{"id":86501,"date":"2020-06-26T07:42:00","date_gmt":"2020-06-26T05:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set"},"modified":"2020-06-26T07:42:00","modified_gmt":"2020-06-26T05:42:00","slug":"snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","title":{"rendered":"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>N\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">artikulli i m\u00ebparsh\u00ebm<\/a><\/noindex> Ne kemi treguar si t\u00eb lansoni nj\u00eb version t\u00eb q\u00ebndruesh\u00ebm t\u00eb Suricata n\u00eb Ubuntu 18.04 LTS. T\u00eb vendosni IDS n\u00eb nj\u00eb nyje dhe t\u00eb lidhni paketat falas t\u00eb rregullave \u00ebsht\u00eb mjaft e thjesht\u00eb. Sot do t\u00eb shqyrtojm\u00eb se si, me ndihm\u00ebn e Suricata t\u00eb instaluar n\u00eb nj\u00eb server virtual, t\u00eb mbrojm\u00eb rrjetin korporativ nga llojet m\u00eb t\u00eb zakonshme t\u00eb sulmeve. P\u00ebr k\u00ebt\u00eb na nevojitet nj\u00eb VDS n\u00eb Linux me dy b\u00ebrthama p\u00ebrpunuese. Sasia e memorjes varet nga ngarkesa: disa mund t\u00eb jen\u00eb t\u00eb k\u00ebnaqur me 2 GB, nd\u00ebrsa p\u00ebr detyra m\u00eb serioze mund t\u00eb nevojiten 4 ose madje 6. Avantazhi i makin\u00ebs virtuale \u00ebsht\u00eb mund\u00ebsia e eksperimenteve: mund t\u00eb filloni me nj\u00eb konfigurim minimal dhe t\u00eb rrisni burimet sipas nevoj\u00ebs.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\"><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/27cd9ba910418444ac7a2b5482f2a8a7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex>foto: Reuters<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort ose Suricata. Pjesa 1: zgjidhni nj\u00eb IDS\/IPS falas p\u00ebr mbrojtjen e rrjetit t\u00eb korporat\u00ebs<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">Snort ose Suricata. Pjesa 2: instalimi dhe konfigurimi fillestar i Suricata<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2>Bashkojm\u00eb rrjetet<\/h2>\n<p>\nShkarkimi i IDS n\u00eb nj\u00eb makin\u00eb virtuale mund t\u00eb jet\u00eb e nevojshme p\u00ebr teste. N\u00ebse keni qen\u00eb ndonj\u00ebher\u00eb n\u00eb kontakt me zgjidhje t\u00eb tilla, nuk \u00ebsht\u00eb e nevojshme t\u00eb nxitoni t\u00eb porosini pajisje fizike dhe t\u00eb ndryshoni arkitektur\u00ebn e rrjetit. E mira \u00ebsht\u00eb ta provoni sistemin n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt dhe pa shpenzime t\u00eb tep\u00ebrta p\u00ebr t\u00eb p\u00ebrcaktuar nevojat p\u00ebr burime p\u00ebrpunimi. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptoni se gjith\u00eb trafiku korporativ do t\u00eb kaloj\u00eb p\u00ebrmes nj\u00eb nyje t\u00eb vetme t\u00eb jashtme: p\u00ebr t\u00eb lidhur rrjetin lokal (ose disa rrjete) me VDS q\u00eb ka Suricata t\u00eb instaluar, mund t\u00eb p\u00ebrdorni <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">SoftEther<\/a><\/noindex> \u2014 nj\u00eb server VPN multidimensionale i leht\u00eb p\u00ebr t'u konfiguruar q\u00eb ofron kriptim t\u00eb sigurt. Lidhja e zyr\u00ebs me internetin nuk mund t\u00eb ket\u00eb nj\u00eb IP t\u00eb v\u00ebrtet\u00eb, prandaj \u00ebsht\u00eb m\u00eb mir\u00eb ta ngrisni at\u00eb n\u00eb VPS. N\u00eb depozit\u00ebn e Ubuntu nuk ka paketa t\u00eb gatshme, ju do t\u00eb duhet t'i shkarkoni ato ose nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.softether.org\/\">sajti i projektit<\/a><\/noindex>, ose nga nj\u00eb depo e jashtme n\u00eb sh\u00ebrbimin <noindex><a rel=\"nofollow\" href=\"https:\/\/launchpad.net\/~paskal-07\/+archive\/ubuntu\/softethervpn\">Launchpad<\/a><\/noindex> (n\u00ebse i besoni atij):<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:paskal-07\/softethervpn\nsudo apt-get update<\/code><\/pre>\n<p>\nP\u00ebr t\u00eb par\u00eb list\u00ebn e paketimeve t\u00eb disponueshme, mund t\u00eb p\u00ebrdorni k\u00ebt\u00eb komand\u00eb:<\/p>\n<pre><code class=\"bash\">apt-cache search softether<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/14803c275d46c02a43a52eec9254042c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa nevojitet softether-vpnserver (serveri n\u00eb konfigurim testimi \u00ebsht\u00eb i aktivizuar n\u00eb VDS), si dhe softether-vpncmd \u2014 utilitetet e linj\u00ebs s\u00eb komand\u00ebs p\u00ebr konfigurimin e tij.<\/p>\n<pre><code class=\"bash\">sudo apt-get install softether-vpnserver softether-vpncmd<\/code><\/pre>\n<p>\nP\u00ebr konfigurimin e serverit p\u00ebrdoret nj\u00eb utilitet i ve\u00e7ant\u00eb i linj\u00ebs s\u00eb komand\u00ebs:<\/p>\n<pre><code class=\"bash\">sudo vpncmd<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/39e1f66848527a771a246aaa9f163933.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNuk do t\u00eb flasim n\u00eb holl\u00ebsi p\u00ebr konfigurimin: procedura \u00ebsht\u00eb mjaft e thjesht\u00eb, dhe \u00ebsht\u00eb e p\u00ebrshkruar mir\u00eb n\u00eb shum\u00eb publikime dhe nuk lidhet drejtp\u00ebrdrejt me tem\u00ebn e artikullit. N\u00ebse e shpjegojm\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb shkurt\u00ebr, pas nisjes s\u00eb vpncmd, duhet t\u00eb zgjidhni pik\u00ebn 1 p\u00ebr t'u kaluar n\u00eb konsol\u00ebn e menaxhimit t\u00eb serverit. P\u00ebr k\u00ebt\u00eb, \u00ebsht\u00eb e nevojshme t\u00eb shkruani emrin localhost dhe t\u00eb shtypni enter n\u00eb vend t\u00eb emrit t\u00eb hub-it. N\u00eb konsol\u00eb, vendoset komand\u00ebn e fjal\u00ebkalimit t\u00eb administratorit me komand\u00ebn serverpasswordset, hiqet hub-i virtual DEFAULT (komanda hubdelete) dhe krijohet nj\u00eb i ri me emrin Suricata_VPN, si dhe caktohet fjal\u00ebkalimi i tij (komanda hubcreate). M\u00eb pas, duhet t\u00eb kaloni n\u00eb konsol\u00ebn e menaxhimit t\u00eb hub-it t\u00eb ri me komand\u00ebn hub Suricata_VPN p\u00ebr t\u00eb krijuar nj\u00eb grup dhe p\u00ebrdorues me komandat groupcreate dhe usercreate. Fjal\u00ebkalimi i p\u00ebrdoruesit caktohet me userpasswordset. <\/p>\n<p>SoftEther mb\u00ebshtet dy m\u00ebnyra p\u00ebr kalimin e trafikut: SecureNAT dhe Local Bridge. E para \u00ebsht\u00eb nj\u00eb teknologji unike p\u00ebr nd\u00ebrtimin e nj\u00eb rrjeti privat virtual me NAT dhe DHCP t\u00eb vetin. SecureNAT nuk k\u00ebrkon TUN\/TAP, as konfigurimin e Netfilter ose firewall tjet\u00ebr. Rrug\u00ebzim nuk prek b\u00ebrtham\u00ebn e sistemit, dhe t\u00eb gjitha proceset jan\u00eb virtualizuar dhe funksionojn\u00eb n\u00eb \u00e7do VPS\/VDS, pavar\u00ebsisht nga hipervizori i p\u00ebrdorur. Kjo \u00e7on n\u00eb nj\u00eb ngarkes\u00eb m\u00eb t\u00eb lart\u00eb n\u00eb procesor dhe nj\u00eb ulje t\u00eb shpejt\u00ebsis\u00eb krahasuar me m\u00ebnyr\u00ebn Local Bridge, e cila lidh hub-in virtual t\u00eb SoftEther me nj\u00eb adapator t\u00eb fizik ose pajisje TAP. <\/p>\n<p>Konfigurimi n\u00eb k\u00ebt\u00eb rast komplikohet, pasi rrug\u00ebzimi ndodh n\u00eb nivelin e b\u00ebrtham\u00ebs n\u00ebp\u00ebrmjet Netfilter. VDS tan\u00eb jan\u00eb nd\u00ebrtuar mbi Hyper-V, k\u00ebshtu q\u00eb n\u00eb hapin e fundit krijojm\u00eb nj\u00eb ur\u00eb lokale dhe aktivizojm\u00eb pajisjen TAP me komand\u00ebn bridgecreate Suricate_VPN -device:suricate_vpn -tap:yes. Pas daljes nga konsola e menaxhimit t\u00eb hub-it, do t\u00eb shohim nj\u00eb nd\u00ebrfaqe t\u00eb re rrjeti n\u00eb sistem, e cila ende nuk ka marr\u00eb nj\u00eb IP:<\/p>\n<pre><code class=\"bash\">ifconfig<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/336fc07fbb44793719789e3f3ce1f124.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00eb pas do t\u00eb duhet t\u00eb aktivizoni rrug\u00ebzimin e paketave mes nd\u00ebrfaqeve (ip forward), n\u00ebse ajo nuk \u00ebsht\u00eb e aktivizuar:<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n<p>\n\u00c7aktivizoni rreshtin e m\u00ebposht\u00ebm:<\/p>\n<pre><code class=\"bash\">net.ipv4.ip_forward = 1<\/code><\/pre>\n<p>\nRuajm\u00eb ndryshimet n\u00eb skedarin, dalim nga edituesi dhe i aplikojm\u00eb ato me komand\u00ebn vijuese:<\/p>\n<pre><code class=\"bash\">sudo sysctl -p<\/code><\/pre>\n<p>\nM\u00eb pas, na duhen t\u00eb p\u00ebrcaktojm\u00eb p\u00ebr rrjetin virtual nj\u00eb n\u00ebngrup me IP t\u00eb fiktiv (p\u00ebr shembull, 10.0.10.0\/24) dhe t'i japim adres\u00eb nd\u00ebrfaqes:<\/p>\n<pre><code class=\"bash\">sudo ifconfig tap_suricata_vp 10.0.10.1\/24<\/code><\/pre>\n<p>\nM\u00eb pas, do t\u00eb nevojitet t\u00eb shkruani rregullat e Netfilter.<\/p>\n<p>1. N\u00ebse \u00ebsht\u00eb e nevojshme, lejoni paketat n\u00eb portet e d\u00ebgjuara (protokolli i vet\u00eb SoftEther p\u00ebrdor HTTPS dhe portin 443)<\/p>\n<pre><code class=\"bash\">sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 992 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p udp -m udp --dport 1194 -j ACCEPT\nsudo iptables -A INPUT -p tcp -m tcp --dport 5555 -j ACCEPT<\/code><\/pre>\n<p>\n2. Konfigurojm\u00eb NAT nga subneti 10.0.10.0\/24 n\u00eb IP-n\u00eb kryesore t\u00eb serverit<\/p>\n<pre><code class=\"bash\">sudo iptables -t nat -A POSTROUTING -s 10.0.10.0\/24 -j SNAT --to-source 45.132.17.140<\/code><\/pre>\n<p>\n3. Lejojm\u00eb paketat e kalueshme nga subneti 10.0.10.0\/24<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -s 10.0.10.0\/24 -j ACCEPT<\/code><\/pre>\n<p>\n4. Lejojm\u00eb paketat e kalueshme p\u00ebr lidhjet q\u00eb jan\u00eb tashm\u00eb t\u00eb vendosura<\/p>\n<pre><code class=\"bash\">sudo iptables -A FORWARD -p all -m state --state ESTABLISHED,RELATED -j ACCEPT<\/code><\/pre>\n<p>\nAutomatizimin e procesit kur sistemi ripersahet me skriptet e inicializimit do ta l\u00ebm\u00eb p\u00ebr lexuesit si detyr\u00eb sht\u00ebpie. <\/p>\n<p>N\u00ebse d\u00ebshironi t\u00eb jepni IP automatikisht p\u00ebr klient\u00ebt, do t\u00eb duhet gjithashtu t\u00eb instaloni nj\u00eb sh\u00ebrbim DHCP p\u00ebr ur\u00ebn lokale. Me k\u00ebt\u00eb, konfigurimi i serverit p\u00ebrfundon dhe mund t\u00eb kalojm\u00eb te klient\u00ebt. SoftEther mb\u00ebshtet shum\u00eb protokolle, p\u00ebrdorimi i t\u00eb cilave varet nga kapacitetet e pajisjeve t\u00eb rrjetit lokal. <\/p>\n<pre><code class=\"bash\">netstat -ap |grep vpnserver<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/42511aeec204ee27b65325d296e30db3.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPasi rrjeti yn\u00eb testues gjithashtu funksionon n\u00ebn Ubuntu, do t\u00eb instalojm\u00eb paketat softether-vpnclient dhe softether-vpncmd nga depozita e jashtme p\u00ebr t\u00eb p\u00ebrfituar nga protokolli i mark\u00ebs. Duhet t\u00eb aktivizojm\u00eb klientin:<\/p>\n<pre><code class=\"bash\">sudo vpnclient start<\/code><\/pre>\n<p>\nP\u00ebr konfigurimin p\u00ebrdorim utilitarin vpncmd, duke zgjedhur localhost si makin\u00ebn ku \u00ebsht\u00eb aktivizuar vpnclient. T\u00eb gjitha komandat b\u00ebhen n\u00eb konsol: do t\u00eb k\u00ebrkohet t\u00eb krijoni nj\u00eb nd\u00ebrfaqe virtuale (NicCreate) dhe nj\u00eb llogari (AccountCreate). <\/p>\n<p>N\u00eb disa raste, \u00ebsht\u00eb e nevojshme t\u00eb caktoni m\u00ebnyr\u00ebn e autentifikimit me komandat AccountAnonymousSet, AccountPasswordSet, AccountCertSet dhe AccountSecureCertSet. Pasi ne nuk p\u00ebrdorim DHCP, adresa p\u00ebr adaptorin virtual caktohet manualisht. <\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, na nevojitet t\u00eb aktivizojm\u00eb ip forward (parametri net.ipv4.ip_forward=1 n\u00eb skedarin \/etc\/sysctl.conf) dhe t\u00eb konfigurojm\u00eb rrug\u00ebt statike. N\u00ebse \u00ebsht\u00eb e nevojshme, n\u00eb VDS me Suricata mund t\u00eb konfigurojm\u00eb kalimin e porteve p\u00ebr t\u00eb p\u00ebrdorur sh\u00ebrbimet e vendosura n\u00eb rrjetin lokal. Me k\u00ebt\u00eb, bashkimi i rrjeteve mund t\u00eb konsiderohet p\u00ebrfunduar.<\/p>\n<p>Konfigurimi q\u00eb ne propozojm\u00eb do t\u00eb duket pak a shum\u00eb k\u00ebshtu:<\/p>\n<p><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/8c650da06420efd25cbb6ed71f37aac2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Konfigurojm\u00eb Suricata<\/h2>\n<p>\nN\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">artikulli i m\u00ebparsh\u00ebm<\/a><\/noindex> Kemi folur p\u00ebr dy m\u00ebnyrat e funksionimit t\u00eb IDS: p\u00ebrmes radh\u00ebs NFQUEUE (modi NFQ) dhe p\u00ebrmes zero copy (modi AF_PACKET). E dyta k\u00ebrkon dy nd\u00ebrfaqe, por ofron nj\u00eb performanc\u00eb m\u00eb t\u00eb lart\u00eb \u2014 ne do ta p\u00ebrdorim pik\u00ebrisht k\u00ebt\u00eb. Parametri \u00ebsht\u00eb i vendosur si imazhi parazgjedhje n\u00eb \/etc\/default\/suricata. Gjithashtu, do na nevojitet t\u00eb redaktojm\u00eb seksionin vars n\u00eb \/etc\/suricata\/suricata.yaml, duke specifikuar atje nj\u00eb n\u00ebnrrjet virtual si sht\u00ebpiake.<\/p>\n<p><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/b3dc856ba0436de16fbd2ed0f1fa70a9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr t\u00eb rimarr\u00eb IDS p\u00ebrdorim komand\u00ebn:<\/p>\n<pre><code class=\"bash\">systemctl restart suricata<\/code><\/pre>\n<p>\nZgjidhja \u00ebsht\u00eb gati, tani mund t'ju nevojitet t\u00eb kontrolloni q\u00eb ajo t\u00eb jet\u00eb e q\u00ebndrueshme ndaj veprimeve t\u00eb sulmuesve.<\/p>\n<h2>Simulojm\u00eb sulmet<\/h2>\n<p>\nKa disa skenar\u00eb t\u00eb p\u00ebrdorimit t\u00eb sh\u00ebrbimit t\u00eb jasht\u00ebm IDS:<\/p>\n<p><b>Mbrojtja nga sulmet DDoS (q\u00ebllimi kryesor)<\/b><\/p>\n<p>T\u00eb realizosh nj\u00eb version t\u00eb till\u00eb brenda rrjetit korporativ \u00ebsht\u00eb e v\u00ebshtir\u00eb, pasi paketat p\u00ebr analiz\u00eb duhet t\u00eb kalojn\u00eb n\u00eb nd\u00ebrfaqen q\u00eb shikon n\u00eb internet t\u00eb sistemit. Edhe n\u00ebse IDS i bllokon ato, trafiku parazitar mund ta p\u00ebrmbys\u00eb kanalin e transferimit t\u00eb t\u00eb dh\u00ebnave. P\u00ebr t\u00eb parandaluar k\u00ebt\u00eb, duhet t\u00eb porosisni nj\u00eb VPS me nj\u00eb lidhje t\u00eb internetit mjaft produktive, e cila \u00ebsht\u00eb n\u00eb gjendje t\u00eb kaloj\u00eb t\u00eb gjith\u00eb trafik t\u00eb rrjetit lokal dhe t\u00eb gjith\u00eb trafikun e jasht\u00ebm. Kjo shpesh \u00ebsht\u00eb m\u00eb e leht\u00eb dhe m\u00eb e p\u00ebrballueshme se sa t\u00eb zgjerohet kanali zyrtar. Si nj\u00eb alternativ\u00eb, p\u00ebrmendja e sh\u00ebrbimeve t\u00eb specializuara p\u00ebr mbrojtjen nga DDoS \u00ebsht\u00eb e r\u00ebnd\u00ebsishme. Kostot e sh\u00ebrbimeve t\u00eb tyre jan\u00eb t\u00eb ngjashme me \u00e7mimin e nj\u00eb serveri virtual, nd\u00ebrsa nuk k\u00ebrkohet konfigurim i mundimsh\u00ebm, por ka edhe disavantazhe \u2014 p\u00ebr parat\u00eb e tij, klienti merr vet\u00ebm mbrojtje nga DDoS, nd\u00ebrsa IDS e tij mund t\u00eb konfigurohet sipas d\u00ebshir\u00ebs.<\/p>\n<p><b>Mbrojtja nga sulmet e jashtme t\u00eb llojeve t\u00eb tjera<\/b> <\/p>\n<p>Suricata \u00ebsht\u00eb n\u00eb gjendje t\u00eb p\u00ebrballoj\u00eb p\u00ebrpjekjet p\u00ebr shfryt\u00ebzimin e marrjes s\u00eb ndryshimeve n\u00eb sh\u00ebrbimet e qasshme nga interneti t\u00eb rrjetit korporativ (serveri i post\u00ebs, serveri i internetit dhe aplikacionet e internetit etj.). Zakonisht p\u00ebr k\u00ebt\u00eb, IDS instalohet brenda rrjetit lokal pas pajisjeve p\u00ebr kufizim, por nxjerrja e saj jasht\u00eb ka t\u00eb drejta p\u00ebr t\u00eb ekzistuar.<\/p>\n<p><b>Mbrojtja nga keqb\u00ebr\u00ebsit e brendsh\u00ebm<\/b><\/p>\n<p>Megjith\u00eb t\u00eb gjitha p\u00ebrpjekjet e administratorit t\u00eb sistemit, kompjuterat e rrjetit korporativ mund t\u00eb infektohen nga softuer t\u00eb d\u00ebmsh\u00ebm. P\u00ebr m\u00eb tep\u00ebr, n\u00eb rrjetin lokal ndonj\u00ebher\u00eb shfaqen huligan\u00eb q\u00eb p\u00ebrpiqen t\u00eb kryejn\u00eb disa operacione t\u00eb paligjshme. Suricata mund t\u00eb ndihmoj\u00eb n\u00eb bllokimin e k\u00ebtyre p\u00ebrpjekjeve, megjith\u00ebse p\u00ebr t\u00eb mbrojtur rrjetin e brendsh\u00ebm, \u00ebsht\u00eb m\u00eb mir\u00eb ta instaluar at\u00eb brenda perimeterit dhe ta p\u00ebrdorim n\u00eb \u00e7ift me nj\u00eb switch t\u00eb men\u00e7ur q\u00eb di t\u00eb pasqyroj\u00eb trafik n\u00eb nj\u00eb port. Nj\u00eb IDS e jashtme n\u00eb k\u00ebt\u00eb rast nuk \u00ebsht\u00eb e panevojshme \u2013 s\u00eb paku ajo do t\u00eb mund t\u00eb kap\u00eb p\u00ebrpjekjet e malware-ve q\u00eb jetojn\u00eb brenda LAN-it p\u00ebr t'u lidhur me nj\u00eb server t\u00eb jasht\u00ebm.<\/p>\n<p>S\u00eb pari, le t\u00eb krijojm\u00eb edhe nj\u00eb VPS sulmues testues, dhe n\u00eb routerin e rrjetit lokal do t\u00eb ngrem\u00eb Apache me konfigurimin t\u00eb parazgjedhur, pas s\u00eb cil\u00ebs do t\u00eb kalojm\u00eb portin 80 nga serveri IDS. M\u00eb pas do t\u00eb imitojm\u00eb nj\u00eb sulm DDoS nga nodi sulmues. P\u00ebr k\u00ebt\u00eb, do t\u00eb shkarkojm\u00eb nga GitHub, do ta kompilohet dhe do ta ekzekutojm\u00eb n\u00eb nodin sulmues nj\u00eb program t\u00eb vog\u00ebl xerxes (mund t\u00eb nevojitet instalimi i paket\u00ebs gcc):<\/p>\n<pre><code class=\"bash\">git clone https:\/\/github.com\/Soldie\/xerxes-DDos-zanyarjamal-C.git\ncd xerxes-DDos-zanyarjamal-C\/\ngcc xerxes.c -o xerxes\n.\/xerxes 45.132.17.140 80<\/code><\/pre>\n<p>\nRezultati i pun\u00ebs s\u00eb tij doli si m\u00eb posht\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/80fe4d74ae71cfb16c91336102479670.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSuricata ndalon keqb\u00ebr\u00ebsin, nd\u00ebrsa faqja Apache e parazgjedhur hapet, pavar\u00ebsisht nga sulmi yn\u00eb improvizues dhe kanalit t\u00eb dob\u00ebt \"zyrtar\" (n\u00eb t\u00eb v\u00ebrtet\u00eb sht\u00ebpiak) t\u00eb rrjetit. P\u00ebr detyra m\u00eb serioze ia vlen t\u00eb p\u00ebrdorni <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/\">Metasploit Framework<\/a><\/noindex>. Ai \u00ebsht\u00eb i destinuar p\u00ebr kryerjen e testeve t\u00eb infiltrimit dhe lejon imitim t\u00eb sulmeve t\u00eb ndryshme. Udh\u00ebzimi p\u00ebr instalimin <noindex><a rel=\"nofollow\" href=\"https:\/\/www.metasploit.com\/get-started\">e disponueshme<\/a><\/noindex> ndodhet n\u00eb faqen e projektit. Pas instalimit, do t\u00eb nevojitet p\u00ebrdit\u00ebsim:<\/p>\n<pre><code class=\"bash\">sudo msfupdate<\/code><\/pre>\n<p>\nP\u00ebr testim, nisim msfconsole.<\/p>\n<p><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/b2a08cf048ae726ca720e942729ed7f8.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFatkeq\u00ebsisht, n\u00eb versionet e fundit t\u00eb \u00e7ar\u00e7afit mungon mund\u00ebsia p\u00ebr thyerje automatikisht, prandaj do t\u00eb duhet t\u00eb kalojm\u00eb manualisht p\u00ebrmes exploit-eve dhe t'i ekzekutojm\u00eb me komand\u00ebn use. Fillimisht ia vlen t\u00eb p\u00ebrcaktojm\u00eb portet e hapura n\u00eb makin\u00ebn e sulmuar, p\u00ebr shembull, me ndihm\u00ebn e nmap (n\u00eb rastin ton\u00eb netstat n\u00eb nodin e sulmuar \u00ebsht\u00eb mjaftuesh\u00ebm), dhe pastaj t\u00eb zgjidhim dhe t\u00eb p\u00ebrdorim modulat e p\u00ebrshtatshme <noindex><a rel=\"nofollow\" href=\"https:\/\/www.rapid7.com\/db\/\">t\u00eb Metasploit<\/a><\/noindex>.\u00a0<\/p>\n<p>Ekzistojn\u00eb edhe mjete t\u00eb tjera p\u00ebr verifikimin e q\u00ebndrueshm\u00ebris\u00eb s\u00eb IDS ndaj sulmeve, duke p\u00ebrfshir\u00eb sh\u00ebrbimet online. Nga kurioziteti, mund t\u00eb organizoni nj\u00eb testim stresi duke p\u00ebrdorur versionin prov\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ipstresser.com\/\">IP Stresser<\/a><\/noindex>. P\u00ebr t\u00eb verifikuar reagimin ndaj veprimeve t\u00eb sulmuesve t\u00eb brendsh\u00ebm, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb vendosni mjete speciale n\u00eb nj\u00eb nga makinat e rrjetit lokal. Ka shum\u00eb mund\u00ebsi dhe her\u00eb pas here \u00ebsht\u00eb e nevojshme t'i aplikoni ato jo vet\u00ebm n\u00eb poligonin eksperimental, por edhe n\u00eb sistemet e pun\u00ebs, por kjo \u00ebsht\u00eb nj\u00eb histori krejt tjet\u00ebr.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3\"><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/801a7d4e4fa0aa755205509bd2d26020.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-3#order\"><img decoding=\"async\" alt=\"Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin zyrtar\" src=\"\/wp-content\/uploads\/2020\/06\/e2c2a9e30fae35d3a3afaea1915dc106.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/508052\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS. \u041d\u0430\u0441\u0442\u0440\u043e\u0438\u0442\u044c IDS \u043d\u0430 \u043e\u0434\u043d\u043e\u043c \u0443\u0437\u043b\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u0432\u0438\u043b \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043d\u0435\u0441\u043b\u043e\u0436\u043d\u043e. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0440\u0430\u0437\u0431\u0435\u0440\u0435\u043c\u0441\u044f, \u043a\u0430\u043a \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Suricata \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u043e\u043d \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 \u0432\u0438\u0434\u043e\u0432 \u0430\u0442\u0430\u043a. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0430\u043c \u043f\u043e\u043d\u0430\u0434\u043e\u0431\u0438\u0442\u0441\u044f VDS \u043d\u0430 Linux \u0441 \u0434\u0432\u0443\u043c\u044f \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86502,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-86501","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-26T05:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort ose Suricata. Pjesa 3: mbrojm\u00eb rrjetin e zyr\u00ebs | ProHoster","description":"N\u00eb artikullin e kaluar, ne treguam se si t\u00eb lan\u00e7oni nj\u00eb version stabil t\u00eb Suricata n\u00eb Ubuntu 18.04 LTS.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 3: \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u043e\u0444\u0438\u0441\u043d\u0443\u044e \u0441\u0435\u0442\u044c | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e Suricata \u0432 Ubuntu 18.04 LTS.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/snort-ili-suricata-chast-3-zashhishhaem-ofisnuyu-set","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-26T05:42:00+00:00","article:modified_time":"2020-06-26T05:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86501","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:00:11","updated":"2026-08-11 12:50:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/86501","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=86501"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/86501\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/86502"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=86501"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=86501"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=86501"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}