{"id":85141,"date":"2020-06-13T13:42:24","date_gmt":"2020-06-13T11:42:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki"},"modified":"2020-06-13T13:42:24","modified_gmt":"2020-06-13T11:42:24","slug":"chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","title":{"rendered":"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506334\/\"><img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/867a0b09b6e2b2676e520a16cee0148d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><i>kdpv \u2014 Reuters<\/i><\/p>\n<p>Ak ste si prenajali server, nem\u00e1te nad n\u00edm pln\u00fa kontrolu. To znamen\u00e1, \u017ee v ktoromko\u013evek momente m\u00f4\u017eu k poskytovate\u013eovi hostingu pr\u00eds\u0165 \u0161peci\u00e1lne vy\u0161kolen\u00ed \u013eudia a po\u017eiada\u0165 o poskytnutie ak\u00fdchko\u013evek va\u0161ich \u00fadajov. A poskytovate\u013e hostingu ich odovzd\u00e1, ak bude po\u017eiadavka spr\u00e1vne formulovan\u00e1 pod\u013ea z\u00e1kona. <\/p>\n<p>Ve\u013emi by ste nechceli, aby sa logy v\u00e1\u0161ho webov\u00e9ho servera alebo \u00fadaje pou\u017e\u00edvate\u013eov dostali k niekomu in\u00e9mu. Ide\u00e1lnu ochranu nie je mo\u017en\u00e9 postavi\u0165. Ochrana pred poskytovate\u013eom hostingu, ktor\u00fd vlastn\u00ed hyperv\u00edzor a poskytuje v\u00e1m virtu\u00e1lny stroj, je prakticky nemo\u017en\u00e1. Ale mo\u017eno sa podar\u00ed trochu zn\u00ed\u017ei\u0165 rizik\u00e1. \u0160ifrovanie prenajat\u00fdch strojov nie je tak bezn\u00e1dejne zbyto\u010dn\u00e9, ako sa zd\u00e1 na prv\u00fd poh\u013ead. Z\u00e1rove\u0148 sa pozrieme na hrozby vy\u0165a\u017eenia \u00fadajov z fyzick\u00fdch serverov.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Model hrozieb<\/h2>\n<p>\nZvy\u010dajne sa poskytovate\u013e hostingu sna\u017e\u00ed maxim\u00e1lne chr\u00e1ni\u0165 z\u00e1ujmy klienta, pokia\u013e je to pod\u013ea z\u00e1kona mo\u017en\u00e9. Ak v liste od ofici\u00e1lnych org\u00e1nov po\u017eaduj\u00fa len logy pr\u00edstupu, poskytovate\u013e hostingu neodovzd\u00e1 z\u00e1lohy v\u0161etk\u00fdch va\u0161ich virtu\u00e1lnych strojov s datab\u00e1zami. Nemal by, aspo\u0148. Ak po\u017eaduj\u00fa \u00faplne v\u0161etky \u00fadaje, poskytovate\u013e hostingu skop\u00edruje virtu\u00e1lne disky so v\u0161etk\u00fdmi s\u00fabormi a vy o tom nebudete vedie\u0165.<\/p>\n<p>Bez oh\u013eadu na scen\u00e1r v\u00fdvoja udalost\u00ed je va\u0161ou hlavnou \u00falohou urobi\u0165 \u00fatok pr\u00edli\u0161 zlo\u017eit\u00fdm a drah\u00fdm. Zvy\u010dajne existuj\u00fa tri hlavn\u00e9 varianty hrozby.<\/p>\n<h2>Ofici\u00e1lny<\/h2>\n<p>\nNaj\u010dastej\u0161ie do ofici\u00e1lnych priestorov poskytovate\u013ea hostingu zasielaj\u00fa papierov\u00fd list s po\u017eiadavkou poskytn\u00fa\u0165 potrebn\u00e9 \u00fadaje pod\u013ea pr\u00edslu\u0161n\u00e9ho predpisu. Ak je v\u0161etko spr\u00e1vne vyplnen\u00e9, poskytovate\u013e hostingu odovzd\u00e1 potrebn\u00e9 logy pr\u00edstupu a in\u00e9 \u00fadaje ofici\u00e1lnym org\u00e1nom. Zvy\u010dajne jednoducho po\u017eaduj\u00fa zasla\u0165 potrebn\u00e9 \u00fadaje.<\/p>\n<p>Ob\u010das, ak je to naozaj potrebn\u00e9, pr\u00eddu z\u00e1stupcovia org\u00e1nov \u010dinn\u00fdch v trestnom konan\u00ed osobne do d\u00e1tov\u00e9ho centra. Napr\u00edklad, ke\u010f m\u00e1te svoj vlastn\u00fd dedikovan\u00fd server a \u00fadaje odtia\u013e mo\u017eno z\u00edska\u0165 len fyzicky.<\/p>\n<p>Vo v\u0161etk\u00fdch krajin\u00e1ch je na z\u00edskanie pr\u00edstupu na s\u00fakromn\u00e9 \u00fazemie, vykonanie prehliadky a in\u00e9 aktivity potrebn\u00e9 preuk\u00e1za\u0165, \u017ee tieto \u00fadaje m\u00f4\u017eu obsahova\u0165 d\u00f4le\u017eit\u00e9 inform\u00e1cie pre vy\u0161etrovanie trestn\u00e9ho \u010dinu. Okrem toho je potrebn\u00fd s\u00fadny pr\u00edkaz na prehliadku, ktor\u00fd mus\u00ed by\u0165 vyhotoven\u00fd v s\u00falade so v\u0161etk\u00fdmi predpismi. M\u00f4\u017eu tu by\u0165 nuansy spojen\u00e9 s osobitos\u0165ami miestneho z\u00e1konodarstva. Hlavn\u00e9, \u010do treba pochopi\u0165 \u2013 v pr\u00edpade spr\u00e1vneho ofici\u00e1lneho postupu z\u00e1stupcovia d\u00e1tov\u00e9ho centra nikoho \u010falej nepustia.<\/p>\n<p>Navy\u0161e, vo v\u00e4\u010d\u0161ine kraj\u00edn nie je mo\u017en\u00e9 len tak vzia\u0165 a odobra\u0165 funguj\u00face vybavenie. Napr\u00edklad v Rusku do konca roka 2018, pod\u013ea \u010dl\u00e1nku 183 Trestn\u00e9ho poriadku Ruskej feder\u00e1cie, \u010das\u0165 3.1, sa garantovalo, \u017ee pri v\u00fdrobe odoberania, sa odobratie elektronick\u00fdch nosi\u010dov inform\u00e1ci\u00ed vykon\u00e1va s \u00fa\u010das\u0165ou odborn\u00edka. Na z\u00e1klade \u017eiadosti z\u00e1konn\u00e9ho vlastn\u00edka odoberan\u00fdch elektronick\u00fdch nosi\u010dov inform\u00e1ci\u00ed alebo vlastn\u00edka obsahu t\u00fdchto inform\u00e1ci\u00ed sa odborn\u00edk, ktor\u00fd sa z\u00fa\u010dastnil na odoberan\u00ed, v pr\u00edtomnosti svedkov z odoberan\u00fdch elektronick\u00fdch nosi\u010dov inform\u00e1ci\u00ed asistuje pri kop\u00edrovan\u00ed inform\u00e1ci\u00ed na in\u00e9 elektronick\u00e9 nosi\u010de inform\u00e1ci\u00ed.<\/p>\n<p>Potom, \u017eia\u013e, tento bod z \u010dl\u00e1nku odstr\u00e1nili.<\/p>\n<h2>Tajn\u00fd a neofici\u00e1lny<\/h2>\n<p>\nTo u\u017e je \u00fazemie \u010dinnosti \u0161peci\u00e1lne \u0161kolen\u00fdch pracovn\u00edkov z NSA, FBI, MI5 a in\u00fdch trojp\u00edsmenov\u00fdch organiz\u00e1ci\u00ed. Naj\u010dastej\u0161ie pr\u00e1vo kraj\u00edn predpoklad\u00e1 mimoriadne \u0161irok\u00e9 pr\u00e1vomoci pre podobn\u00e9 \u0161trukt\u00fary. Navy\u0161e takmer v\u017edy existuje legislat\u00edvny z\u00e1kaz na ak\u00e9ko\u013evek priame a nepriame zverejnenie samotn\u00e9ho faktu spolupr\u00e1ce s tak\u00fdmi silov\u00fdmi org\u00e1nmi. V Rusku existuj\u00fa anal\u00f3gie <noindex><a rel=\"nofollow\" href=\"http:\/\/publication.pravo.gov.ru\/Document\/View\/0001201801220009?index=3&amp;rangeSize=1\">pr\u00e1vne normy<\/a><\/noindex>.<\/p>\n<p>V pr\u00edpade takejto hrozby va\u0161im \u00fadajom ich takmer ur\u010dite vyber\u00fa. Okrem jednoduch\u00e9ho odobratie m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 v\u0161etky neofici\u00e1lne prostriedky, ako s\u00fa zadn\u00e9 vr\u00e1tka, zranite\u013enosti s nulov\u00fdm d\u0148om, extrakcia \u00fadajov z opera\u010dnej pam\u00e4te va\u0161ej virtu\u00e1lnej ma\u0161iny a in\u00e9 radosti. Poskytovate\u013e slu\u017eieb bude pritom povinn\u00fd maximalizova\u0165 pomoc odborn\u00edkom z silov\u00fdch \u0161trukt\u00far.<\/p>\n<h2>Ned\u00f4veryhodn\u00fd zamestnanec<\/h2>\n<p>\nNie v\u0161etci s\u00fa \u013eudia rovnako dobr\u00ed. Niektor\u00ed z adminov d\u00e1tov\u00fdch centier m\u00f4\u017eu ma\u0165 z\u00e1ujem privyrobi\u0165 si a preda\u0165 va\u0161e d\u00e1ta. \u010eal\u0161\u00ed v\u00fdvoj situ\u00e1cie z\u00e1vis\u00ed od jeho opr\u00e1vnen\u00ed a pr\u00edstupov. Najnepr\u00edjemnej\u0161ie je, \u017ee administr\u00e1tor s pr\u00edstupom k virtualiza\u010dnej konzole m\u00e1 pln\u00fa kontrolu nad va\u0161imi strojmi. V\u017edy je mo\u017en\u00e9 vytvori\u0165 snapshot spolu so v\u0161etk\u00fdm obsahom opera\u010dnej pam\u00e4te a potom ho pomaly sk\u00fama\u0165.<\/p>\n<h2>VDS<\/h2>\n<p>\nTak\u017ee m\u00e1te virtu\u00e1lny stroj, ktor\u00fd v\u00e1m poskytol hostite\u013e. Ako m\u00f4\u017eete zabezpe\u010di\u0165 \u0161ifrovanie, aby ste sa ochr\u00e1nili? V skuto\u010dnosti, takmer nijako. Viac, dokonca aj cudz\u00ed dedikovan\u00fd server sa nakoniec m\u00f4\u017ee uk\u00e1za\u0165 ako virtu\u00e1lny stroj, do ktor\u00e9ho s\u00fa nasmerovan\u00e9 potrebn\u00e9 zariadenia.<\/p>\n<p>Ak \u00falohou vzdialen\u00e9ho syst\u00e9mu nie je len uchov\u00e1vanie d\u00e1t, ale aj vykon\u00e1vanie nejak\u00fdch v\u00fdpo\u010dtov, jedinou mo\u017enos\u0165ou, ako pracova\u0165 s ned\u00f4veryhodn\u00fdm strojom, bude realiz\u00e1cia <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/%D0%9F%D0%BE%D0%BB%D0%BD%D0%BE%D1%81%D1%82%D1%8C%D1%8E_%D0%B3%D0%BE%D0%BC%D0%BE%D0%BC%D0%BE%D1%80%D1%84%D0%BD%D0%BE%D0%B5_%D1%88%D0%B8%D1%84%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5\">homomorfn\u00e9ho \u0161ifrovania<\/a><\/noindex>. Pri tomto syst\u00e9me sa bud\u00fa vykon\u00e1va\u0165 v\u00fdpo\u010dty bez mo\u017enosti porozumie\u0165, \u010do presne rob\u00ed. \u017dia\u013e, n\u00e1klady na realiz\u00e1ciu tak\u00e9ho \u0161ifrovania s\u00fa tak vysok\u00e9, \u017ee praktick\u00e9 pou\u017eitie je v s\u00fa\u010dasnosti obmedzen\u00e9 na ve\u013emi \u00fazke \u00falohy.<\/p>\n<p>Navy\u0161e, v momente, ke\u010f je virtu\u00e1lny stroj zapnut\u00fd a vykon\u00e1va nejak\u00e9 akcie, v\u0161etky za\u0161ifrovan\u00e9 objemy s\u00fa v pr\u00edstupnom stave, inak by opera\u010dn\u00fd syst\u00e9m jednoducho nemohol s nimi pracova\u0165. To znamen\u00e1, \u017ee ak m\u00e1te pr\u00edstup k virtualiza\u010dnej konzole, v\u017edy m\u00f4\u017eete urobi\u0165 snapshot pracuj\u00faceho stroja a extrahova\u0165 v\u0161etky k\u013e\u00fa\u010de z opera\u010dnej pam\u00e4te.<\/p>\n<p>Mnoh\u00ed dod\u00e1vatelia sa pok\u00fa\u0161ali zorganizova\u0165 hardv\u00e9rov\u00e9 \u0161ifrovanie RAM, aby ani hostite\u013e nemal pr\u00edstup k t\u00fdmto \u00fadajom. Napr\u00edklad technol\u00f3gia Intel Software Guard Extensions, ktor\u00e1 organizuje oblasti vo virtu\u00e1lnom adresnom priestore, chr\u00e1nen\u00e9 proti \u010d\u00edtaniu a z\u00e1pisu zvonku t\u00fdmi ist\u00fdmi procesmi, vr\u00e1tane jadra opera\u010dn\u00e9ho syst\u00e9mu. \u017dia\u013e, nem\u00f4\u017eete sa na tieto technol\u00f3gie plne spo\u013eahn\u00fa\u0165, preto\u017ee budete obmedzen\u00ed svoj\u00edm virtu\u00e1lnym strojom. Okrem toho u\u017e existuj\u00fa konkr\u00e9tne pr\u00edklady <noindex><a rel=\"nofollow\" href=\"https:\/\/www.theregister.co.uk\/2017\/03\/07\/eggheads_slip_a_note_under_intels_door_sgx_can_leak_crypto_keys\/\">\u00faspe\u0161n\u00e9ho \u00fatoku<\/a><\/noindex> na t\u00fato technol\u00f3giu. A predsa, \u0161ifrovanie virtu\u00e1lnych strojov nie je tak\u00e9 bezv\u00fdznamn\u00e9, ako sa m\u00f4\u017ee zda\u0165.<\/p>\n<h2>\u0160ifrujeme d\u00e1ta na VDS<\/h2>\n<p>\nHne\u010f na \u00favod chcem poznamena\u0165, \u017ee v\u0161etko, \u010do urob\u00edme ni\u017e\u0161ie, neudel\u00ed pln\u00fa ochranu. Hyperv\u00edzor umo\u017en\u00ed vytv\u00e1ra\u0165 potrebn\u00e9 k\u00f3pie bez zastavenia slu\u017eby a nepozorovane pre v\u00e1s.<\/p>\n<ul>\n<li>Ak poskytovate\u013e hostingu odovzd\u00e1 \u201echladn\u00fd\u201c obraz va\u0161ej virtu\u00e1lnej ma\u0161iny, budete v relat\u00edvnom bezpe\u010d\u00ed. To je najbe\u017enej\u0161\u00ed scen\u00e1r.<\/li>\n<li>Ak poskytovate\u013e hostingu odovzd\u00e1 \u00fapln\u00fd sn\u00edmok funk\u010dnej ma\u0161iny, situ\u00e1cia je dos\u0165 zl\u00e1. V\u0161etky \u00fadaje bud\u00fa pripojen\u00e9 v syst\u00e9me v otvorenej forme. Okrem toho sa objav\u00ed mo\u017enos\u0165 preh\u013ead\u00e1va\u0165 RAM, aby sa na\u0161li s\u00fakromn\u00e9 k\u013e\u00fa\u010de a podobn\u00e9 \u00fadaje.<\/li>\n<\/ul>\n<p>\nPokia\u013e ide o predvolen\u00e9 nastavenia, ak ste nasadili OS z vanilkov\u00e9ho obrazu, poskytovate\u013e hostingu nem\u00e1 root pr\u00edstup. V\u017edy je mo\u017en\u00e9 pripoji\u0165 nosi\u010d s rescue obrazom a zmeni\u0165 heslo od roota, prech\u00e1dzaj\u00fac do chroot prostredia virtu\u00e1lnej ma\u0161iny. Av\u0161ak to si bude vy\u017eadova\u0165 re\u0161tart, \u010do bude vidite\u013en\u00e9. Navy\u0161e, v\u0161etky pripojen\u00e9 za\u0161ifrovan\u00e9 oddiely bud\u00fa uzavret\u00e9.<\/p>\n<p>Av\u0161ak ak sa nasadenie virtu\u00e1lnej ma\u0161iny neuskuto\u010d\u0148uje z vanilkov\u00e9ho obrazu, ale z vopred pripraven\u00e9ho, poskytovate\u013e hostingu \u010dasto m\u00f4\u017ee prid\u00e1va\u0165 privilegovan\u00fd \u00fa\u010det na pomoc v n\u00fadzov\u00fdch situ\u00e1ci\u00e1ch klienta. Napr\u00edklad na zmenu zabudnut\u00e9ho hesla od roota.<\/p>\n<p>Aj v pr\u00edpade \u00fapln\u00e9ho sn\u00edmku to nie je a\u017e tak\u00e9 zl\u00e9. \u00dato\u010dn\u00edk nez\u00edska za\u0161ifrovan\u00e9 s\u00fabory, ak ste ich pripojili z vzdialen\u00e9ho s\u00faborov\u00e9ho syst\u00e9mu inej ma\u0161iny. \u00c1no, teoreticky je mo\u017en\u00e9 rozobra\u0165 dump opera\u010dnej pam\u00e4te a extrahova\u0165 k\u013e\u00fa\u010de na \u0161ifrovanie. Ale v praxi to nie je jednoduch\u00e9 a je ve\u013emi nepravdepodobn\u00e9, \u017ee proces p\u00f4jde \u010falej ne\u017e jednoduch\u00fd prenos s\u00faborov.<\/p>\n<h2>Objedn\u00e1vame ma\u0161inu<\/h2>\n<p>\n<img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/3a4c244720963e8da57e782aa53e2db0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPre na\u0161e testovacie \u00fa\u010dely berieme jednoduch\u00fa ma\u0161inu v <noindex><a rel=\"nofollow\" href=\"https:\/\/ruvds.com\/ru-rub#order\">sekcii na objedn\u00e1vanie serverov<\/a><\/noindex>. Potrebujeme len m\u00e1lo zdrojov, preto si vezmeme mo\u017enos\u0165 s platbou za skuto\u010dne spotrebovan\u00e9 megahertzy a traffic. To bude akur\u00e1t sta\u010di\u0165 na experimentovanie.<\/p>\n<p>Klasick\u00fd dm-crypt pre cel\u00fd oddiel nefungoval. Disk sa predvolene odovzd\u00e1va ako jeden kus, s root na cel\u00fd oddiel. Zmen\u0161ovanie oddielu s ext4 na pripojenom roote je prakticky zaru\u010den\u00fd sp\u00f4sob, ako z\u00edska\u0165 kame\u0148 namiesto s\u00faborov\u00e9ho syst\u00e9mu. Sk\u00fasil som to) Bubon nepomohol.<\/p>\n<h2>Vytv\u00e1rame kryptokontajner<\/h2>\n<p>\nPreto nebudeme \u0161ifrova\u0165 cel\u00fa sekciu, ale vyu\u017eijeme s\u00faborov\u00e9 kryptokontajnery, konkr\u00e9tne aud\u00edtorom overen\u00fd a spo\u013eahliv\u00fd VeraCrypt. Na\u0161e \u00fa\u010dely to sta\u010d\u00ed. Najsk\u00f4r si stiahneme a nain\u0161talujeme bal\u00edk s CLI verziou z ofici\u00e1lnej str\u00e1nky. M\u00f4\u017eete si skontrolova\u0165 aj podpis.<\/p>\n<pre><code class=\"bash\">wget https:\/\/launchpad.net\/veracrypt\/trunk\/1.24-update4\/+download\/veracrypt-console-1.24-Update4-Ubuntu-18.04-amd64.deb\ndpkg -i veracrypt-console-1.24-Update4-Ubuntu-18.04-amd64.deb\n<\/code><\/pre>\n<p>\nTeraz vytvor\u00edme samotn\u00fd kontajner niekde v na\u0161om home, aby sme ho mohli ru\u010dne namontova\u0165 po re\u0161tarte. V interakt\u00edvnom variante nastavte ve\u013ekos\u0165 kontajnera, heslo a \u0161ifrovacie algoritmy. M\u00f4\u017eete si vybra\u0165 patriotick\u00fd \u0161ifru Kobilica a hashovaciu funkciu Stribog.<\/p>\n<pre><code class=\"bash\">veracrypt -t -c ~\/my_super_secret<\/code><\/pre>\n<p>\nTeraz nain\u0161talujme nginx, namontujme kontajner a nahrajme do\u0148 tajn\u00e9 inform\u00e1cie.<\/p>\n<pre><code class=\"bash\">mkdir \/var\/www\/html\/images\nveracrypt ~\/my_super_secret \/var\/www\/html\/images\/\nwget https:\/\/upload.wikimedia.org\/wikipedia\/ru\/2\/24\/Lenna.png<\/code><\/pre>\n<p>\nTrochu uprav\u00edme \/var\/www\/html\/index.nginx-debian.html, aby sme z\u00edskali po\u017eadovan\u00fa str\u00e1nku a mohli kontrolova\u0165.<\/p>\n<h2>Pripoj\u00edme sa a skontrolujeme<\/h2>\n<p>\n<img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/1b1567cfd45db0d6f8421e89c0617a3a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Kontajner je namontovan\u00fd, \u00fadaje s\u00fa pr\u00edstupn\u00e9 a s\u00fa pred\u00e1van\u00e9.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/216440e8f586886a6ce79dc2b8d76fb0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tu je stroj po re\u0161tarte. \u00dadaje s\u00fa bezpe\u010dne ulo\u017een\u00e9 v ~\/my_super_secret.<\/i><\/p>\n<p>Ak naozaj chcete hardcore, m\u00f4\u017eete za\u0161ifrova\u0165 cel\u00fd opera\u010dn\u00fd syst\u00e9m, aby po re\u0161tarte vy\u017eadoval pripojenie cez ssh a zadanie hesla. Toto bude tie\u017e posta\u010duj\u00face v scen\u00e1ri jednoduch\u00e9ho odoberania 'studen\u00fdch \u00fadajov'. Tu je <noindex><a rel=\"nofollow\" href=\"https:\/\/benediktkr.github.io\/ops\/2015\/05\/01\/remote-fde.html\">n\u00e1vod na pou\u017eitie dropbear<\/a><\/noindex> a vzdialen\u00e9 \u0161ifrovanie diskov. Hoci v pr\u00edpade VDS to je zlo\u017eit\u00e9 a nadbyto\u010dn\u00e9.<\/p>\n<h2>Bare metal<\/h2>\n<p>\nNie je tak jednoduch\u00e9 postavi\u0165 si vlastn\u00fd server v d\u00e1tovom centre. Cudziu dedi\u0165 m\u00f4\u017ee by\u0165 virtu\u00e1lny stroj, kde s\u00fa pripojen\u00e9 v\u0161etky zariadenia. Ale nie\u010do zauj\u00edmav\u00e9 v oblasti ochrany sa za\u010d\u00edna, ke\u010f m\u00e1te mo\u017enos\u0165 umiestni\u0165 si v d\u00e1tovom centre vlastn\u00fd d\u00f4veryhodn\u00fd fyzick\u00fd server. Tu m\u00f4\u017eete naplno vyu\u017ei\u0165 tradi\u010dn\u00e9 dm-crypt, VeraCrypt alebo ak\u00e9ko\u013evek in\u00e9 \u0161ifrovanie pod\u013ea v\u00e1\u0161ho v\u00fdberu.<\/p>\n<p>Treba ch\u00e1pa\u0165, \u017ee pri realiz\u00e1cii celkov\u00e9ho \u0161ifrovania server nebude schopn\u00fd samostatne sa spusti\u0165 po re\u0161tarte. Bude potrebn\u00e9 pripoji\u0165 sa k lok\u00e1lnemu rozhraniu IP-KVM, IPMI alebo in\u00e9mu podobn\u00e9mu ekvivalentu. Potom manu\u00e1lne zad\u00e1me master-k\u013e\u00fa\u010d. Sch\u00e9ma sa zd\u00e1 by\u0165 slab\u00e1 z h\u013eadiska kontinuity a odolnosti proti zlyhaniu, ale nesta\u010d\u00ed tu ve\u013ea alternat\u00edv, ak s\u00fa \u00fadaje tak cenn\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/db32aac0efebed1bc71a2277b7f51244.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>NCipher nShield F3 Hardware Security Module<\/i><\/p>\n<p>M\u00e4kk\u00fd variant znamen\u00e1, \u017ee \u00fadaje s\u00fa \u0161ifrovan\u00e9 a k\u013e\u00fa\u010d sa nach\u00e1dza priamo na samotnom serveri v \u0161peci\u00e1lnom HSM (Hardware Security Module). Zvy\u010dajne ide o ve\u013emi funk\u010dn\u00e9 zariadenia, ktor\u00e9 nielen zabezpe\u010duj\u00fa hardv\u00e9rov\u00fa kryptografiu, ale maj\u00fa aj mechanizmy na detekciu pokusu o fyzick\u00e9 n\u00e1silie. Ak niekto za\u010dne kopa\u0165 do v\u00e1\u0161ho servera br\u00faskou, HSM s nez\u00e1visl\u00fdm zdrojom nap\u00e1jania vyma\u017ee k\u013e\u00fa\u010de, ktor\u00e9 uchov\u00e1va vo svojej pam\u00e4ti. \u00dato\u010dn\u00edkovi pr\u00edde len \u0161ifrovan\u00fd chaos. Re\u0161tartovanie m\u00f4\u017ee prebieha\u0165 automaticky.<\/p>\n<p>Odstr\u00e1nenie k\u013e\u00fa\u010dov je omnoho r\u00fdchlej\u0161\u00ed a hum\u00e1nnej\u0161\u00ed variant ako aktiv\u00e1cia termitnej \u0161ar\u017ee alebo elektromagnetick\u00e9ho odpudzova\u010da. Za tak\u00e9to zariadenia v\u00e1s bud\u00fa va\u0161i susedia v d\u00e1tovom centre ve\u013emi dlho bi\u0165. Obzvl\u00e1\u0161\u0165, ak sa pou\u017eije <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Opal_Storage_Specification\">TCG Opal 2<\/a><\/noindex> \u0161ifrovanie na samotn\u00fdch nosi\u010doch prakticky nevytv\u00e1ra \u017eiadne dodato\u010dn\u00e9 n\u00e1klady. V\u0161etko prebieha prieh\u013eadne pre OS. Pravda, mus\u00edte d\u00f4verova\u0165 hypotetick\u00e9mu Samsungu a d\u00fafa\u0165, \u017ee tam je poctiv\u00fd AES256, a nie jednoduch\u00fd XOR.<\/p>\n<p>Pri tom netreba zab\u00fada\u0165, \u017ee v\u0161etky zbyto\u010dn\u00e9 porty musia by\u0165 fyzicky odpojen\u00e9 alebo jednoducho zaplnen\u00e9 kompozitom. Inak d\u00e1te \u00fato\u010dn\u00edkom \u0161ancu uskuto\u010dni\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/DMA_attack\">DMA-\u00fatok<\/a><\/noindex>. Ak m\u00e1te vy\u010dnievaj\u00faci PCI Express alebo Thunderbolt, vr\u00e1tane USB s jeho podporou - ste zranite\u013en\u00ed. \u00dato\u010dn\u00edk m\u00f4\u017ee prostredn\u00edctvom t\u00fdchto portov uskuto\u010dni\u0165 \u00fatok a z\u00edska\u0165 priamy pr\u00edstup do pam\u00e4te s k\u013e\u00fa\u010dmi.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"E6gzVVjW4yY\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/E6gzVVjW4yY\/hqdefault.jpg\" alt=\"Prehrajte video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><\/p>\n<p>V \u00faplne sofistikovanej variante dok\u00e1\u017ee \u00fato\u010dn\u00edk vykona\u0165 cold boot \u00fatok. Pri tom len naleje dobr\u00fa porciu kvapaln\u00e9ho dus\u00edka do v\u00e1\u0161ho servera, surovo vyber\u00e1 zamrznut\u00e9 pam\u00e4\u0165ov\u00e9 modul a rob\u00ed z nich dump so v\u0161etk\u00fdmi k\u013e\u00fa\u010dmi. \u010casto na uskuto\u010dnenie \u00fatoku sta\u010d\u00ed be\u017en\u00fd chladiaci sprej a teploty okolo -50 stup\u0148ov. Existuje aj prec\u00edznej\u0161\u00ed variant. Ak ste neodpojili bootovanie z extern\u00fdch zariaden\u00ed, algoritmus \u00fato\u010dn\u00edka bude e\u0161te jednoduch\u0161\u00ed:<\/p>\n<ol>\n<li>Zmrzn\u00fa\u0165 pam\u00e4\u0165ov\u00e9 moduly bez otvorenia skrine<\/li>\n<li>Pripoji\u0165 svoj bootovac\u00ed USB k\u013e\u00fa\u010d<\/li>\n<li>\u0160peci\u00e1lnymi utilitami z\u00edska\u0165 \u00fadaje z opera\u010dnej pam\u00e4te, ktor\u00e9 pre\u017eili re\u0161tart v\u010faka zmrazeniu.<\/li>\n<\/ol>\n<p><\/p>\n<h2>Rozde\u013euj a panuj<\/h2>\n<p>\nOk, m\u00e1me len virtu\u00e1lky, ale chceli by sme aspo\u0148 nejako zn\u00ed\u017ei\u0165 riziko \u00faniku \u00fadajov.<br \/>\nV z\u00e1sade je mo\u017en\u00e9 zv\u00e1\u017ei\u0165 prepracovanie architekt\u00fary a rozlo\u017eenie uchov\u00e1vania d\u00e1t a spracovania na r\u00f4zne jurisdikcie. Napr\u00edklad front-end s \u0161ifrovac\u00edmi k\u013e\u00fa\u010dmi u hostite\u013ea v \u010cesku a back-end so za\u0161ifrovan\u00fdmi d\u00e1tami niekde v Rusku. V pr\u00edpade \u0161tandardn\u00e9ho pokusu o z\u00edskanie je ve\u013emi nepravdepodobn\u00e9, \u017ee by mocensk\u00e9 \u0161trukt\u00fary mohli vykona\u0165 tento krok s\u00fa\u010dasne v r\u00f4znych jurisdikci\u00e1ch. Navy\u0161e, to \u010diasto\u010dne chr\u00e1ni n\u00e1s pred sc\u00e9narom so sn\u00edman\u00edm sn\u00edmky.<\/p>\n<p>Alebo m\u00f4\u017eeme zv\u00e1\u017ei\u0165 \u00faplne \u010dist\u00fa alternat\u00edvu \u2014 \u0161ifrovanie End-to-End. Samozrejme, to presahuje r\u00e1mec po\u017eiadaviek a nepredpoklad\u00e1 vykon\u00e1vanie v\u00fdpo\u010dtov na strane vzdialen\u00e9ho stroja. Napriek tomu je to celkom prijate\u013en\u00e1 mo\u017enos\u0165, pokia\u013e ide o uchov\u00e1vanie a synchroniz\u00e1ciu d\u00e1t. Napr\u00edklad, to je ve\u013emi pohodlne implementovan\u00e9 v tom istom Nextcloude. Pri tom synchroniz\u00e1cia, verzionovanie a \u010fal\u0161ie v\u00fdhody serverovej \u010dasti nikam nezmizn\u00fa.<\/p>\n<h2>Spolu<\/h2>\n<p>\nNeexistuj\u00fa dokonale chr\u00e1nen\u00e9 syst\u00e9my. \u00daloha spo\u010d\u00edva len v tom, aby \u00fatok bol drah\u0161\u00ed ako potenci\u00e1lny zisk.<\/p>\n<p>Ur\u010dit\u00e9 zn\u00ed\u017eenie riz\u00edk pr\u00edstupu k d\u00e1tam na virtu\u00e1lnom serveri je mo\u017en\u00e9 dosiahnu\u0165 kombinovan\u00edm \u0161ifrovania a oddelen\u00e9ho uchov\u00e1vania u r\u00f4znych hostite\u013eov.<\/p>\n<p>Celkom spo\u013eahlivou alternat\u00edvou je pou\u017eitie vlastn\u00e9ho hardv\u00e9rov\u00e9ho servera.<\/p>\n<p>Hostite\u013eovi sa aj tak bude treba d\u00f4verova\u0165. Na tom spo\u010d\u00edva cel\u00fd priemysel.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=mekl&amp;utm_content=prishli-siloviki\"><img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/13474ad7e4e39f259f91f51f4fd1febc.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=mekl&amp;utm_content=prishli-siloviki#order\"><img decoding=\"async\" alt=\"\u010co robi\u0165, ak k v\u00e1\u0161mu poskytovate\u013eovi hostingu pri\u0161li siloviky\" src=\"\/wp-content\/uploads\/2020\/06\/92555b963c5ff5b7bf0393a1918c40dd.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506334\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u043a\u0434\u043f\u0432 \u2014 Reuters \u0415\u0441\u043b\u0438 \u0432\u044b \u0430\u0440\u0435\u043d\u0434\u043e\u0432\u0430\u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440, \u0442\u043e \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0443 \u0432\u0430\u0441 \u043d\u0430\u0434 \u043d\u0438\u043c \u043d\u0435\u0442. \u042d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0432 \u043b\u044e\u0431\u043e\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043a \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0439\u0442\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0431\u0443\u0447\u0435\u043d\u043d\u044b\u0435 \u043b\u044e\u0434\u0438 \u0438 \u043f\u043e\u043f\u0440\u043e\u0441\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043b\u044e\u0431\u044b\u0435 \u0432\u0430\u0448\u0438 \u0434\u0430\u043d\u043d\u044b\u0435. \u0418 \u0445\u043e\u0441\u0442\u0435\u0440 \u0438\u0445 \u043e\u0442\u0434\u0430\u0441\u0442, \u0435\u0441\u043b\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435 \u0431\u0443\u0434\u0435\u0442 \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043e \u043f\u043e \u0437\u0430\u043a\u043e\u043d\u0443. \u0412\u044b \u043e\u0447\u0435\u043d\u044c \u043d\u0435 \u0445\u043e\u0442\u0438\u0442\u0435, \u0447\u0442\u043e\u0431\u044b \u043b\u043e\u0433\u0438 \u0432\u0430\u0448\u0435\u0433\u043e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85142,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85141","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043a \u0442\u0432\u043e\u0435\u043c\u0443 \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043f\u0440\u0438\u0448\u043b\u0438 siloviki | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-13T11:42:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-13T11:42:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u010co robi\u0165, ak k tvojmu hostite\u013eovi pri\u0161li siloviki | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0442\u044c, \u0435\u0441\u043b\u0438 \u043a \u0442\u0432\u043e\u0435\u043c\u0443 \u0445\u043e\u0441\u0442\u0435\u0440\u0443 \u043f\u0440\u0438\u0448\u043b\u0438 siloviki | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/chto-delat-esli-k-tvoemu-hosteru-prishli-siloviki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-13T11:42:24+00:00","article:modified_time":"2020-06-13T11:42:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85141","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:43:30","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/85141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=85141"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/85141\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/85142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=85141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=85141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=85141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}