ed tejto publik\u00e1cie:<\/b><\/p>\n
https:\/\/www.freebsd.org\/doc\/ru_RU.KOI8-R\/books\/handbook\/mac.html<\/a><\/noindex>
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0430\u043d\u0434\u0430\u0442\u043d\u0443\u044e \u043c\u043e\u0434\u0435\u043b\u044c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430. \u0412 \u0434\u0430\u043d\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0431\u0443\u0434\u0435\u0442 \u043e\u043f\u0438\u0441\u0430\u043d\u043e \u043a\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c apache \u0432 jail \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0442\u0435\u043c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u0434\u043b\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b apache \u0438 php. \u041f\u043e \u0434\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0443 \u043c\u043e\u0436\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e apache, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043b\u044e\u0431\u043e\u0439 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u044d\u043a. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31890","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mand\u00e1tna model distrib\u00facie pr\u00e1v v FreeBSD | ProHoster","description":"\u00davod Pre zaistenie \u010fal\u0161ej \u00farovne bezpe\u010dnosti servera je mo\u017en\u00e9 pou\u017ei\u0165","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u0430\u043d\u0434\u0430\u0442\u043d\u0430\u044f \u043c\u043e\u0434\u0435\u043b\u044c \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432 \u0432 FreeBSD | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/mandatnaya-model-raspredeleniya-prav-v-freebsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:43:45+00:00","article:modified_time":"2019-10-31T18:43:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31890","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 08:18:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:09:26","updated":"2026-01-21 08:18:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31890"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31890\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}