{"id":85475,"date":"2020-06-16T13:42:55","date_gmt":"2020-06-16T11:42:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti"},"modified":"2020-06-16T13:42:55","modified_gmt":"2020-06-16T11:42:55","slug":"snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","title":{"rendered":"Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kedysi na ochranu lok\u00e1lnej siete sta\u010dil be\u017en\u00fd firewall a antiv\u00edrusov\u00e9 programy, ale proti \u00fatokom modern\u00fdch hackerov a roz\u0161\u00edrenej malware u\u017e tento s\u00fabor nie je dostato\u010dne efekt\u00edvny. Star\u00fd dobr\u00fd firewall analyzuje iba hlavi\u010dky paketov, prech\u00e1dza alebo blokuje ich pod\u013ea s\u00faboru form\u00e1lnych pravidiel. O obsahu paketov ni\u010d nevie, a preto nedok\u00e1\u017ee rozpozna\u0165 na poh\u013ead legit\u00edmne \u010dinnosti \u00fato\u010dn\u00edkov. Antiv\u00edrusov\u00e9 programy v\u017edy nezachyt\u00e1vaj\u00fa \u0161kodliv\u00fd softv\u00e9r, a preto sa pred administr\u00e1torom objavuje \u00faloha sledovania anom\u00e1lnej aktivity a v\u010dasnej izol\u00e1cie infikovan\u00fdch hostite\u013eov. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\"><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete\" src=\"\/wp-content\/uploads\/2020\/06\/e5bf2d1eeec4b350c9a3b89fdf2a2475.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Existuje mno\u017estvo pokro\u010dil\u00fdch prostriedkov, ktor\u00e9 umo\u017e\u0148uj\u00fa chr\u00e1ni\u0165 IT infra\u0161trukt\u00faru spolo\u010dnosti. Dnes sa budeme rozpr\u00e1va\u0165 o syst\u00e9moch detekcie a prevencie naru\u0161en\u00ed s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom, ktor\u00e9 mo\u017eno implementova\u0165 bez zak\u00fapenia drah\u00e9ho hardv\u00e9ru a softv\u00e9rov\u00fdch licenci\u00ed.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Klasifik\u00e1cia IDS\/IPS<\/h2>\n<p>\nIDS (Intrusion Detection System) \u2014 je ur\u010den\u00fd na zaznamen\u00e1vanie podozriv\u00fdch \u010dinnost\u00ed v sieti alebo na samostatnom po\u010d\u00edta\u010di. Vedie z\u00e1znamy o udalostiach a upozor\u0148uje na ne zodpovedn\u00e9ho pracovn\u00edka za informa\u010dn\u00fa bezpe\u010dnos\u0165. V r\u00e1mci IDS m\u00f4\u017eeme vy\u010dleni\u0165 nasleduj\u00face prvky:<\/p>\n<ul>\n<li>senzory na sledovanie sie\u0165ov\u00e9ho prev\u00e1dzky, r\u00f4znych z\u00e1znamov at\u010f.\u00a0<\/li>\n<li>analyza\u010dn\u00fd subsyst\u00e9m, ktor\u00fd odha\u013euje v z\u00edskan\u00fdch \u00fadajoch znaky \u0161kodliv\u00e9ho z\u00e1sahu;<\/li>\n<li>\u00falo\u017eisko na zhroma\u017e\u010fovanie prim\u00e1rnych udalost\u00ed a v\u00fdsledkov anal\u00fdzy;<\/li>\n<li>riadiaca konzola.<\/li>\n<\/ul>\n<p>\nP\u00f4vodne sa IDS klasifikovali pod\u013ea miesta umiestnenia: mohli by\u0165 orientovan\u00e9 na ochranu jednotliv\u00fdch uzlov (host-based alebo Host Intrusion Detection System \u2014 HIDS) alebo chr\u00e1ni\u0165 cel\u00fa firemn\u00fa sie\u0165 (network-based alebo Network Intrusion Detection System \u2014 NIDS). Stoj\u00ed za zmienku tzv. APIDS (Application protocol-based IDS): sleduj\u00fa obmedzen\u00fa sadu aplika\u010dn\u00fdch protokolov na identifik\u00e1ciu \u0161pecifick\u00fdch \u00fatokov a nezaoberaj\u00fa sa hlbokou anal\u00fdzou sie\u0165ov\u00fdch paketov. Tieto produkty obvykle pripom\u00ednaj\u00fa proxy a pou\u017e\u00edvaj\u00fa sa na ochranu konkr\u00e9tnych slu\u017eieb: webov\u00fdch serverov a webov\u00fdch aplik\u00e1ci\u00ed (napr\u00edklad nap\u00edsan\u00fdch v PHP), serverov datab\u00e1z a pod. Typick\u00fdm z\u00e1stupcom tejto triedy je mod_security pre webov\u00fd server Apache. <\/p>\n<p>Viac n\u00e1s zauj\u00edmaj\u00fa univerz\u00e1lne NIDS, ktor\u00e9 podporuj\u00fa \u0161irok\u00fa \u0161k\u00e1lu komunika\u010dn\u00fdch protokolov a technol\u00f3gi\u00ed hlbok\u00e9ho anal\u00fdzy paketov DPI (Deep Packet Inspection). Monitoruj\u00fa cel\u00fd prech\u00e1dzaj\u00faci prenos, po\u010d\u00ednaj\u00fac na kan\u00e1lovej \u00farovni, a odha\u013euj\u00fa \u0161irok\u00e9 spektrum sie\u0165ov\u00fdch \u00fatokov, ako aj pokusy o neopr\u00e1vnen\u00fd pr\u00edstup k inform\u00e1ci\u00e1m. Tak\u00e9to syst\u00e9my sa \u010dasto vyzna\u010duj\u00fa distribuovanou architekt\u00farou a m\u00f4\u017eu interagova\u0165 s r\u00f4znymi akt\u00edvnymi sie\u0165ov\u00fdmi zariadeniami. Je potrebn\u00e9 poznamena\u0165, \u017ee mnoh\u00e9 modern\u00e9 NIDS s\u00fa hybridn\u00e9 a kombinuj\u00fa nieko\u013eko pr\u00edstupov. V z\u00e1vislosti od konfigur\u00e1cie a nastaven\u00ed m\u00f4\u017eu rie\u0161i\u0165 r\u00f4zne \u00falohy - napr\u00edklad ochranu jedn\u00e9ho uzla alebo celej siete. Okrem toho funkcie IDS pre pracovn\u00e9 stanice prevzali antiv\u00edrusov\u00e9 bal\u00edky, ktor\u00e9 sa v d\u00f4sledku \u0161\u00edrenia cielen\u00fdch trojanov na kr\u00e1de\u017e inform\u00e1ci\u00ed premenili na multifunk\u010dn\u00e9 br\u00e1ny, ktor\u00e9 rie\u0161ia aj \u00falohy rozpozn\u00e1vania a blokovania podozriv\u00e9ho prenosu. <\/p>\n<p>P\u00f4vodne IDS dok\u00e1zali len odha\u013eova\u0165 \u010dinnosti \u0161kodliv\u00e9ho softv\u00e9ru, pr\u00e1cu skenerov portov alebo, povedzme, poru\u0161enia korpor\u00e1tnych bezpe\u010dnostn\u00fdch polit\u00edk zo strany pou\u017e\u00edvate\u013eov. Pri vzniku ur\u010dit\u00e9ho incidentu informovali administr\u00e1tora, ale pomerne r\u00fdchlo sa uk\u00e1zalo, \u017ee len rozpozna\u0165 \u00fatok nesta\u010d\u00ed - je potrebn\u00e9 ho zablokova\u0165. Tak sa IDS transformovali na IPS (Intrusion Prevention Systems) - syst\u00e9my prevencie vniknut\u00ed, schopn\u00e9 interagova\u0165 so sie\u0165ov\u00fdmi firewallmi.<\/p>\n<h2>Met\u00f3dy detekcie<\/h2>\n<p>\nModern\u00e9 rie\u0161enia na detekciu a prevenciu vniknut\u00ed pou\u017e\u00edvaj\u00fa r\u00f4zne met\u00f3dy ur\u010dovania \u0161kodlivej aktivity, ktor\u00e9 m\u00f4\u017eeme rozdeli\u0165 do troch kateg\u00f3ri\u00ed. To n\u00e1m poskytuje \u010fal\u0161iu mo\u017enos\u0165 klasifik\u00e1cie syst\u00e9mov:<\/p>\n<ul>\n<li>Signat\u00farne IDS\/IPS identifikuj\u00fa v prenose ur\u010dit\u00e9 vzory alebo sleduj\u00fa zmeny stavu syst\u00e9mov na ur\u010denie sie\u0165ov\u00e9ho \u00fatoku alebo pokusu o infikovanie. Prakticky ned\u00e1vaj\u00fa falo\u0161n\u00e9 poplachy, ale nie s\u00fa schopn\u00e9 odhali\u0165 nezn\u00e1me hrozby.<\/li>\n<li>Syst\u00e9my IDS na detekciu anom\u00e1li\u00ed nepou\u017e\u00edvaj\u00fa podpisy \u00fatokov. Rozpozn\u00e1vaj\u00fa spr\u00e1vanie informa\u010dn\u00fdch syst\u00e9mov, ktor\u00e9 sa odli\u0161uje od norm\u00e1lu (vr\u00e1tane anom\u00e1li\u00ed v sie\u0165ovom prenosu) a m\u00f4\u017eu identifikova\u0165 aj nezn\u00e1me \u00fatoky. Tieto syst\u00e9my generuj\u00fa pomerne ve\u013ea falo\u0161n\u00fdch poplachov a pri nespr\u00e1vnom pou\u017eit\u00ed m\u00f4\u017eu paralyzova\u0165 pr\u00e1cu miestnej siete;<\/li>\n<li>Syst\u00e9my IDS zalo\u017een\u00e9 na pravidl\u00e1ch funguj\u00fa na princ\u00edpe: if FAKT then \u010cINNOS\u0164. V podstate ide o expertn\u00e9 syst\u00e9my s datab\u00e1zou znalost\u00ed \u2014 s\u00fabor faktov a pravidiel logick\u00e9ho odvodzovania. Tieto rie\u0161enia s\u00fa n\u00e1ro\u010dn\u00e9 na nastavenie a vy\u017eaduj\u00fa od administr\u00e1tora podrobn\u00e9 porozumenie fungovania siete.\u00a0<\/li>\n<\/ul>\n<p><\/p>\n<h2>Hist\u00f3ria v\u00fdvoja IDS<\/h2>\n<p>\n\u00c9ra intenz\u00edvneho rozvoja internetu a podnikov\u00fdch siet\u00ed za\u010dala v 90. rokoch 20. storo\u010dia, av\u0161ak pokrokov\u00e9 technol\u00f3gie sie\u0165ovej bezpe\u010dnosti sa stali t\u00e9mou sk\u00f4r. V roku 1986 Dorothy Denning a Peter Neuman publikovali model IDES (Intrusion Detection Expert System), ktor\u00fd sa stal z\u00e1kladom v\u00e4\u010d\u0161iny modern\u00fdch syst\u00e9mov na detekciu vniknutia. Pou\u017e\u00edval expertn\u00fd syst\u00e9m na identifik\u00e1ciu zn\u00e1mych typov \u00fatokov a tie\u017e \u0161tatistick\u00e9 met\u00f3dy a profily pou\u017e\u00edvate\u013eov\/syst\u00e9mov. IDES be\u017eala na pracovn\u00fdch staniciach Sun a kontrolovala sie\u0165ov\u00fd prenos a d\u00e1ta aplik\u00e1ci\u00ed. V roku 1993 vy\u0161la NIDES (Next-generation Intrusion Detection Expert System) \u2014 expertn\u00fd syst\u00e9m na detekciu vniknut\u00ed novej gener\u00e1cie.<\/p>\n<p>Na z\u00e1klade pr\u00e1c Denninga a Neymana v roku 1988 vznikol expertn\u00fd syst\u00e9m MIDAS (Multics intrusion detection and alerting system), ktor\u00fd vyu\u017e\u00edva P-BEST a LISP. V tom istom roku bola vytvoren\u00e1 na \u0161tatistick\u00fdch met\u00f3dach zalo\u017een\u00e1 syst\u00e9m Haystack. O rok nesk\u00f4r vo Los Alamoskej n\u00e1rodnej laborat\u00f3rii vyvinuli \u010fal\u0161\u00ed \u0161tatistick\u00fd detektor anom\u00e1li\u00ed W&amp;S (Wisdom &amp; Sense). Rozvoj odvetvia prebiehal r\u00fdchlym tempom. Napr\u00edklad v roku 1990 sa v syst\u00e9me TIM (Time-based inductive machine) u\u017e implementovalo zistenie anom\u00e1li\u00ed pomocou indukt\u00edvneho u\u010denia na sekven\u010dn\u00fdch vzorcoch pou\u017e\u00edvate\u013ea (jazyk Common LISP). NSM (Network Security Monitor) na zistenie anom\u00e1li\u00ed porovn\u00e1val pr\u00edstupov\u00e9 matice, zatia\u013e \u010do ISOA (Information Security Officer\u2019s Assistant) podporoval r\u00f4zne strat\u00e9gie detekcie: \u0161tatistick\u00e9 met\u00f3dy, kontrolu profilu a expertn\u00fd syst\u00e9m. Syst\u00e9m ComputerWatch vytvoren\u00fd v AT&amp;T Bell Labs pou\u017e\u00edval na kontrolu ako \u0161tatistick\u00e9 met\u00f3dy, tak pravidl\u00e1, a prv\u00fd prototyp distribuovanej IDS v\u00fdvoj\u00e1ri z Kalifornskej univerzity vytvorili u\u017e v roku 1991 \u2014 DIDS (Distributed intrusion detection system), ktor\u00fd taktie\u017e sl\u00fa\u017eil ako expertn\u00fd syst\u00e9m.<\/p>\n<p>Na za\u010diatku boli IDS propriet\u00e1rne, ale u\u017e v roku 1998 N\u00e1rodn\u00e1 laborat\u00f3rie menom Lawrence v Berkeley vydala Bro (v roku 2018 premenovan\u00e9 na Zeek) \u2014 syst\u00e9m s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom, ktor\u00fd vyu\u017e\u00edva vlastn\u00fd jazyk pravidiel na anal\u00fdzu d\u00e1t libpcap. V novembri toho ist\u00e9ho roku sa objavil pomocou libpcap bal\u00edkov\u00fd sniffer APE, ktor\u00fd o mesiac nesk\u00f4r bol premenovan\u00fd na Snort, a nesk\u00f4r sa stal plnohodnotn\u00fdm IDS\/IPS. V tom \u010dase sa za\u010dali objavova\u0165 aj mnoh\u00e9 propriet\u00e1rne rie\u0161enia. <\/p>\n<h2>Snort a Suricata<\/h2>\n<p>\nV mnoh\u00fdch spolo\u010dnostiach d\u00e1vaj\u00fa prednos\u0165 bezplatn\u00fdm IDS\/IPS s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom. Dlho sa \u0161tandardn\u00fdm rie\u0161en\u00edm pova\u017eoval u\u017e spomenut\u00fd Snort, ale teraz ho vytla\u010dila s\u00fastava Suricata. Pozrime sa na ich v\u00fdhody a nev\u00fdhody podrobnej\u0161ie. Snort kombinuje v\u00fdhody signat\u00farneho met\u00f3dy s mo\u017enos\u0165ou zistenia anom\u00e1li\u00ed v re\u00e1lnom \u010dase. Suricata tie\u017e umo\u017e\u0148uje pou\u017e\u00edva\u0165 in\u00e9 met\u00f3dy okrem rozpozn\u00e1vania \u00fatokov pod\u013ea signat\u00far. Syst\u00e9m bol vytvoren\u00fd skupinou v\u00fdvoj\u00e1rov, ktor\u00ed sa odpojili od projektu Snort, a podporuje funkcie IPS od verzie 1.4, zatia\u013e \u010do v Snort bola mo\u017enos\u0165 predch\u00e1dzania naru\u0161eniam pridan\u00e1 nesk\u00f4r. <\/p>\n<p>Hlavn\u00fd rozdiel medzi dvoma popul\u00e1rnymi produktmi spo\u010d\u00edva v tom, \u017ee Suricata m\u00e1 mo\u017enos\u0165 vyu\u017e\u00edva\u0165 GPU na v\u00fdpo\u010dty v re\u017eime IDS a m\u00e1 aj pokro\u010dilej\u0161ie IPS. Syst\u00e9m je od za\u010diatku navrhnut\u00fd pre viacer\u00e9 vl\u00e1kna, zatia\u013e \u010do Snort je jednovl\u00e1knov\u00fd produkt. Kv\u00f4li svojej dlhodobej hist\u00f3rii a zdeden\u00e9mu k\u00f3du nie je optim\u00e1lne prisp\u00f4soben\u00fd na viacprocesorov\u00e9\/multijadro\u00e9 hardv\u00e9rov\u00e9 platformy, zatia\u013e \u010do Suricata na be\u017en\u00fdch po\u010d\u00edta\u010doch dok\u00e1\u017ee spracov\u00e1va\u0165 prenosy a\u017e do 10 Gbit\/s. O podobnostiach a rozdieloch medzi t\u00fdmito dvoma syst\u00e9mami by sa dalo diskutova\u0165 dlho, ale hoci motor Suricata funguje r\u00fdchlej\u0161ie, pre nie pr\u00edli\u0161 \u0161irok\u00e9 kan\u00e1ly to nem\u00e1 z\u00e1sadn\u00fd v\u00fdznam.<\/p>\n<h2>Mo\u017enosti nasadenia<\/h2>\n<p>\nIPS mus\u00ed by\u0165 umiestnen\u00e9 tak, aby syst\u00e9m mohol monitorova\u0165 pod kontrolou segmenty siete. Naj\u010dastej\u0161ie ide o dedikovan\u00fd po\u010d\u00edta\u010d, ktor\u00e9ho jedno rozhranie je pripojen\u00e9 za okrajov\u00fdmi zariadeniami a \"sleduje\" cez ne nezabezpe\u010den\u00e9 verejn\u00e9 siete (Internet). Druh\u00e9 rozhranie IPS je pripojen\u00e9 na vstup chr\u00e1nen\u00e9ho segmentu, aby cel\u00fd prenos prech\u00e1dzal syst\u00e9mom a bol analyzovan\u00fd. V zlo\u017eitej\u0161\u00edch pr\u00edpadoch m\u00f4\u017ee by\u0165 chr\u00e1nen\u00fdch segmentov viac: povedzme, v firemn\u00fdch sie\u0165ach sa \u010dasto vy\u010dle\u0148uje demilitarizovan\u00e1 z\u00f3na (DMZ) so slu\u017ebami pr\u00edstupn\u00fdmi z internetu. <\/p>\n<p><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete\" src=\"\/wp-content\/uploads\/2020\/06\/15e2e449a81eedea09032718ff4a1bc9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u00e9to IPS m\u00f4\u017ee zabr\u00e1ni\u0165 pokusom o skenovanie portov alebo hacking prostredn\u00edctvom h\u00e1dania hesiel, zneu\u017eiteiu zranite\u013enost\u00ed na po\u0161tovom serveri, webovom serveri alebo v skriptoch, ako aj in\u00fdm typom vonkaj\u0161\u00edch \u00fatokov. V pr\u00edpade, \u017ee po\u010d\u00edta\u010de v lok\u00e1lnej sieti bud\u00fa infikovan\u00e9 \u0161kodliv\u00fdm softv\u00e9rom, IDS im neumo\u017en\u00ed nadviaza\u0165 spojenie s vonkaj\u0161\u00edmi servermi botnetu. Pre v\u00e1\u017enej\u0161iu ochranu vn\u00fatornej siete pravdepodobne bude potrebn\u00e1 zlo\u017eit\u00e1 konfigur\u00e1cia s distribuovan\u00fdm syst\u00e9mom a nie lacn\u00e9 spravovan\u00e9 prep\u00edna\u010de, schopn\u00e9 zrkadli\u0165 prenosy pre pripojen\u00e9 rozhranie IDS na jednom z portov.<\/p>\n<p>\u010casto sa korpor\u00e1tne siete vystavuj\u00fa distribuovan\u00fdm \u00fatokom zameran\u00fdm na odmietnutie slu\u017eby (DDoS). Hoci modern\u00e9 IDS dok\u00e1\u017eu bojova\u0165 s tak\u00fdmito \u00fatokmi, uveden\u00e1 forma nasadenia tu sotva pom\u00f4\u017ee. Syst\u00e9m rozpozn\u00e1 zhubn\u00fa aktivitu a zablokuje parazitn\u00fd prenos, ale na to, aby sa tak stalo, musia pakety prejs\u0165 cez vonkaj\u0161ie internetov\u00e9 pripojenie a dosta\u0165 sa na jeho sie\u0165ov\u00e9 rozhranie. V z\u00e1vislosti od intenzity \u00fatoku m\u00f4\u017ee prenosov\u00fd kan\u00e1l nezvl\u00e1dnu\u0165 z\u00e1\u0165a\u017e a cie\u013e \u00fato\u010dn\u00edkov bude dosiahnut\u00fd. Pre tak\u00e9to pr\u00edpady odpor\u00fa\u010dame nasadi\u0165 IDS na virtu\u00e1lnom serveri s predsavzatej\u0161\u00edm v\u00fdkonn\u00fdm internetov\u00fdm pripojen\u00edm. Pripoji\u0165 VPS k lok\u00e1lnej sieti je mo\u017en\u00e9 cez VPN, a potom bude potrebn\u00e9 nastavi\u0165 cez neho smerovanie cel\u00e9ho vonkaj\u0161ieho prenosu. V pr\u00edpade DDoS \u00fatoku potom nebude potrebn\u00e9 posiela\u0165 pakety cez pripojenie k poskytovate\u013eovi, bud\u00fa zablokovan\u00e9 na vonkaj\u0161om uzle.<\/p>\n<p><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete\" src=\"\/wp-content\/uploads\/2020\/06\/7ced164023bf2aa37e676d460804d6da.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Probl\u00e9m v\u00fdberu<\/h2>\n<p>\nIdentifikova\u0165 l\u00eddra medzi bezplatn\u00fdmi syst\u00e9mami je ve\u013emi obtia\u017ene. V\u00fdber IDS\/IPS sa ur\u010duje topol\u00f3giou siete, po\u017eadovan\u00fdmi funkciami ochrany, ako aj osobn\u00fdmi preferenciami administr\u00e1tora a jeho ochotou zaobera\u0165 sa nastaveniami. Snort m\u00e1 dlh\u0161iu hist\u00f3riu a je lep\u0161ie zdokumentovan\u00fd, hoci aj o Suricate n\u00e1jdete inform\u00e1cie celkom \u013eahko na internete. V ka\u017edom pr\u00edpade, na osvojenie si syst\u00e9mu bude potrebn\u00e9 vynalo\u017ei\u0165 ur\u010dit\u00e9 \u00fasilie, ktor\u00e9 sa nakoniec oplat\u00ed \u2014 komer\u010dn\u00e9 hardv\u00e9rov\u00e9 a hardv\u00e9rovopr\u00edkladov\u00e9 IDS\/IPS s\u00fa dos\u0165 drah\u00e9 a nie v\u017edy sa zmestia do rozpo\u010dtu. \u013dutova\u0165 str\u00e1ven\u00fd \u010das netreba, preto\u017ee dobr\u00fd admin v\u017edy zvy\u0161uje svoju kvalifik\u00e1ciu na n\u00e1klady zamestn\u00e1vate\u013ea. V tejto situ\u00e1cii v\u0161etci z\u00edskavaj\u00fa. V nasleduj\u00facom \u010dl\u00e1nku sa pozrieme na niektor\u00e9 mo\u017enosti nasadenia Suricaty a v praxi porovn\u00e1me modernej\u0161\u00ed syst\u00e9m s klasick\u00fdm IDS\/IPS Snort.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata\"><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete\" src=\"\/wp-content\/uploads\/2020\/06\/19f0fd87faf30e31d34e2a10421514da.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata#order\"><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete\" src=\"\/wp-content\/uploads\/2020\/06\/a5fe3bac97102322110b9d0e33f3919c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u0435\u043d. \u0421\u0442\u0430\u0440\u044b\u0439-\u0434\u043e\u0431\u0440\u044b\u0439 firewall \u0430\u043d\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u044f \u0438\u0445 \u0432 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0438 \u0441 \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u0444\u043e\u0440\u043c\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b. \u041e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u043e\u043d \u043d\u0438\u0447\u0435\u0433\u043e \u043d\u0435 \u0437\u043d\u0430\u0435\u0442, \u0430 \u043f\u043e\u0442\u043e\u043c\u0443 \u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85476,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85475","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-16T11:42:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00e9 IDS\/IPS na ochranu korpor\u00e1tnej siete | ProHoster","description":"Kedysi na ochranu lok\u00e1lnej siete sta\u010dil oby\u010dajn\u00fd firewall a antiv\u00edrusov\u00e9 programy, ale proti \u00fatokom modern\u00fdch hackerov a roz\u0161iruj\u00facej sa malv\u00e9ri u\u017e tak\u00e1to s\u00faprava nesta\u010d\u00ed.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 1: \u0432\u044b\u0431\u0438\u0440\u0430\u0435\u043c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IDS\/IPS \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430-\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0431\u044b\u043b\u043e \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0431\u044b\u043a\u043d\u043e\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0430 \u0438 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043d\u043e \u043f\u0440\u043e\u0442\u0438\u0432 \u0430\u0442\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u043b\u043e\u0434\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u0432 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u0432\u0440\u0435\u043c\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 \u0442\u0430\u043a\u043e\u0439 \u043d\u0430\u0431\u043e\u0440 \u0443\u0436\u0435 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-1-vybiraem-besplatnuyu-ids-ips-dlya-zashhity-korporativnoj-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-16T11:42:55+00:00","article:modified_time":"2020-06-16T11:42:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85475","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:36:28","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/85475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=85475"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/85475\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/85476"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=85475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=85475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=85475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}