{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">predch\u00e1dzaj\u00facej \u010dl\u00e1nku<\/a><\/noindex> povedali sme, ako spusti\u0165 stabiln\u00fa verziu Suricata na Ubuntu 18.04 LTS. Nastavi\u0165 IDS na jednom uzle a pripoji\u0165 bezplatn\u00e9 s\u00fabory pravidiel nie je naj\u0165a\u017e\u0161ie. Dnes si uk\u00e1\u017eeme, ako ochr\u00e1ni\u0165 firemn\u00fa sie\u0165 pred najroz\u0161\u00edrenej\u0161\u00edmi typmi \u00fatokov pomocou Suricaty nain\u0161talovanej na virtu\u00e1lnom serveri. Na to budeme potrebova\u0165 VDS na Linuxe s dvoma v\u00fdpo\u010dtov\u00fdmi jadrami. Ve\u013ekos\u0165 pam\u00e4te z\u00e1vis\u00ed od za\u0165a\u017eenia: niekomu sta\u010d\u00ed aj 2 GB, zatia\u013e \u010do pre v\u00e1\u017enej\u0161ie \u00falohy m\u00f4\u017ee by\u0165 potrebn\u00e9 4 alebo dokonca 6. Plus virtu\u00e1lneho stroja spo\u010d\u00edva v mo\u017enosti experimentovania: m\u00f4\u017eete za\u010da\u0165 s minim\u00e1lnou konfigur\u00e1ciou a zvy\u0161ova\u0165 zdroje pod\u013ea potreby.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>foto: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort alebo Suricata. \u010cas\u0165 1: vyber\u00e1me bezplatn\u00fd IDS\/IPS na ochranu podnikov\u00e9ho siete<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">V\u00fdvoj\u00e1ri projektu LLVM vyjadrili \u017eelanie nasledova\u0165 pr\u00edklad<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>Zlu\u010dujeme siete<\/h2>\n<p>\nZavedenie IDS na virtu\u00e1lny stroj m\u00f4\u017ee by\u0165 potrebn\u00e9 najm\u00e4 na testy. Ak ste sa nikdy nestretli s podobn\u00fdmi rie\u0161eniami, netreba sa hne\u010f vrhn\u00fa\u0165 na objedn\u00e1vanie fyzick\u00e9ho hardv\u00e9ru a menenie architekt\u00fary siete. Lep\u0161ie je otestova\u0165 syst\u00e9m bezpe\u010dne a bez zbyto\u010dn\u00fdch n\u00e1kladov, aby ste ur\u010dili potreby v oblasti v\u00fdpo\u010dtov\u00fdch zdrojov. D\u00f4le\u017eit\u00e9 je ch\u00e1pa\u0165, \u017ee cel\u00fd firemn\u00fd prev\u00e1dzkov\u00fd tok bude potrebn\u00e9 prehna\u0165 cez jedin\u00e9 vonkaj\u0161ie uzly: na pripojenie lok\u00e1lnej siete (alebo nieko\u013ek\u00fdch siet\u00ed) k VDS so nain\u0161talovan\u00fdm IDS Suricata m\u00f4\u017eete pou\u017ei\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 jednoduch\u00fd na nastavenie multiplatformov\u00fd VPN server, ktor\u00fd zabezpe\u010duje spo\u013eahliv\u00e9 \u0161ifrovanie. Kancel\u00e1rske pripojenie na internet nemus\u00ed ma\u0165 skuto\u010dn\u00fa IP adresu, tak\u017ee je lep\u0161ie ho vytvori\u0165 na VPS. V repozit\u00e1ri Ubuntu nie s\u00fa pripraven\u00e9 bal\u00edky, softv\u00e9r bude potrebn\u00e9 stiahnu\u0165 bu\u010f z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">webovej str\u00e1nky projektu<\/a><\/noindex>, alebo z extern\u00e9ho repozit\u00e1ra na slu\u017ebe <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (ak mu d\u00f4verujete):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nZoznam dostupn\u00fdch bal\u00edkov m\u00f4\u017eete zobrazi\u0165 pomocou nasleduj\u00faceho pr\u00edkazu:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPotrebujeme softether-vpnserver (server v testovacej konfigur\u00e1cii je spusten\u00fd na VDS), ako aj softether-vpncmd \u2014 pr\u00edkazov\u00e9 n\u00e1stroje na jeho nastavenie.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nNa nastavenie servera sa pou\u017e\u00edva \u0161peci\u00e1lny pr\u00edkazov\u00fd n\u00e1stroj:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPodrobne sa nebudeme rozpr\u00e1va\u0165 o konfigur\u00e1cii: postup je dos\u0165 jednoduch\u00fd, je dobre pop\u00edsan\u00fd v mnoh\u00fdch publik\u00e1ci\u00e1ch a priamo sa net\u00fdka t\u00e9my \u010dl\u00e1nku. Ak to zhrnieme, po spusten\u00ed vpncmd je potrebn\u00e9 vybra\u0165 bod 1, aby sme pre\u0161li do konzoly pre spr\u00e1vu servera. Na to je potrebn\u00e9 zada\u0165 n\u00e1zov localhost a stla\u010di\u0165 enter namiesto zad\u00e1vania n\u00e1zvu hubu. V konzole sa nastav\u00ed administr\u00e1torsk\u00fd heslo pr\u00edkazom serverpasswordset, odstr\u00e1ni sa virtu\u00e1lny hub DEFAULT (pr\u00edkaz hubdelete) a vytvor\u00ed sa nov\u00fd s n\u00e1zvom Suricata_VPN a nastav\u00ed sa jeho heslo (pr\u00edkaz hubcreate). Potom je potrebn\u00e9 prejs\u0165 do spr\u00e1vcovskej konzoly nov\u00e9ho hubu pomocou pr\u00edkazu hub Suricata_VPN, aby sa vytvorila skupina a pou\u017e\u00edvate\u013e pomocou pr\u00edkazov groupcreate a usercreate. Heslo pou\u017e\u00edvate\u013ea je nastaven\u00e9 pr\u00edkazom userpasswordset. <\/p>\n<p>SoftEther podporuje dva re\u017eimy prenosu prev\u00e1dzky: SecureNAT a Local Bridge. Prv\u00fd predstavuje vlastn\u00fa technol\u00f3giu budovania virtu\u00e1lnej s\u00fakromnej siete so svoj\u00edm NAT a DHCP. SecureNAT nevy\u017eaduje TUN\/TAP a ani nastavenie Netfilter alebo in\u00e9ho firewallu. Smerovanie sa nedot\u00fdka jadra syst\u00e9mu a v\u0161etky procesy s\u00fa virtualizovan\u00e9 a funguj\u00fa na akomko\u013evek VPS\/VDS bez oh\u013eadu na pou\u017e\u00edvan\u00fd hyperv\u00edzor. To vedie k vy\u0161\u0161ej z\u00e1\u0165a\u017ei procesora a zn\u00ed\u017eeniu r\u00fdchlosti v porovnan\u00ed s re\u017eimom Local Bridge, ktor\u00fd sp\u00e1ja virtu\u00e1lny hub SoftEther s fyzick\u00fdm sie\u0165ov\u00fdm adapt\u00e9rom alebo zariaden\u00edm TAP. <\/p>\n<p>Konfigur\u00e1cia je v tomto pr\u00edpade zlo\u017eit\u00e1, preto\u017ee smerovanie prebieha na \u00farovni jadra pomocou Netfilter. Na\u0161e VDS s\u00fa postaven\u00e9 na Hyper-V, preto na poslednom kroku vytv\u00e1rame lok\u00e1lny most a aktivujeme zariadenie TAP pr\u00edkazom bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes. Po opusten\u00ed konzoly spr\u00e1vy hubu uvid\u00edme v syst\u00e9me nov\u00e9 sie\u0165ov\u00e9 rozhranie, ktor\u00e9mu e\u0161te nebol pridelen\u00fd IP:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u010ealej bude potrebn\u00e9 povoli\u0165 smerovanie paketov medzi rozhraniami (ip forward), ak nie je akt\u00edvne:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\nOdkomentujeme nasleduj\u00faci riadok:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nUlo\u017e\u00edme zmeny v s\u00fabore, opust\u00edme editor a aplikujeme ich pomocou nasleduj\u00faceho pr\u00edkazu:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nPotom mus\u00edme ur\u010di\u0165 pre virtu\u00e1lnu sie\u0165 podsie\u0165 s fikt\u00edvnymi IP (napr\u00edklad, 10.0.10.0\/24) a priradi\u0165 adresu rozhraniu:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nPotom bude potrebn\u00e9 zada\u0165 pravidl\u00e1 Netfilter.<\/p>\n<p>1. V pr\u00edpade potreby povo\u013ete prich\u00e1dzaj\u00face pakety na po\u010d\u00favan\u00e9 porty (firemn\u00fd protokol SoftEther pou\u017e\u00edva HTTPS a port 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Nastavujeme NAT z podsiete 10.0.10.0\/24 na hlavn\u00fd IP servera<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Povo\u013eujeme prech\u00e1dzaj\u00face pakety z podsiete 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Povo\u013eujeme prech\u00e1dzaj\u00face pakety pre u\u017e ustanoven\u00e9 spojenia<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nAutomatiz\u00e1ciu procesu pri re\u0161tarte syst\u00e9mu pomocou inicializa\u010dn\u00fdch skriptov nech\u00e1me \u010ditate\u013eom ako \u00falohu na doma. <\/p>\n<p>Ak chcete automaticky pride\u013eova\u0165 klientom IP, budete musie\u0165 tie\u017e nain\u0161talova\u0165 nejak\u00fa slu\u017ebu DHCP pre lok\u00e1lny most. T\u00fdmto je nastavenie servera dokon\u010den\u00e9 a m\u00f4\u017eeme prejs\u0165 k klientom. SoftEther podporuje mno\u017estvo protokolov, ktor\u00fdch pou\u017eitie z\u00e1vis\u00ed od mo\u017enost\u00ed zariadenia lok\u00e1lnej siete. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKe\u010f\u017ee n\u00e1\u0161 testovac\u00ed router tie\u017e be\u017e\u00ed na Ubuntu, nain\u0161talujeme na \u0148om z extern\u00e9ho repozit\u00e1ra bal\u00edky softether-vpnclient a softether-vpncmd, aby sme mohli vyu\u017ei\u0165 firemn\u00fd protokol. Bude potrebn\u00e9 spusti\u0165 klienta:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nNa nastavenie pou\u017eijeme utilitu vpncmd, vyberieme localhost ako stroj, na ktorom be\u017e\u00ed vpnclient. V\u0161etky pr\u00edkazy sa vykon\u00e1vaj\u00fa v konzole: bude potrebn\u00e9 vytvori\u0165 virtu\u00e1lny rozhranie (NicCreate) a \u00fa\u010det (AccountCreate). <\/p>\n<p>V niektor\u00fdch pr\u00edpadoch je potrebn\u00e9 ur\u010di\u0165 sp\u00f4sob autentifik\u00e1cie pomocou pr\u00edkazov AccountAnonymousSet, AccountPasswordSet, AccountCertSet a AccountSecureCertSet. Ke\u010f\u017ee nepou\u017e\u00edvame DHCP, adresa pre virtu\u00e1lny adapt\u00e9r sa nastavuje manu\u00e1lne. <\/p>\n<p>Okrem toho bude potrebn\u00e9 povoli\u0165 ip forward (parametr net.ipv4.ip_forward=1 v s\u00fabore \/etc\/sysctl.conf) a nastavi\u0165 statick\u00e9 trasy. V pr\u00edpade potreby m\u00f4\u017eete na VDS s Suricata nastavi\u0165 preposielanie portov na pou\u017e\u00edvanie slu\u017eieb nain\u0161talovan\u00fdch v lok\u00e1lnej sieti. T\u00fdmto je spojenie siet\u00ed pova\u017eovan\u00e9 za dokon\u010den\u00e9.<\/p>\n<p>Navrhovan\u00e1 konfigur\u00e1cia bude vyzera\u0165 pribli\u017ene takto:<\/p>\n<p><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Nastavujeme Suricata<\/h2>\n<p>\nV <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">predch\u00e1dzaj\u00facej \u010dl\u00e1nku<\/a><\/noindex> Hovorili sme o dvoch re\u017eimoch fungovania IDS: cez front NFQUEUE (re\u017eim NFQ) a cez zero copy (re\u017eim AF_PACKET). Druh\u00fd vy\u017eaduje pr\u00edtomnos\u0165 dvoch rozhran\u00ed, ale vyzna\u010duje sa vy\u0161\u0161ou efektivitou \u2014 pou\u017eijeme pr\u00e1ve ten. Parameter je predvolene nastaven\u00fd v \/etc\/default\/suricata. Taktie\u017e bude potrebn\u00e9 upravi\u0165 sekciu vars v \/etc\/suricata\/suricata.yaml a zap\u00edsa\u0165 tam virtu\u00e1lnu podsiete ako dom\u00e1cu.<\/p>\n<p><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa re\u0161tartovanie IDS pou\u017eijeme pr\u00edkaz:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\nRie\u0161enie je hotov\u00e9, teraz si mo\u017eno budete chcie\u0165 overi\u0165 jeho odolnos\u0165 vo\u010di \u00fatokom \u00fato\u010dn\u00edkov.<\/p>\n<h2>Modelujeme \u00fatoky<\/h2>\n<p>\nExistuje nieko\u013eko scen\u00e1rov bojov\u00e9ho nasadenia extern\u00e9ho servisu IDS:<\/p>\n<p><b>Ochrana proti DDoS \u00fatokom (hlavn\u00e9 ur\u010denie)<\/b><\/p>\n<p>Realizova\u0165 tak\u00fato mo\u017enos\u0165 v r\u00e1mci firemnej siete je zlo\u017eit\u00e1, preto\u017ee pakety na anal\u00fdzu musia prejs\u0165 na rozhran\u00ed syst\u00e9mu, ktor\u00e9 sleduje internet. Aj ke\u010f ich IDS zablokuje, parazitn\u00fd traffic m\u00f4\u017ee polo\u017ei\u0165 prenosov\u00fd kan\u00e1l. Aby ste tomu predi\u0161li, je potrebn\u00e9 si objedna\u0165 VPS s dostato\u010dne v\u00fdkonn\u00fdm internetov\u00fdm pripojen\u00edm, ktor\u00e9 bez probl\u00e9mov prejde cel\u00fa prev\u00e1dzku lok\u00e1lnej siete a cel\u00fd extern\u00fd traffic. Urobi\u0165 to je \u010dasto jednoduch\u0161ie a lacnej\u0161ie, ne\u017e roz\u0161irova\u0165 kancel\u00e1rsky kan\u00e1l. Ako alternat\u00edvu stoj\u00ed za to spomen\u00fa\u0165 \u0161pecializovan\u00e9 slu\u017eby na ochranu proti DDoS. Cena ich slu\u017eieb je porovnate\u013en\u00e1 s cenou virtu\u00e1lneho servera, pri\u010dom nebude potrebn\u00e1 n\u00e1ro\u010dn\u00e1 konfigur\u00e1cia, no existuj\u00fa aj nev\u00fdhody \u2014 za svoje peniaze z\u00e1kazn\u00edk dost\u00e1va iba ochranu proti DDoS, zatia\u013e \u010do vlastn\u00fd IDS si mo\u017eno nakonfigurova\u0165 pod\u013ea vlastn\u00fdch predst\u00e1v.<\/p>\n<p><b>Ochrana pred extern\u00fdmi \u00fatokmi in\u00e9ho druhu<\/b> <\/p>\n<p>Suricata je schopn\u00e1 zvl\u00e1dnu\u0165 pokusy o zneu\u017eitie r\u00f4znych zranite\u013enost\u00ed v slu\u017eb\u00e1ch firemnej siete pr\u00edstupn\u00fdch z internetu (po\u0161tov\u00fd server, webov\u00fd server a webov\u00e9 aplik\u00e1cie at\u010f.). Zvy\u010dajne je IDS nain\u0161talovan\u00fd vo vn\u00fatri lok\u00e1lky za hranicami zariaden\u00ed, ale jeho umiestnenie aj vonku m\u00e1 opodstatnenie.<\/p>\n<p><b>Ochrana pred vn\u00fatorn\u00fdmi \u00fato\u010dn\u00edkmi<\/b><\/p>\n<p>Napriek v\u0161etk\u00fdm snah\u00e1m syst\u00e9mov\u00e9ho administr\u00e1tora m\u00f4\u017eu by\u0165 po\u010d\u00edta\u010de v podnikovej sieti infikovan\u00e9 \u0161kodliv\u00fdm softv\u00e9rom. Okrem toho sa v lok\u00e1lnej sieti ob\u010das objavia \u201ehoolig\u00e1ni\u201c, ktor\u00ed sa sna\u017eia vykon\u00e1va\u0165 ur\u010dit\u00e9 nez\u00e1konn\u00e9 oper\u00e1cie. Suricata m\u00f4\u017ee pom\u00f4c\u0165 zablokova\u0165 tak\u00e9to pokusy, hoci pre ochranu vn\u00fatornej siete je lep\u0161ie ju nain\u0161talova\u0165 vo vn\u00fatri perimetra a pou\u017ei\u0165 ju v p\u00e1re s prep\u00edna\u010dom s mo\u017enos\u0165ou zrkadli\u0165 sie\u0165ov\u00fd prenos na jeden port. Extern\u00e1 IDS v tomto pr\u00edpade nie je tie\u017e zbyto\u010dn\u00e1 \u2013 aspo\u0148 dok\u00e1\u017ee zachyti\u0165 pokusy malv\u00e9ru v lok\u00e1lnej sieti skontaktova\u0165 sa s extern\u00fdm serverom.<\/p>\n<p>Na za\u010diatok vytvor\u00edme \u010fal\u0161\u00ed testovac\u00ed \u00fato\u010dn\u00fd VPS, a na routeri lok\u00e1lnej siete spust\u00edme Apache s predvolenou konfigur\u00e1ciou, po \u010dom preposunieme na\u0148 80. port zo servera IDS. N\u00e1sledne budeme imitova\u0165 DDoS \u00fatok z \u00fato\u010dn\u00e9ho uzla. Na tento \u00fa\u010del stiahneme z GitHubu, skompilujeme a spust\u00edme na \u00fato\u010dnom uzle mal\u00fd program xerxes (m\u00f4\u017ee by\u0165 potrebn\u00e9 nain\u0161talova\u0165 bal\u00edk gcc):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nV\u00fdsledok jeho \u010dinnosti bol nasleduj\u00faci:<\/p>\n<p><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata zadr\u017e\u00ed \u00fato\u010dn\u00edka a str\u00e1nka Apache s predvolenou konfigur\u00e1ciou sa otvor\u00ed, napriek na\u0161ej improvizovanej \u00fatoku a dos\u0165 slab\u00e9mu kan\u00e1lu \u201ekancel\u00e1rskej\u201c (v skuto\u010dnosti dom\u00e1cej) siete. Pre seri\u00f3znej\u0161ie \u00falohy sa oplat\u00ed pou\u017ei\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. Je ur\u010den\u00fd na vykon\u00e1vanie testov na prenikanie a umo\u017e\u0148uje simulova\u0165 r\u00f4zne \u00fatoky. In\u0161trukcie na in\u0161tal\u00e1ciu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">je dostupn\u00e1<\/a><\/noindex> n\u00e1jdete na str\u00e1nke projektu. Po in\u0161tal\u00e1cii bude potrebn\u00e9 aktualizova\u0165:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nNa testovanie sp\u00fa\u0161\u0165ame msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBohu\u017eia\u013e, v posledn\u00fdch verzi\u00e1ch r\u00e1mca ch\u00fdba mo\u017enos\u0165 automatick\u00e9ho hackovania, tak\u017ee exploity bude treba prech\u00e1dza\u0165 manu\u00e1lne a sp\u00fa\u0161\u0165a\u0165 pomocou pr\u00edkazu use. Najprv by ste mali ur\u010di\u0165 otvoren\u00e9 porty na napadenej ma\u0161ine, napr\u00edklad pomocou nmap (v na\u0161om pr\u00edpade ho dos\u0165 dobre nahrad\u00ed netstat na napadn\u00fa\u0165 uzle), a potom vybra\u0165 a pou\u017ei\u0165 vhodn\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">moduly Metasploit<\/a><\/noindex>.\u00a0<\/p>\n<p>Existuj\u00fa aj \u010fal\u0161ie prostriedky na kontrolu odolnosti IDS proti \u00fatokom, vr\u00e1tane online slu\u017eieb. Z \u010d\u00edrej zvedavosti si m\u00f4\u017eete urobi\u0165 stresov\u00e9 testovanie pomocou sk\u00fa\u0161obnej verzie <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser<\/a><\/noindex>. Ak chcete overi\u0165 reakciu na \u010dinnosti vn\u00fatorn\u00fdch zlodejov, stoj\u00ed za to nain\u0161talova\u0165 \u0161peci\u00e1lne n\u00e1stroje na jeden z po\u010d\u00edta\u010dov v miestnej sieti. Mo\u017enost\u00ed je mno\u017estvo a ob\u010das by sa mali aplikova\u0165 nielen na experiment\u00e1lnu platformu, ale aj na pracovn\u00e9 syst\u00e9my, len\u017ee to je u\u017e \u00faplne in\u00fd pr\u00edbeh.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort alebo Suricata. \u010cas\u0165 3: chr\u00e1nime kancel\u00e1rsku sie\u0165 | ProHoster","description":"V predch\u00e1dzaj\u00facom \u010dl\u00e1nku sme povedali, ako spusti\u0165 stabiln\u00fa verziu Suricata v Ubuntu 18.04 LTS.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2026-08-11 12:50:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}