{"id":31057,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","title":{"rendered":"Si ta merrni n\u00ebn kontroll infrastruktur\u00ebn rrjetore. Kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e dyt\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Ky kjo artikull \u00ebsht\u00eb e kat\u00ebrta n\u00eb serin\u00eb e artikujve \"Si t\u00eb marrim n\u00ebn kontroll infrastruktur\u00ebn rrjet\u00ebsore\". P\u00ebrmbajtjen e gjith\u00eb seris\u00eb s\u00eb artikujve dhe lidhjet mund t'i gjeni <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">k\u00ebtu<\/a><\/noindex><\/i>.<\/p>\n<p>N\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjes\u00ebn e par\u00eb<\/a><\/noindex> n\u00eb k\u00ebt\u00eb kapitull ne shqyrtuam disa aspekte t\u00eb siguris\u00eb rrjet\u00ebsore t\u00eb segmentit \"Qendra e t\u00eb Dh\u00ebnave\". Ky pjes\u00eb do t\u00eb jet\u00eb e p\u00ebrkushtuar segmentit \"Qasje n\u00eb Internet\". <\/p>\n<p><img decoding=\"async\" alt=\"Si ta merrni n\u00ebn kontroll infrastruktur\u00ebn rrjetore. Kapitulli i tret\u00eb. Siguria e rrjetit. Pjesa e dyt\u00eb\" src=\"\/wp-content\/uploads\/2019\/04\/10b33f9b02e3a7562d9e7cf023cbc197.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>Qasja n\u00eb Internet<\/h1>\n<p>\nTema e siguris\u00eb padyshim q\u00eb \u00ebsht\u00eb nj\u00eb nga temat m\u00eb t\u00eb komplikuara n\u00eb bot\u00ebn e rrjetave t\u00eb transmetimit t\u00eb t\u00eb dh\u00ebnave. Si n\u00eb rastet e m\u00ebparshme, pa pretenduar p\u00ebr thell\u00ebsi dhe plot\u00ebsi, do t\u00eb shqyrtoj k\u00ebtu disa pyetje mjaft t\u00eb thjeshta, por, sipas mendimit tim, t\u00eb r\u00ebnd\u00ebsishme, p\u00ebrgjigjet e t\u00eb cilave shpresoj se do t\u00eb ndihmojn\u00eb n\u00eb rritjen e nivelit t\u00eb siguris\u00eb s\u00eb rrjetit tuaj.<\/p>\n<p>Gjat\u00eb auditi t\u00eb k\u00ebtij segmenti, kushtoni v\u00ebmendje aspekteve t\u00eb m\u00ebposhtme:<\/p>\n<ul>\n<li>i instaluesit \u00ebsht\u00eb futur. Po ashtu, \u00ebsht\u00eb disponueshme mund\u00ebsia p\u00ebr t\u00eb instaluar driverin pron\u00ebsor p\u00ebr kartat grafike Nvidia gjat\u00eb instalimit t\u00eb sistemit operativ dhe dy m\u00ebnyra p\u00ebr ndarjen e disqeve: plot\u00ebsisht manuale dhe automatike me enkriptimin e plot\u00eb t\u00eb t\u00eb gjitha pjes\u00ebve.<\/li>\n<li>konfigurimit t\u00eb BGP <\/li>\n<li>Mbrojtja DOS\/DDOS<\/li>\n<li>filtrimin e trafikut n\u00eb firewall<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Dizajni<\/h3>\n<p>\nSi nj\u00eb shembull t\u00eb dizajnit t\u00eb k\u00ebtij segmenti p\u00ebr rrjetin e nd\u00ebrmarrjes, do t\u00eb rekomandoja <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-pin-secure-internet-edge.pdf\">manual<\/a><\/noindex> nga Cisco n\u00eb kuad\u00ebr t\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">modelit SAFE<\/a><\/noindex>.<\/p>\n<p>Natyrisht, mund t\u00eb duket se zgjidhjet e ofruesve t\u00eb tjer\u00eb jan\u00eb m\u00eb t\u00ebrheq\u00ebse p\u00ebr ju (shih <noindex><a rel=\"nofollow\" href=\"https:\/\/researchcenter.paloaltonetworks.com\/2018\/10\/palo-alto-networks-seven-time-gartner-magic-quadrant-leader\/\">katrori i Gartner p\u00ebr 2018<\/a><\/noindex>), por, pa ju inkurajuar t\u00eb ndiqni k\u00ebt\u00eb dizajn n\u00eb detaje, un\u00eb gjithashtu e mendoj t\u00eb dobish\u00ebm t\u00eb kuptoni parimet dhe idet\u00eb q\u00eb q\u00ebndrojn\u00eb n\u00eb themel t\u00eb tij.<\/p>\n<blockquote><p><b>V\u00ebrejtje<\/b><\/p>\n<p>N\u00eb segmentin SAFE, \"Qasja e Larg\u00ebt\" \u00ebsht\u00eb nj\u00eb pjes\u00eb e \"Qasjes n\u00eb Internet\". Por n\u00eb k\u00ebt\u00eb seri artikujsh do ta shqyrtojm\u00eb at\u00eb ve\u00e7mas.<\/p><\/blockquote>\n<p>Grupi standard i pajisjeve n\u00eb k\u00ebt\u00eb segment p\u00ebr rrjetin e nd\u00ebrmarrjes (enterprise network) jan\u00eb <\/p>\n<ul>\n<li>routerat kufitar\u00eb (border routers)<\/li>\n<li>firewall-et<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Sh\u00ebnim 1<\/b><\/p>\n<p>N\u00eb k\u00ebt\u00eb seri artikujsh, kur flas p\u00ebr firewall, n\u00ebnkuptoj <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Next-generation_firewall\">NGFW<\/a><\/noindex>.<\/p><\/blockquote>\n<blockquote><p><b>Sh\u00ebnim 2<\/b><\/p>\n<p>Un\u00eb po e anashkaloj shqyrtimin e ndryshimeve t\u00eb llojeve L2\/L1 ose zgjidhjeve L2 mbi L3 t\u00eb nevojshme p\u00ebr t\u00eb siguruar lidhshm\u00ebrin\u00eb L1\/L2 dhe po kufizohem vet\u00ebm n\u00eb pyetje t\u00eb nivelit L3 e lart. N\u00eb pjes\u00ebn e nj\u00ebjt\u00eb, pyetje t\u00eb L1\/L2 jan\u00eb shqyrtuar n\u00eb kapitullin \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">Pastrimi dhe dokumentimi<\/a><\/noindex>&#171;.<\/p><\/blockquote>\n<p> N\u00ebse nuk e keni identifikuar nj\u00eb firewall n\u00eb k\u00ebt\u00eb segment, mos u nxito p\u00ebr t\u00eb nxjerr\u00eb p\u00ebrfundime.<\/p>\n<p>Le t\u00eb fillojm\u00eb, si n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjes\u00ebn e kaluar<\/a><\/noindex>, me pyetjen, a \u00ebsht\u00eb e nevojshme p\u00ebrdorimi i nj\u00eb firewall n\u00eb k\u00ebt\u00eb segment n\u00eb rastin tuaj?<\/p>\n<p>Mund t\u00eb them se, duket se kjo \u00ebsht\u00eb vendi m\u00eb i arsyesh\u00ebm p\u00ebr p\u00ebrdorimin e firewall-eve dhe p\u00ebr aplikimin e algoritmeve komplekse t\u00eb filtrimit t\u00eb trafikut. N\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjesa 1<\/a><\/noindex> ne p\u00ebrmend\u00ebm 4 faktor\u00eb q\u00eb mund t\u00eb pengojn\u00eb p\u00ebrdorimin e firewall-eve n\u00eb segmentin e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave. Por k\u00ebtu ata nuk jan\u00eb m\u00eb kaq thelb\u00ebsor\u00eb.<\/p>\n<blockquote><p>Shembulli 1. <b>Vonesa<\/b><\/p>\n<p>N\u00eb lidhje me internetin, nuk ka kuptim t\u00eb flitet p\u00ebr vonesa edhe prej 1 milisekunde. Prandaj, vonesa n\u00eb k\u00ebt\u00eb segment nuk mund t\u00eb jet\u00eb nj\u00eb faktor q\u00eb kufizon p\u00ebrdorimin e firewall-it.<\/p><\/blockquote>\n<blockquote><p>Shembulli 2. <b>Performanca<\/b><\/p>\n<p>N\u00eb disa raste, ky faktor ende mund t\u00eb jet\u00eb thelb\u00ebsor. Prandaj, ndoshta do t\u00eb duhet t\u00eb drejtoni nj\u00eb pjes\u00eb t\u00eb trafikut (p\u00ebr shembull, trafikun e balancuesve t\u00eb ngarkes\u00ebs) p\u00ebrmes nj\u00eb m\u00ebnyre bypass, p\u00ebrve\u00e7 firewall-it.<\/p><\/blockquote>\n<blockquote><p>Shembulli 3. <b>Besueshm\u00ebria<\/b><\/p>\n<p>Ky faktor ende duhet t\u00eb merret parasysh, por duke marr\u00eb parasysh pabesueshm\u00ebrin\u00eb e vet\u00eb internetit, rangu i tij n\u00eb k\u00ebt\u00eb segment nuk \u00ebsht\u00eb aq i r\u00ebnd\u00ebsish\u00ebm sa p\u00ebr qendr\u00ebn e t\u00eb dh\u00ebnave. <\/p>\n<p>K\u00ebshtu, le t\u00eb supozojm\u00eb se sh\u00ebrbimi juaj ekziston mbi http\/https (me seanca t\u00eb shkurtra). N\u00eb k\u00ebt\u00eb rast, mund t\u00eb p\u00ebrdorni dy kutia t\u00eb pavarura (pa HA) dhe n\u00eb rast t\u00eb ndonj\u00eb problemi me nj\u00ebr\u00ebn prej tyre, t\u00eb redirigjoni t\u00eb gjith\u00eb trafikun n\u00eb t\u00eb dyt\u00ebn. <\/p>\n<p>Ose mund t\u00eb p\u00ebrdorni firewall-et n\u00eb modalitetin transparent dhe, n\u00eb rast se ato dalin jasht\u00eb funksionit, p\u00ebrkoh\u00ebsisht t\u00eb lejoni trafikun t\u00eb kaloj\u00eb p\u00ebrmes firewall-eve.<\/p><\/blockquote>\n<p> Prandaj, ndoshta \u00ebsht\u00eb vet\u00ebm <b>\u00e7mimi<\/b> ai faktor q\u00eb do t'ju detyroj\u00eb t\u00eb heqni dor\u00eb nga p\u00ebrdorimi i firewall-eve n\u00eb k\u00ebt\u00eb segment.<\/p>\n<blockquote><p><b>\u00cb r\u00ebnd\u00ebsishme!<\/b><\/p>\n<p>Ka nj\u00eb tundim t\u00eb kombinohet ky firewall me firewall-in e qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave (t\u00eb p\u00ebrdoret nj\u00eb firewall p\u00ebr k\u00ebto segmente). Nj\u00eb zgjidhje, n\u00eb parim, \u00ebsht\u00eb e mundur, por, megjithat\u00eb, duhet t\u00eb kuptohet se, duke qen\u00eb se \"Access-i n\u00eb Internet\" firewall-i \u00ebsht\u00eb faktikisht n\u00eb vij\u00ebn e par\u00eb t\u00eb mbrojtjes tuaj dhe \"merr p\u00ebrsip\u00ebr\", t\u00eb pakt\u00ebn, nj\u00eb pjes\u00eb t\u00eb trafikut t\u00eb d\u00ebmsh\u00ebm, \u00ebsht\u00eb e qart\u00eb se duhet t\u00eb merret parasysh rreziku i rritur q\u00eb ky firewall mund t\u00eb d\u00ebshtoj\u00eb. Pra, duke p\u00ebrdorur t\u00eb nj\u00ebjtat pajisje n\u00eb k\u00ebto dy segmente, do ta ulni n\u00eb m\u00ebnyr\u00eb t\u00eb konsiderueshme disponueshm\u00ebrin\u00eb e segmentit t\u00eb qendr\u00ebs s\u00eb t\u00eb dh\u00ebnave.<\/p><\/blockquote>\n<p> Si zakonisht, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se n\u00eb var\u00ebsi t\u00eb sh\u00ebrbimit q\u00eb kompania ofron, dizajni i k\u00ebtij segmenti mund t\u00eb ndryshoj\u00eb shum\u00eb. Ju, si zakonisht, mund t\u00eb zgjidhni qasje t\u00eb ndryshme n\u00eb var\u00ebsi t\u00eb k\u00ebrkesave. <\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>N\u00ebse jeni nj\u00eb ofrues p\u00ebrmbajtjeje me nj\u00eb rrjet CDN (shihni, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/ramax\/posts\/\">serin\u00eb e artikujve<\/a><\/noindex>), at\u00ebher\u00eb mund t\u00eb mos d\u00ebshironit t\u00eb krijonit n\u00eb dhjet\u00ebra, madje qindra pik\u00eb pranimi infrastrukture duke p\u00ebrdorur pajisje t\u00eb ndryshme p\u00ebr ruterizimin dhe filtrimin e trafikut. Kjo do t\u00eb ishte e shtrenjt\u00eb dhe madje mund t\u00eb ishte e tepruar. <\/p>\n<p>P\u00ebr BGP nuk \u00ebsht\u00eb aspak e nevojshme t\u00eb keni router t\u00eb dedikuar, mund t\u00eb p\u00ebrdorni mjete open-source, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quagga.net\">Quagga<\/a><\/noindex>. K\u00ebshtu, ndoshta gjith\u00e7ka q\u00eb ju nevojitet \u00ebsht\u00eb nj\u00eb server ose disa servera, nj\u00eb switch dhe BGP.<\/p>\n<p>N\u00eb k\u00ebt\u00eb rast, serveri juaj ose disa servera mund t\u00eb luajn\u00eb rolin jo vet\u00ebm t\u00eb nj\u00eb serveri CDN, por gjithashtu edhe t\u00eb nj\u00eb routeri. Sigurisht, ka akoma shum\u00eb detaje (p\u00ebr shembull, si t\u00eb sigurohet balancimi), por kjo \u00ebsht\u00eb e realizueshme, dhe k\u00ebt\u00eb qasje e kemi zbatuar me sukses p\u00ebr nj\u00eb nga partner\u00ebt tan\u00eb.<\/p>\n<p>Ju mund t\u00eb keni disa qendra t\u00eb t\u00eb dh\u00ebnave me mbrojtje t\u00eb plot\u00eb (firewall, sh\u00ebrbime t\u00eb mbrojtjes nga DDOS, ofruar nga ofruesit tuaj t\u00eb internetit) dhe dhjet\u00ebra ose qindra pika t\u00eb pranishme \"t\u00eb thjeshta\" vet\u00ebm me switches L2 dhe servera.<\/p>\n<p>Por si q\u00ebndron mbrojtja n\u00eb k\u00ebt\u00eb rast?<\/p>\n<p>Le t\u00eb shqyrtojm\u00eb, p\u00ebr shembull, sulmin e njohur koh\u00ebt e fundit <noindex>DNS Amplification DDOS<\/noindex>. Rreziku i tij q\u00ebndron n\u00eb faktin se prodhohet nj\u00eb sasi e madhe trafiku, e cila thjesht \"bllokon\" 100% t\u00eb t\u00eb gjitha uplink-\u00ebve tuaj. <\/p>\n<p>\u00c7far\u00eb kemi n\u00eb rastin e dizajnit ton\u00eb.<\/p>\n<ul>\n<li>n\u00ebse p\u00ebrdorni AnyCast, at\u00ebher\u00eb trafiku shp\u00ebrndahet midis pikave tuaja t\u00eb pranishme. N\u00ebse bandwidth-a totale \u00ebsht\u00eb terabita, at\u00ebher\u00eb kjo n\u00eb vetvete (edhe pse koh\u00ebt e fundit kishte disa sulme me trafik t\u00eb d\u00ebmsh\u00ebm q\u00eb arrinin deri n\u00eb terabita) ju mbron nga \"mbingarkesa\" e uplink-\u00ebve.<\/li>\n<li>n\u00ebse ndonj\u00eb uplink \u00ebsht\u00eb \"bllokuar\", at\u00ebher\u00eb thjesht e hiqni k\u00ebt\u00eb platform\u00eb nga sh\u00ebrbimi (ndaloni t\u00eb shpallni prefix-in).<\/li>\n<li>ju gjithashtu mund t\u00eb rritni pjes\u00ebn e trafikut q\u00eb jepni nga qendrat tuaja t\u00eb t\u00eb dh\u00ebnave \"t\u00eb plota\" (dhe, p\u00ebr pasoj\u00eb, t\u00eb mbrojtura), duke larguar k\u00ebshtu nj\u00eb pjes\u00eb t\u00eb r\u00ebnd\u00ebsishme t\u00eb trafikut t\u00eb d\u00ebmsh\u00ebm nga pikat e pranishme t\u00eb pambrojtura.<\/li>\n<\/ul>\n<p>\nDhe nj\u00eb v\u00ebrejtje e vog\u00ebl p\u00ebr k\u00ebt\u00eb shembull. N\u00ebse nj\u00eb sasi e mjaftueshme e trafikut kalon n\u00ebp\u00ebr IX, kjo gjithashtu zvog\u00eblon ndjeshm\u00ebrin\u00eb tuaj ndaj sulmeve t\u00eb tilla.<\/p><\/blockquote>\n<h3>Konfigurimi i BGP<\/h3>\n<p>\nK\u00ebtu ka dy tema.<\/p>\n<ul>\n<li>Lidhshm\u00ebria<\/li>\n<li>Konfigurimi i BGP<\/li>\n<\/ul>\n<p>\nP\u00ebr lidhshm\u00ebrin\u00eb kemi folur pak m\u00eb par\u00eb n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjesa 1<\/a><\/noindex>. Thelbi \u00ebsht\u00eb q\u00eb trafiku p\u00ebr klient\u00ebt tuaj t\u00eb kaloj\u00eb n\u00eb rrug\u00ebn m\u00eb optimale. Megjithat\u00eb, optimaliteti nuk \u00ebsht\u00eb gjithmon\u00eb vet\u00ebm p\u00ebr vones\u00ebn, por zakonisht vonesa e ul\u00ebt \u00ebsht\u00eb treguesi kryesor i optimalitetit. P\u00ebr disa kompani, kjo \u00ebsht\u00eb m\u00eb e r\u00ebnd\u00ebsishme, p\u00ebr t\u00eb tjera - m\u00eb pak. Varet nga sh\u00ebrbimi q\u00eb ofroni.<\/p>\n<blockquote><p><b>Shembulli 1<\/b><\/p>\n<p>N\u00ebse jeni nj\u00eb exchange, dhe intervalet e koh\u00ebs m\u00eb pak se mili-sekonda jan\u00eb t\u00eb r\u00ebnd\u00ebsishme p\u00ebr klient\u00ebt tuaj, at\u00ebher\u00eb, padyshim, nuk ka asnj\u00eb fjal\u00eb p\u00ebr internetin n\u00eb p\u00ebrgjith\u00ebsi.<\/p><\/blockquote>\n<blockquote><p><b>Shembulli 2<\/b><\/p>\n<p>N\u00ebse jeni nj\u00eb kompani loj\u00ebrash, dhe jan\u00eb t\u00eb r\u00ebnd\u00ebsishme dhjetra mili-sekonda p\u00ebr ju, at\u00ebher\u00eb, sigurisht, lidhshm\u00ebria \u00ebsht\u00eb shum\u00eb e r\u00ebnd\u00ebsishme.<\/p><\/blockquote>\n<blockquote><p><b>Shembulli 3<\/b><\/p>\n<p>Po ashtu, duhet t\u00eb kuptoni se, p\u00ebr shkak t\u00eb vetive t\u00eb protokollit TCP, shpejt\u00ebsia e transferimit t\u00eb t\u00eb dh\u00ebnave brenda nj\u00eb seance TCP varet gjithashtu nga RTT (Round Trip Time). Rrjetet CDN nd\u00ebrtohen gjithashtu p\u00ebr t\u00eb zgjidhur k\u00ebt\u00eb problem, duke e sjell\u00eb server\u00ebt e shp\u00ebrndarjes s\u00eb p\u00ebrmbajtjes m\u00eb af\u00ebr konsumatorit t\u00eb k\u00ebsaj p\u00ebrmbajtjeje.<\/p><\/blockquote>\n<p> Hulumtimi i lidhshm\u00ebris\u00eb \u00ebsht\u00eb nj\u00eb tem\u00eb interesante e ve\u00e7ant\u00eb, e cila meriton nj\u00eb artikull t\u00eb ve\u00e7ant\u00eb ose nj\u00eb seri artikujsh dhe k\u00ebrkon nj\u00eb kuptim t\u00eb mir\u00eb se si \u00ebsht\u00eb \"nd\u00ebrtuar\" interneti.<\/p>\n<p>Burimet e dobishme:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/ripe.net\">ripe.net<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex><\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>Do t\u00eb jap vet\u00ebm nj\u00eb shembull t\u00eb vog\u00ebl.<\/p>\n<p>Supozoni se qendra juaj e t\u00eb dh\u00ebnave ndodhet n\u00eb Mosk\u00eb, dhe keni nj\u00eb uplink t\u00eb vet\u00ebm \u2013 Rostelecom (AS12389). N\u00eb k\u00ebt\u00eb rast (single homed) BGP ju nevojitet, dhe si adresat publike do t\u00eb p\u00ebrdorni, me siguri, nj\u00eb grup adresash nga Rostelecom. <\/p>\n<p>Supozoni se ofroni nj\u00eb sh\u00ebrbim, dhe keni nj\u00eb num\u00ebr t\u00eb mjaftuesh\u00ebm klient\u00ebsh nga Ukraina, dhe ata ankojn\u00eb p\u00ebr vonesa t\u00eb m\u00ebdha. Gjat\u00eb hulumtimit, keni zbuluar se adresat IP t\u00eb disa prej tyre jan\u00eb n\u00eb rrjetin 37.52.0.0\/21. <\/p>\n<p>Duke kryer traceroute, keni par\u00eb se trafiku kalon p\u00ebrmes AS1299 (Telia), dhe duke kryer ping, keni marr\u00eb nj\u00eb RTT mesatar prej 70 \u2014 80 mili-sekonda. Mund ta shihni k\u00ebt\u00eb gjithashtu n\u00eb <noindex><a rel=\"nofollow\" href=\"http:\/\/lg.ip.rt.ru\">looking glass t\u00eb Rostelecom<\/a><\/noindex>.<\/p>\n<p>Me utilitarin whois (n\u00eb faqen e ripe.net ose utilitarin lokal) leht\u00ebsisht mund t\u00eb p\u00ebrcaktoni se blloku 37.52.0.0\/21 i p\u00ebrket AS6849 (Ukrtelecom).<\/p>\n<p>M\u00eb tej, duke hyr\u00eb n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex> shihni se AS6849 nuk ka marr\u00ebdh\u00ebnie me AS12389 (ata nuk jan\u00eb as klient\u00eb, as uplinks p\u00ebr nj\u00ebri-tjetrin, as nuk kan\u00eb peering). Por n\u00ebse shikoni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\/AS6849#_peers\">list\u00ebn e peer-\u00ebve<\/a><\/noindex> p\u00ebr AS6849, do t\u00eb shihni, p\u00ebr shembull, AS29226 (Mastertel) dhe AS31133 (Megafon). <\/p>\n<p>Duke gjetur looking glass t\u00eb k\u00ebtyre ofruesve, mund t\u00eb krahasoni rrug\u00ebn dhe RTT. P\u00ebr shembull, p\u00ebr Mastertel RTT do t\u00eb jet\u00eb rreth 30 mili-sekonda. <\/p>\n<p>Pra, n\u00ebse ndryshimi midis 80 dhe 30 mili-sekondave \u00ebsht\u00eb thelb\u00ebsor p\u00ebr sh\u00ebrbimin tuaj, at\u00ebher\u00eb ndoshta duhet t\u00eb mendoni p\u00ebr lidhshm\u00ebrin\u00eb, t\u00eb merrni n\u00eb RIPE numrin tuaj AS, grupin tuaj t\u00eb adresave dhe t\u00eb lidheni me uplink t\u00eb tjera dhe\\\/ose t\u00eb krijoni pika prezence n\u00eb IX.<\/p><\/blockquote>\n<p>\nDuke p\u00ebrdorimit t\u00eb BGP, jo vet\u00ebm q\u00eb keni mund\u00ebsin\u00eb t\u00eb p\u00ebrmir\u00ebsoni lidhshm\u00ebrin\u00eb, por gjithashtu rezervoni lidhjen tuaj me internetin.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ssi.gouv.fr\/uploads\/2016\/03\/bgp-configuration-best-practices.pdf\">Ky dokument<\/a><\/noindex> p\u00ebrmban rekomandime p\u00ebr konfigurimin e BGP. Megjith\u00ebse k\u00ebto rekomandime jan\u00eb hartuar mbi baz\u00ebn e \"praktikave m\u00eb t\u00eb mira\" t\u00eb ofruesve, ato jan\u00eb padyshim t\u00eb dobishme dhe realisht duhet t\u00eb jen\u00eb pjes\u00eb e hardening-ut q\u00eb diskutuam n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">pjes\u00ebn e par\u00eb<\/a><\/noindex>.<\/p>\n<h3>Mbrojtja DOS\/DDOS<\/h3>\n<p>\nAktualisht, sulmet DOS\/DDOS jan\u00eb b\u00ebr\u00eb nj\u00eb realitet i zakonsh\u00ebm p\u00ebr shum\u00eb kompani. N\u00eb t\u00eb v\u00ebrtet\u00eb, n\u00eb nj\u00eb form\u00eb ose n\u00eb nj\u00eb tjet\u00ebr, ju sulmoheni mjaft shpesh. Ajo q\u00eb nuk e vini re deri tani thot\u00eb vet\u00ebm se ende nuk \u00ebsht\u00eb organizuar nj\u00eb sulm i drejtp\u00ebrdrejt\u00eb kund\u00ebr jush, dhe se mjetet e mbrojtjes q\u00eb p\u00ebrdorni, madje ndoshta pa e kuptuar (mbrojtjet e ndryshme t\u00eb integruara n\u00eb sistemet operative), jan\u00eb mjaft t\u00eb mjaftueshme p\u00ebr t\u00eb minimizuar degradimin e sh\u00ebrbimit t\u00eb ofruar p\u00ebr ju dhe klient\u00ebt tuaj.<\/p>\n<p>Ekzistojn\u00eb burime n\u00eb internet, t\u00eb cilat, mbi baz\u00ebn e logeve nga pajisjet, n\u00eb koh\u00eb reale krijojn\u00eb harta t\u00eb bukura t\u00eb sulmeve.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3217944\/security\/8-top-cyber-attack-maps-and-how-to-use-them.html\">K\u00ebtu<\/a><\/noindex> mund t\u00eb gjeni linke p\u00ebr to.<\/p>\n<p>M\u00eb e preferuara ime <noindex><a rel=\"nofollow\" href=\"https:\/\/threatmap.checkpoint.com\/ThreatPortal\/livemap.html\">hart\u00eb<\/a><\/noindex> nga CheckPoint.<\/p>\n<p>Mbrojtja nga DDOS\/DOS zakonisht \u00ebsht\u00eb n\u00eb nivele t\u00eb shumta. P\u00ebr t\u00eb kuptuar pse, duhet t\u00eb kuptoni cilat lloje sulmesh DOS\/DDOS ekzistojn\u00eb (shih, p\u00ebr shembull, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3222095\/network-security\/ddos-explained-how-denial-of-service-attacks-are-evolving.html\">k\u00ebtu <\/a><\/noindex> ose <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.thousandeyes.com\/three-types-ddos-attacks\/\">k\u00ebtu<\/a><\/noindex>)<\/p>\n<p>Pra, ne kemi tre lloje sulmesh:<\/p>\n<ul>\n<li>sulme volumetrike<\/li>\n<li>sulme protokollesh<\/li>\n<li>sulme aplikacionesh<\/li>\n<\/ul>\n<p>\nN\u00ebse nga dy llojet e fundit t\u00eb sulmeve mund t\u00eb mbroni veten me p\u00ebrdorimin e, p\u00ebr shembull, firewalleve, nga sulmet q\u00eb kan\u00eb p\u00ebr objektiv \"mbushjen\" e lidhjeve tuaja, nuk mund t\u00eb mbroni veten (sigurisht, n\u00ebse kapaciteti total i kanaleve tuaja t\u00eb internetit nuk \u00ebsht\u00eb mat\u00ebs nga terabit\u00eb, e m\u00eb mir\u00eb, nga dhjet\u00ebra terabit\u00eb).<\/p>\n<p>Prandaj, linja e par\u00eb e mbrojtjes \u00ebsht\u00eb mbrojtja nga sulmet \"volumetrike\" dhe kjo mbrojtje duhet t'ju siguroj\u00eb ofruesi juaj ose ofruesit. N\u00ebse k\u00ebt\u00eb ende nuk e keni kuptuar, at\u00ebher\u00eb thjesht ju ka b\u00ebr\u00eb fat.<\/p>\n<blockquote><p><b>Shembulli<\/b><\/p>\n<p>Supozoni se keni disa lidhje, por vet\u00ebm nj\u00eb nga ofruesit mund t'ju siguroj\u00eb k\u00ebt\u00eb mbrojtje. Por n\u00ebse gjith\u00eb trafiku do t\u00eb kalonte p\u00ebrmes nj\u00eb ofruesi, si mund t\u00eb lidhet, q\u00eb e diskutuam pak m\u00eb par\u00eb?<\/p>\n<p>N\u00eb koh\u00ebn e sulmit do t'ju duhet n\u00eb k\u00ebt\u00eb rast t\u00eb sakrifikoni pjes\u00ebrisht lidhshm\u00ebrin\u00eb.<\/p>\n<ul>\n<li>ky \u00ebsht\u00eb vet\u00ebm p\u00ebr koh\u00ebzgjatjen e sulmit. Ju mund ta rikonfiguroni BGP n\u00eb m\u00ebnyr\u00eb manuale ose automatike gjat\u00eb nj\u00eb sulmi, n\u00eb m\u00ebnyr\u00eb q\u00eb trafiku t\u00eb kaloj\u00eb vet\u00ebm p\u00ebrmes ofruesit q\u00eb ju ofron \"mbules\u00ebn\". Pas p\u00ebrfundimit t\u00eb sulmit, mund ta ktheni ruterin n\u00eb gjendjen e m\u00ebparshme.<\/li>\n<li>nuk \u00ebsht\u00eb e nevojshme t\u00eb transferoni t\u00eb gjith\u00eb trafikun. N\u00ebse p\u00ebrshembull, shihni se p\u00ebrmes disa uplink-\u00eb ose peering nuk ka sulm (ose trafiku \u00ebsht\u00eb i par\u00ebnd\u00ebsish\u00ebm), mund t\u00eb vazhdoni t\u00eb njoftoni prefiksat me atributet konkurruese drejt k\u00ebtyre fqinj\u00ebve BGP.<\/li>\n<\/ul>\n<\/blockquote>\n<p>\nMbrojtjen nga \"protocol attacks\" dhe \"application attacks\" gjithashtu mund ta delegoni te partner\u00ebt tuaj.<br \/>\nJa <noindex><a rel=\"nofollow\" href=\"https:\/\/geekflare.com\/ddos-protection-service\/\">k\u00ebtu<\/a><\/noindex> ju mund t\u00eb lexoni nj\u00eb studim t\u00eb mir\u00eb (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/company\/hosting-cafe\/blog\/324848\/\">p\u00ebrkthim<\/a><\/noindex>). N\u00eb t\u00eb v\u00ebrtet\u00eb, artikulli \u00ebsht\u00eb dyvje\u00e7ar, por do t'ju jap\u00eb nj\u00eb pasqyr\u00eb t\u00eb qasjeve se si mund t\u00eb mbroheni nga sulmet DDOS.<\/p>\n<p>N\u00eb parim, mund t\u00eb kufizoheni vet\u00ebm n\u00eb k\u00ebt\u00eb, duke i besuar plot\u00ebsisht mbrojtjen tuaj n\u00eb outsourcing. Ka p\u00ebrfitime n\u00eb k\u00ebt\u00eb zgjidhje, por ka edhe nj\u00eb mang\u00ebsi t\u00eb dukshme. B\u00ebhet fjal\u00eb (p\u00ebrs\u00ebri, n\u00eb var\u00ebsi t\u00eb asaj q\u00eb b\u00ebn kompania juaj) p\u00ebr mbijetes\u00ebn e biznesit. Dhe t\u00eb besosh n\u00eb k\u00ebto gj\u00ebra organizatave t\u00eb huaja...<\/p>\n<p>Prandaj, le t\u00eb shqyrtojm\u00eb se si t\u00eb organizojm\u00eb linjat e dyta dhe t\u00eb treta t\u00eb mbrojtjes (si nj\u00eb plot\u00ebsim t\u00eb mbrojtjes nga ofruesi).<\/p>\n<p>K\u00ebshtu, linja e dyt\u00eb e mbrojtjes \u00ebsht\u00eb filtrimi dhe kufizuesit e trafikut (policers) n\u00eb hyrje t\u00eb rrjetit tuaj. <\/p>\n<blockquote><p><b>Shembulli 1<\/b><\/p>\n<p>Supozoni se ju \"i keni mbyllur vetes\" nga DDOS me ndihm\u00ebn e nj\u00eb nga ofruesit. Supozoni se ky ofrues p\u00ebrdor Arbor p\u00ebr filtrimin e trafikut dhe filtrat n\u00eb kufirin e rrjetit t\u00eb tij. <\/p>\n<p>Banda q\u00eb Arbor mund t\u00eb \"trajtoj\u00eb\" \u00ebsht\u00eb e kufizuar, dhe ofruesi natyrisht nuk mund t\u00eb lejoj\u00eb vazhdimisht kalimin e trafikut t\u00eb t\u00eb gjith\u00eb partner\u00ebve t\u00eb tij q\u00eb kan\u00eb k\u00ebrkuar k\u00ebt\u00eb sh\u00ebrbim p\u00ebrmes pajisjeve filtruar. Prandaj, n\u00eb kushte normale, trafiku nuk filtrohet.<\/p>\n<p>Supozoni se po nj\u00eb sulm SYN flood. Edhe n\u00ebse keni porositur nj\u00eb sh\u00ebrbim, ku n\u00eb rast sulmi trafiku automatikisht kalon n\u00eb filtrimin, kjo nuk ndodh menj\u00ebher\u00eb. Gjat\u00eb nj\u00eb minute ose m\u00eb shum\u00eb, ju mbeteni n\u00ebn sulm. Dhe kjo mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebshtimin e pajisjeve tuaja ose t\u00eb degradimin e sh\u00ebrbimit. N\u00eb k\u00ebt\u00eb rast, kufizimi i trafikut n\u00eb rrug\u00ebtimin kufitar, megjithat\u00eb, do t\u00eb \u00e7oj\u00eb n\u00eb faktin se disa seanca TCP gjat\u00eb k\u00ebsaj kohe nuk do t\u00eb krijohen, por do ta shp\u00ebtoj\u00eb infrastruktur\u00ebn tuaj nga probleme m\u00eb t\u00eb m\u00ebdha.<\/p><\/blockquote>\n<blockquote><p><b>Shembulli 2<\/b><\/p>\n<p>Nj\u00eb num\u00ebr anormalisht i madh i paketimeve SYN nuk mund t\u00eb jet\u00eb vet\u00ebm rezultat i nj\u00eb sulmi SYN flood. Le t\u00eb supozojm\u00eb se po ofroni nj\u00eb sh\u00ebrbim, ku mund t\u00eb keni nj\u00ebkoh\u00ebsisht rreth 100,000 lidhje TCP (n\u00eb nj\u00eb qend\u00ebr t\u00eb dh\u00ebnash).<\/p>\n<p>Supozoni se si rezultat i nj\u00eb problemi t\u00eb shkurt\u00ebr me nj\u00eb nga ofruesit tuaj kryesor\u00eb, ju \"u keni ndar\u00eb\" gjysm\u00ebn e seancave. N\u00ebse aplikacioni juaj \u00ebsht\u00eb i strukturuar n\u00eb at\u00eb m\u00ebnyr\u00eb q\u00eb ai, \"pa menduar shum\u00eb\", menj\u00ebher\u00eb (ose pas nj\u00eb intervali t\u00eb nj\u00ebjt\u00eb p\u00ebr t\u00eb gjitha seancat) p\u00ebrpiqet t\u00eb ristabilizoj\u00eb lidhjen, at\u00ebher\u00eb ju do t\u00eb merrni n\u00eb rreth nj\u00eb her\u00eb t\u00eb pakt\u00ebn 50,000 paketime SYN. <\/p>\n<p>N\u00ebse, mbi k\u00ebto seanca, duhet t\u00eb funksionoj\u00eb, p\u00ebr shembull, nj\u00eb shk\u00ebmbim ssl\/tls, q\u00eb supozon nd\u00ebrrimin e certifikatave, at\u00ebher\u00eb nga k\u00ebndv\u00ebshtrimi i shterimit t\u00eb burimeve p\u00ebr balancuesin tuaj t\u00eb ngarkes\u00ebs, kjo do t\u00eb jet\u00eb nj\u00eb \"DDOS\" shum\u00eb m\u00eb e fort\u00eb se nj\u00eb thjesht sulm SYN flood. Duket se balancuesit duhet t\u00eb p\u00ebrballojn\u00eb k\u00ebto ngjarje, por... fatkeq\u00ebsisht, ne kemi hasur n\u00eb m\u00ebnyr\u00eb t\u00eb plot\u00eb nj\u00eb problem t\u00eb till\u00eb.<\/p>\n<p>Dhe, sigurisht, policeri n\u00eb rrug\u00ebtimin kufitar do t\u00eb shp\u00ebtoj\u00eb pajisjet tuaja n\u00eb k\u00ebt\u00eb rast.<\/p><\/blockquote>\n<p>Niveli i tret\u00eb i mbrojtjes nga DDOS\/DOS \u2013 \u00ebsht\u00eb konfigurimi i firewall-it tuaj.<\/p>\n<p>K\u00ebtu mund t\u00eb ndaloni si sulmet e dyta, ashtu edhe t\u00eb treta. N\u00eb p\u00ebrgjith\u00ebsi, gjith\u00e7ka q\u00eb arrin n\u00eb firewall mund t\u00eb filtrohet k\u00ebtu. <\/p>\n<blockquote><p><b>K\u00ebshill\u00eb<\/b><\/p>\n<p>Provoni t'i jepni firewall-it sa m\u00eb pak pun\u00eb t\u00eb jet\u00eb e mundur, duke filtruar sa m\u00eb shum\u00eb n\u00eb dy linjat e para t\u00eb mbrojtjes. Dhe kjo \u00ebsht\u00eb arsyeja.<\/p>\n<p>A ka ndodhur ndonj\u00ebher\u00eb q\u00eb, duke gjeneruar trafik p\u00ebr t\u00eb testuar, p\u00ebr shembull, sa e q\u00ebndrueshme \u00ebsht\u00eb sistemi juaj operativ ndaj sulmeve DDOS, keni \"vrar\u00eb\" firewall-in tuaj duke e ngarkuar at\u00eb me 100 p\u00ebr qind, me trafik t\u00eb zakonsh\u00ebm? N\u00ebse jo, ndoshta sepse nuk e keni provuar?<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, firewall-i, si\u00e7 e thash\u00eb m\u00eb par\u00eb, \u00ebsht\u00eb nj\u00eb gj\u00eb komplekse dhe funksionon mir\u00eb me dob\u00ebsit\u00eb e njohura dhe zgjidhjet e testuara, por n\u00ebse d\u00ebrgoni di\u00e7ka t\u00eb pazakont\u00eb, thjesht ndonj\u00eb gj\u00eb t\u00eb rastit ose paketa me kokat e gabuara, me nj\u00eb mund\u00ebsi t\u00eb konsiderueshme (sipas p\u00ebrvoj\u00ebs time) mund t\u00eb ngat\u00ebrroheni madje edhe me pajisje shum\u00eb t\u00eb avancuara. Prandaj, n\u00eb faz\u00ebn 2, me an\u00eb t\u00eb ACL-ve t\u00eb zakonshme (n\u00eb nivelin L3\/L4), l\u00ebshoni n\u00eb rrjetin tuaj vet\u00ebm at\u00eb trafik q\u00eb duhet t\u00eb hyj\u00eb atje.<\/p><\/blockquote>\n<h3>Filtrimi i trafikut n\u00eb firewall<\/h3>\n<p>\nT\u00eb vazhdojm\u00eb bised\u00ebn p\u00ebr firewall-in. Duhet t\u00eb kuptoni se sulmet DOS\/DDOS jan\u00eb vet\u00ebm nj\u00eb nga llojet e sulmeve kibernetike. <\/p>\n<p>P\u00ebrve\u00e7 mbrojtjes DOS\/DDOS, ne gjithashtu mund t\u00eb kemi di\u00e7ka t\u00eb ngjashme me k\u00ebt\u00eb list\u00eb mund\u00ebsish:<\/p>\n<ul>\n<li>firewall aplikacioni<\/li>\n<li>parandalimi i k\u00ebrc\u00ebnimeve (antivirus, anti-spyware dhe dob\u00ebsi)<\/li>\n<li>filtrimi i URL-ve<\/li>\n<li>filtrimi i t\u00eb dh\u00ebnave (filtrimi i p\u00ebrmbajtjes)<\/li>\n<li>bllokimi i skedar\u00ebve (bllokimi i llojeve t\u00eb skedar\u00ebve)<\/li>\n<\/ul>\n<p>\nJu vendosni se \u00e7far\u00eb nga kjo list\u00eb ju nevojitet.<\/p>\n<p><i>Vazhdon<\/i><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436230\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23032,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Si t\u00eb kontrolloni infrastruktur\u00ebn tuaj t\u00eb rrjetit. Kapoja e tret\u00eb. Siguria e rrjetit. Pjesa e dyt\u00eb | ProHoster","description":"Ky artikull \u00ebsht\u00eb i kat\u00ebrt n\u00eb ciklin e artikujve \"Si t\u00eb kontrolloni infrastruktur\u00ebn tuaj t\u00eb rrjetit\".","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=31057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/31057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/23032"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=31057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=31057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=31057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}