Yedu cyber Defense Center ine basa rekuchengetedza webhu yevatengi uye inodzinga kurwiswa kunzvimbo dzevatengi. Kuti tidzivirire pakurwiswa, tinoshandisa FortiWeb Web Application Firewalls (WAFs). Asi kunyange iyo inotonhorera WAF haisi panacea uye haidziviriri "kunze kwebhokisi" kubva pakurwiswa kwakanangwa.
Naizvozvo, kuwedzera kune WAF, isu tinoshandisa . Inobatsira kuunganidza zviitiko zvose munzvimbo imwe chete, inounganidza nhamba, inozviona uye inotibvumira kuona kurwisa kwakanangwa munguva.
Nhasi ini ndichakuudza zvakadzama kuti takayambuka sei muti weKisimusi neWAF uye chii chakabuda mairi.
Nyaya yekurwiswa kumwe chete: kuti zvese zvakashanda sei zvisati zvachinja kune ELK
Mugore redu, mutengi akaisa application kuseri kweWAF yedu. Kubva pa10 kusvika ku000 vashandisi vanobatana nesaiti pazuva, nhamba yekubatanidza yakasvika mamirioni makumi maviri pazuva. Pakati peizvi, vashandisi 100-000 vaive vapambi uye vakaedza kubaya saiti.
Iyo yakajairika fomu brute force kubva kune imwe IP kero yakavharwa neFortiWeb zviri nyore. Huwandu hwekurova saiti paminiti yaive yakakwira kupfuura yevashandisi vari pamutemo. Isu takangoseta zvikumbaridzo zvezviitiko kubva kune imwe kero uye tikadzora kurwiswa.
Zvakanyanya kuoma kubata ne "zvishoma zvishoma", apo vanorwisa vanoita zvishoma nezvishoma uye vachizvivanza sevatengi vakajairwa. Ivo vanoshandisa akawanda akasiyana IP kero. Chiitiko chakadaro hachina kutaridzika sechisimba chakakura kuWAF, zvaive zvakanyanya kuoma kuitevera otomatiki. Uye pakanga painewo njodzi yekuvharisa vashandisi vakajairwa. Isu takatsvaga zvimwe zviratidzo zvekurwiswa uye takamisa mutemo wekuvharisa otomatiki IP kero zvichienderana nechiratidzo ichi. Semuyenzaniso, masesheni akawanda asiri emutemo aive nezvikamu zvakajairika muhttp yekukumbira misoro. Iwe kazhinji waifanira kutsvaga minda yakadaro nemaoko muFortiWeb chiitiko matanda.
Zvakatora nguva uye kusagadzikana. Mukushanda kwakajairwa kweFortiWeb, zviitiko zvinorekodhwa muzvinyorwa mumatanda matatu akasiyana: kurwiswa kwakaonekwa, ruzivo nezve zvikumbiro, uye mameseji ehurongwa nezve WAF mashandiro. Mazana kana mazana ezviitiko zvekurwisa zvinogona kuuya muminiti.
Kwete zvakanyanya, asi iwe unofanirwa kukwira nemaoko kuburikidza nematanda akati wandei uye kudzokorora pamusoro pemitsetse yakawanda:
Muirogi rekurwisa, tinoona kero dzevashandisi uye chimiro chechiitiko.
Hazvina kukwana kungotarisa tafura yelog. Kuti uwane iyo inonyanya kunakidza uye inobatsira nezvemhando yekurwiswa, unofanirwa kutarisa mukati mechimwe chiitiko:
Minda yakasimudzwa inobatsira kuona "inononoka kurwisa". Kunobva: skrini kubva .
Zvakanaka, dambudziko guru nderekuti chete FortiWeb nyanzvi inogona kuzvifungidzira. Kana mukati memaawa ebhizinesi isu tichiri kugona kuteedzera chiitiko chekufungidzira munguva chaiyo, saka kuferefetwa kwezviitiko zvehusiku kunogona kunonoka. Kana mitemo yeFortiWeb isina kushanda nechikonzero chakati, mainjiniya ehusiku ari pabasa haana kukwanisa kuongorora mamiriro ezvinhu pasina kuwana WAF uye akamutsa nyanzvi yeFortiWeb. Takatarisa mukati mematanda kwemaawa akawanda uye takawana nguva yekurwisa.
Nemavhoriyamu eruzivo akadai, zvakaoma kunzwisisa mufananidzo mukuru nekungotarisa uye kuita zvine hungwaru. Ipapo takasarudza kuunganidza dhata munzvimbo imwechete kuti tiongorore zvese muchimiro chekuona, tsvaga kutanga kwekurwiswa, tsvaga kutungamira kwayo uye nzira yekuvharira.
Wakasarudza kubva kupi
Chekutanga, takatarisa mhinduro dzatove kushandiswa, kuitira kuti tisawanze masangano zvisina basa.
Imwe yesarudzo dzekutanga yaive Nagiosyatinoshandisa kuongorora , , chenjedzo. Vachengetedzi vanoishandisa zvakare kuzivisa varindi kana paine fungidziro yemotokari, asi haizive nzira yekuunganidza matanda akapararira nekudaro inonyangarika.
Paive nesarudzo yekubatanidza zvese nayo MySQL uye PostgreSQL kana imwe database yehukama. Asi kuti uburitse iyo data, zvaive zvakafanira kuveza application yako.
Semunhu anounganidza matanda mukambani yedu ivo vanoshandisawo FortiAnalyzer kubva kuFortinet. Asi munyaya iyi, haanawo kukodzera. Chekutanga, inorodzwa zvakanyanya kushanda nefirewall FortiGate. Kechipiri, marongero mazhinji aive asipo, uye kudyidzana nayo kwaida ruzivo rwakanyanya rwemibvunzo yeSQL. Uye chechitatu, kushandiswa kwayo kwaizowedzera mutengo webasa kumutengi.
Aya ndiwo matangiro atakaita kuvhura source kumeso ELK:.
Sei uchisarudza ELK
ELK seti yeakavhurika sosi zvirongwa:
- Elasticsearch - dhatabhesi yenguva yakatevedzana, iyo yakangogadzirwa kuti ishande nemavhoriyamu makuru ezvinyorwa;
- logstash - dhizaini yekuunganidza data inogona kushandura matanda kune yaunoda fomati;
- kibana - yakanaka yekuona, pamwe neyakajeka ine hushamwari interface yekugadzirisa Elasticsearch. Unogona kuishandisa kuvaka masheti anogona kutariswa nemainjiniya ebasa usiku.
Chikumbaridzo che ELK chakaderera. Zvese zvakakosha maficha ndeemahara. Chii chimwe chinodiwa pakufara.
Wakazvibatanidza sei pamwe chete muhurongwa humwe?
Yakagadzira indexes uye yakasiya chete ruzivo rwakakosha. Isu takatakura ese matatu FortiWEB matanda muELK - iyo yakabuda yaive indexes. Aya mafaera ane ese akaunganidzwa matanda kwenguva, semuenzaniso, zuva. Kana tikavaona ipapo ipapo, taizongoona masimba ekurwisa. Kuti uwane ruzivo, iwe unofanirwa "kudonha" mukurwiswa kwega kwega uye kutarisa kune chaiwo minda.
Takaona kuti chokutanga tinoda kumisikidza kupatsanurwa kwemashoko asina kurongeka. Takatora minda mirefu setambo, senge "Mharidzo" uye "URL", uye tikaiparadzanisa kuti tiwane rumwe ruzivo rwekuita sarudzo.
Semuenzaniso, tichishandisa kupatsanura, takatora nzvimbo yemushandisi zvakasiyana. Izvi zvakabatsira nekukasira kuratidza kurwiswa kubva kunze kwenyika pamasaiti evashandisi veRussia. Nekuvhara zvese zvinongedzo kubva kune dzimwe nyika, isu takadzikisa huwandu hwekurwiswa ne2 nguva uye taigona kubata nyore nekurwiswa mukati meRussia.
Mushure mekutaura, vakatanga kutsvaga ruzivo rwekuchengetedza nekuona. Kusiya zvinhu zvose murogi kwakanga kusina kukodzera: ukuru hweimwe index yakanga yakakura - 7 GB. ELK yakatora nguva yakareba kugadzirisa faira. Zvisinei, haasi mashoko ose aibatsira. Chimwe chinhu chakadhindwa uye chakatora imwe nzvimbo - zvaive zvakafanira kukwirisa.
Pakutanga, takangotarisa kuburikidza nendekisi uye takabvisa zviitiko zvisingakoshi. Izvi zvakazonyanya kunetsa uye zvakareba kupfuura kushanda nematanda paFortiWeb pachayo. Iyo chete yekuwedzera kubva ku "muti weKisimusi" panguva ino ndeyekuti isu takakwanisa kuona nguva yakakura pane imwe skrini.
Hatina kuora mwoyo, takaramba tichidya cactus uye kudzidza ELK uye takatenda kuti taizokwanisa kubvisa ruzivo rwakakosha. Mushure mekuchenesa ma indexes, takatanga kufungidzira kuti chii. Saka takasvika kune dashboards hombe. Isu takakwenya majeti - zvinotaridzika uye zvinoyevedza, chaiyo ΠLKa!
Akabata nguva yekurwisa. Zvino zvakanga zvakakodzera kunzwisisa kuti kutanga kwekurwisa kunotarisa sei pane chati. Kuti tizvione, takatarisa mhinduro dzesevha kumushandisi (kudzorera makodhi). Isu taifarira mhinduro dzeseva nemakodhi akadaro (rc):
Kodhi (rc)
Title
tsananguro
0
DONHEDZA
Chikumbiro kuseva chakavharwa
200
Ok
Chikumbiro chagadziriswa
400
Chikumbiro Chakaipa
Chikumbiro chakashata
403
Inorambidzwa
Mvumo yarambwa
500
Internal Server Error
Sevhisi haisipo
Kana mumwe munhu akatanga kurwisa saiti, chiyero chekodhi chakachinja:
- Kana paine zvimwe zvikumbiro zvisirizvo nekodhi 400, uye nhamba imwechete yezvikumbiro zvakajairika nekodhi 200, saka mumwe munhu aiedza kubaya saiti.
- Kana, panguva imwecheteyo, zvikumbiro zvine kodhi 0 zvakare zvakakura, ipapo vezvematongerwo enyika veFortiWeb "vakaona" kurwiswa uye vakashandisa zvidhinha kwairi.
- Kana iyo nhamba yemeseji ine kodhi 500 yakawedzera, saka saiti haisi kuwanikwa kune idzi IP kero - zvakare rudzi rwekuvhara.
Pakazosvika mwedzi wechitatu, takanga tagadzira dashboard kuti titevere basa iri.
Kuti tisatarise zvese nemaoko, isu tinomisa kubatanidzwa neNagios, iyo yakabvunzurudza ELK pane dzimwe nguva. Kana iyo yakanyora kubudirira kwechikumbaridzo kukosha nemakodhi, yakatumira chiziviso kuvakuru vebasa nezve chiitiko chekufungidzira.
Yakasanganiswa 4 machati mune yekutarisa system. Iye zvino zvaive zvakakosha kuona pamagirafu nguva iyo kurwiswa kusina kuvharwa uye kupindira kweinjiniya kunodiwa. Pamagirafu mana akasiyana, ziso redu rakanga rakasviba. Naizvozvo, takabatanidza machati uye takatanga kuona zvese pane imwe skrini.
Pakutarisa, takatarisa kuti magirafu emavara akasiyana anochinja sei. Kuputika kwehutsvuku kwakaratidza kuti kurwiswa kwatanga, nepo orenji nebhuruu magirafu airatidza kuita kwaFortiWeb:
Zvese zvakanaka pano: pakave nekuwedzera kwe "red" chiitiko, asi FortiWeb yakakunda uye chirongwa chekurwisa chakashaya basa.
Takazvichererawo muenzaniso wegirafu inoda kupindira:
Pano tinogona kuona kuti FortiWeb yakawedzera basa, asi iyo tsvuku yekurwisa girafu haina kuderera. Iwe unofanirwa kushandura WAF marongero.
Kuongorora zviitiko zvehusiku zvakare kwave nyore. Iyo girafu inokurumidza kuratidza iyo nguva kana yave nguva yekuuya kune kudzivirira kwesaiti.
Ndizvo dzimwe nguva zvinoitika usiku. Red girafu - kurwisa kwatanga. Bhuruu - FortiWeb chiitiko. Kurwisa kwacho hakuna kuvharwa zvachose, taifanira kupindira.
Tiri kuenda kupi
Iye zvino tiri kudzidzisa vatariri vebasa kushanda neELK. Varindiri vanodzidza kuongorora mamiriro ezvinhu padashboard uye kuita sarudzo: inguva yekukwira kune FortiWeb nyanzvi, kana marongero ari paWAF anokwana kudzoreredza kurwiswa. Saka isu tinodzikisira mutoro kune mainjiniya ekuchengetedza ruzivo usiku uye tinogovanisa mabasa ekutsigira padanho rehurongwa. Kuwanika kuFortiWeb kunoramba kuine cyber defense centre, uye ivo chete ndivo vanoita shanduko kune WAF marongero kana ichidiwa nekukurumidza.
Isu tiri kushandawo pakushuma kune vatengi. Isu tinoronga kuti data pamusoro peiyo dynamics yebasa reWAF ichave iripo muaccount yemutengi. ELK ichaita kuti mamiriro acho ave pachena pasina chikonzero chekutaura kune WAF pachayo.
Kana mutengi achida kutarisa kuchengetedzwa kwavo munguva chaiyo, ELK ichauyawo inobatsira. Hatigone kupa mukana kuWAF, sezvo kupindira kwemutengi mubasa kunogona kukanganisa vamwe. Asi iwe unogona kutora ELK yakasiyana uye ugoipa "kutamba-tamba".
Aya ndiwo mamiriro ekushandisa muti weKisimusi watakaunganidza nguva pfupi yadarika. Govera pfungwa dzako pane izvi uye usakanganwa kudzivirira kudonha kwedatabase.
Source: www.habr.com