{"id":85990,"date":"2020-06-21T01:42:12","date_gmt":"2020-06-20T23:42:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata"},"modified":"2020-06-21T01:42:12","modified_gmt":"2020-06-20T23:42:12","slug":"snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","title":{"rendered":"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Om man skall tro statistiken \u00f6kar n\u00e4tverkstrafiken med ungef\u00e4r 50% varje \u00e5r. Detta leder till en \u00f6kad belastning p\u00e5 utrustningen och, s\u00e4rskilt, \u00f6kar kraven p\u00e5 prestanda f\u00f6r IDS\/IPS. Man kan k\u00f6pa dyr specialistutrustning, men det finns ett billigare alternativ \u2013 att implementera ett av de m\u00e5nga systemen med \u00f6ppen k\u00e4llkod. M\u00e5nga nyb\u00f6rjaradministrat\u00f6rer tror att det \u00e4r ganska komplicerat att installera och konfigurera en kostnadsfri IPS. I fallet med Suricata \u00e4r detta inte helt korrekt \u2013 det g\u00e5r att installera den och b\u00f6rja avv\u00e4rja typiska attacker med ett paket gratis regler p\u00e5 bara n\u00e5gra minuter.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\"><img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/38b577d1359bfd99ca1f4c7510d8563b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/506730\/\">Snort eller Suricata. Del 1: V\u00e4ljer en kostnadsfri IDS\/IPS f\u00f6r att skydda det f\u00f6retagsn\u00e4tverk<\/a><\/noindex><\/p>\n<h2>Varf\u00f6r beh\u00f6vs ytterligare en \u00f6ppen IPS?<\/h2>\n<p>\nUnder l\u00e5ng tid har Snort-systemet, som betraktades som standard, utvecklats sedan slutet av 90-talet, vilket gjorde att det fr\u00e5n b\u00f6rjan var enkeltr\u00e5dat. Under \u00e5ren har den f\u00e5tt alla moderna funktioner, som st\u00f6d f\u00f6r IPv6, m\u00f6jlighet att analysera applikationsprotokoll eller en universell datatillg\u00e5ngsmodul. <\/p>\n<p>Den grundl\u00e4ggande motorn Snort 2.X l\u00e4rde sig att arbeta med flera k\u00e4rnor, men f\u00f6rblev enkeltr\u00e5dad och kan d\u00e4rf\u00f6r inte optimalt utnyttja f\u00f6rdelarna med moderna h\u00e5rdvaruplattformar. <\/p>\n<p>Problemet l\u00f6stes i systemets tredje version, men den f\u00f6rberedes s\u00e5 l\u00e4nge att det p\u00e5 marknaden hade dykt upp Suricata, som utvecklades helt fr\u00e5n grunden. \u00c5r 2009 b\u00f6rjade den utvecklas som ett flerdimensionellt alternativ till Snort, som har IPS-funktioner fr\u00e5n grunden. Koden distribueras under GPLv2-licensen, men projektets finansiella partners har tillg\u00e5ng till en sluten version av motorn. Vissa skalbarhetsproblem i de f\u00f6rsta versionerna av systemet uppstod, men de l\u00f6stes ganska snabbt.<\/p>\n<h2>Varf\u00f6r Suricata?<\/h2>\n<p>\nSuricata har flera moduler (precis som Snort): f\u00e5ngst, insamling, avkodning, uppt\u00e4ckte och utdata. Som standard f\u00f6rs den f\u00e5ngade trafiken fram till avkodningen i en enda str\u00f6m, vilket kan belasta systemet mer. Vid behov kan str\u00f6mmarna delas upp i inst\u00e4llningarna och f\u00f6rdelas \u00f6ver processorerna \u2013 Suricata \u00e4r mycket v\u00e4linst\u00e4lld f\u00f6r specifik h\u00e5rdvara, \u00e4ven om detta inte \u00e4r p\u00e5 nyb\u00f6rjarniv\u00e5. Det \u00e4r ocks\u00e5 v\u00e4rt att n\u00e4mna att Suricata har avancerade HTTP-inspektionsverktyg baserade p\u00e5 HTP-biblioteket. Dessa kan ocks\u00e5 anv\u00e4ndas f\u00f6r att logga trafiken utan att uppt\u00e4ckas. Systemet st\u00f6der ocks\u00e5 avkodning av IPv6, inklusive tunnlar av IPv4-in-IPv6, IPv6-in-IPv6 och andra. <\/p>\n<p>Olika gr\u00e4nssnitt kan anv\u00e4ndas f\u00f6r att f\u00e5nga trafik (NFQueue, IPFRing, LibPcap, IPFW, AF_PACKET, PF_RING), och i Unix Socket-l\u00e4ge kan f\u00e5ngad data fr\u00e5n en annan sniffer analyseras automatiskt och generera PCAP-filer. Dessutom f\u00f6renklar Suricatas modul\u00e4ra arkitektur integreringen av nya element f\u00f6r f\u00e5ngst, avkodning, analys och bearbetning av n\u00e4tverkspaket. Det \u00e4r ocks\u00e5 viktigt att notera att i Suricata blockeras trafiken med hj\u00e4lp av operativsystemets inbyggda filter. I GNU\/Linux finns det tv\u00e5 s\u00e4tt att arbeta IPS: via NFQUEUE (NFQ-l\u00e4ge) eller zero copy (AF_PACKET-l\u00e4ge). I det f\u00f6rsta fallet skickas paket som f\u00e5ngas av iptables till NFQUEUE-k\u00f6n, d\u00e4r det kan behandlas p\u00e5 anv\u00e4ndarniv\u00e5. Suricata k\u00f6r det genom sina regler och ger ett av tre utl\u00e5tanden: NF_ACCEPT, NF_DROP och NF_REPEAT. De f\u00f6rsta tv\u00e5 kr\u00e4ver ingen f\u00f6rklaring, medan den sista till\u00e5ter m\u00e4rkning av paket och att skicka dem till b\u00f6rjan av den aktuella iptables-tabellen. AF_PACKET-l\u00e4get skiljer sig genom h\u00f6gre hastighet, men p\u00e5l\u00e4gger systemet vissa begr\u00e4nsningar: det m\u00e5ste ha tv\u00e5 n\u00e4tverksgr\u00e4nssnitt och fungera som en gateway. Det blockerade paketet vidarebefordras helt enkelt inte till det andra gr\u00e4nssnittet. <\/p>\n<p>En viktig funktion hos Suricata \u00e4r m\u00f6jligheten att anv\u00e4nda arbeten fr\u00e5n Snort. F\u00f6r administrat\u00f6ren \u00e4r tillg\u00e4ngliga, bland annat, regelupps\u00e4ttningarna Sourcefire VRT och OpenSource Emerging Threats, samt de kommersiella Emerging Threats Pro. Den enhetliga utdata kan analyseras med hj\u00e4lp av popul\u00e4ra backend-l\u00f6sningar, och utdata i PCAP och Syslog st\u00f6ds ocks\u00e5. Systeminst\u00e4llningar och regler lagras i YAML-filer som \u00e4r l\u00e4ttl\u00e4sta och kan behandlas automatiskt. Suricata-motorn k\u00e4nner igen m\u00e5nga protokoll, d\u00e4rf\u00f6r finns det inget behov av att binda regler till portnummer. Dessutom till\u00e4mpas begreppet flowbits aktivt i Suricatas regler. F\u00f6r att sp\u00e5ra utl\u00f6st aktivitet anv\u00e4nds sessionsvariabler, vilket m\u00f6jligg\u00f6r skapandet och till\u00e4mpningen av olika r\u00e4knare och flaggor. M\u00e5nga IDS betraktar olika TCP-anslutningar som separata enheter och kan misslyckas med att se relationen mellan dem som indikerar b\u00f6rjan av en attack. Suricata f\u00f6rs\u00f6ker se helheten och k\u00e4nner i m\u00e5nga fall igen skadlig trafik distribuerad \u00f6ver olika anslutningar. Man kan diskutera dess f\u00f6rdelar l\u00e4nge, men l\u00e5t oss ist\u00e4llet g\u00e5 \u00f6ver till installation och konfiguration.<\/p>\n<h2>Hur installerar man det?<\/h2>\n<p>\nVi kommer att installera Suricata p\u00e5 en virtuell server som k\u00f6r Ubuntu 18.04 LTS. Alla kommandon m\u00e5ste utf\u00f6ras som superanv\u00e4ndare (root). Den s\u00e4kraste metoden \u00e4r att ansluta till servern via SSH som en vanlig anv\u00e4ndare, och sedan anv\u00e4nda verktyget sudo f\u00f6r att h\u00f6ja r\u00e4ttigheterna. F\u00f6r att b\u00f6rja beh\u00f6ver vi installera de paket vi kommer att anv\u00e4nda:<\/p>\n<pre><code class=\"bash\">sudo apt -y install libpcre3 libpcre3-dev build-essential autoconf automake libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libmagic-dev libcap-ng-dev libjansson-dev pkg-config libnetfilter-queue-dev geoip-bin geoip-database geoipupdate apt-transport-https<\/code><\/pre>\n<p>\nAnslut den externa repositoriet:<\/p>\n<pre><code class=\"bash\">sudo add-apt-repository ppa:oisf\/suricata-stable\nsudo apt-get update<\/code><\/pre>\n<p>\nInstallera den senaste stabila versionen av Suricata:<\/p>\n<pre><code class=\"bash\">sudo apt-get install suricata<\/code><\/pre>\n<p>\nOm n\u00f6dv\u00e4ndigt justerar vi konfigurationsfilerna genom att ers\u00e4tta det standardanv\u00e4nda namnet eth0 med det faktiska namnet p\u00e5 serverns externa gr\u00e4nssnitt. Standardinst\u00e4llningarna lagras i filen \/etc\/default\/suricata, medan anv\u00e4ndarinst\u00e4llningar finns i \/etc\/suricata\/suricata.yaml. Konfigurationen av IDS begr\u00e4nsas till stor del av redigeringen av denna konfigurationsfil. Den inneh\u00e5ller m\u00e5nga parametrar vars namn och syfte \u00f6verensst\u00e4mmer med motsvarigheterna i Snort. Syntaxen \u00e4r dock helt annorlunda, men filen \u00e4r mycket enklare att l\u00e4sa \u00e4n Snorts konfigurationer, dessutom \u00e4r den v\u00e4l kommenterad.<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/default\/suricata<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/17ae36d4ca58f0347b0b17f5fcb31c7b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\noch<\/p>\n<pre><code class=\"bash\">sudo nano \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/d2d39b52920aa2019fd2a3ec74fcab78.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVarning! Innan du k\u00f6r b\u00f6r du kontrollera v\u00e4rdena f\u00f6r variablerna i avsnittet vars.<\/p>\n<p>F\u00f6r att slutf\u00f6ra konfigurationen beh\u00f6ver vi installera suricata-update f\u00f6r att uppdatera och ladda ner regler. Det \u00e4r ganska enkelt att g\u00f6ra:<\/p>\n<pre><code class=\"bash\">sudo apt install python-pip\nsudo pip install pyyaml\nsudo pip install &lt;a href=&quot;https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip&quot;&gt;https:\/\/github.com\/OISF\/suricata-update\/archive\/master.zip&lt;\/a&gt;\nsudo pip install --pre --upgrade suricata-update<\/code><\/pre>\n<p>\nD\u00e4refter beh\u00f6ver vi k\u00f6ra kommandot suricata-update f\u00f6r att installera upps\u00e4ttningen regler fr\u00e5n Emerging Threats Open:<\/p>\n<pre><code class=\"bash\">sudo suricata-update<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/e3174089b6a2c67b8db36d2e40c50af9.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nF\u00f6r att visa listan \u00f6ver reglernas k\u00e4llor k\u00f6r vi f\u00f6ljande kommando:<\/p>\n<pre><code class=\"bash\">sudo suricata-update list-sources<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/7cded45bf414c2c2e76fc0bb3e1bb65c.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nUppdaterar reglernas k\u00e4llor:<\/p>\n<pre><code class=\"bash\">sudo suricata-update update-sources<\/code><\/pre>\n<p>\n<img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/786f46118b87cece96e818c70662e3c4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGranskar de uppdaterade k\u00e4llorna igen:<\/p>\n<pre><code class=\"bash\">sudo suricata-update list-sources<\/code><\/pre>\n<p>\nVid behov kan man aktivera tillg\u00e4ngliga gratis k\u00e4llor:<\/p>\n<pre><code class=\"bash\">sudo suricata-update enable-source ptresearch\/attackdetection\nsudo suricata-update enable-source oisf\/trafficid\nsudo suricata-update enable-source sslbl\/ssl-fp-blacklist<\/code><\/pre>\n<p>\nEfter detta m\u00e5ste vi uppdatera reglerna igen:<\/p>\n<pre><code class=\"bash\">sudo suricata-update<\/code><\/pre>\n<p>\nMed detta kan installationen och den initiala konfigurationen av Suricata p\u00e5 Ubuntu 18.04 LTS anses vara avslutad. D\u00e4refter b\u00f6rjar det mest intressanta: i n\u00e4sta artikel kommer vi att ansluta den virtuella servern till kontorsn\u00e4tverket via VPN och b\u00f6rja analysera hela den inkommande och utg\u00e5ende trafiken. Vi kommer s\u00e4rskilt att fokusera p\u00e5 att blockera DDoS-attacker, aktivitet fr\u00e5n skadlig programvara och f\u00f6rs\u00f6k att utnyttja s\u00e5rbarheter i tj\u00e4nster som \u00e4r tillg\u00e4ngliga fr\u00e5n offentliga n\u00e4tverk. F\u00f6r tydlighetens skull kommer vi att simulera attacker av de mest f\u00f6rekommande typerna.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-2\"><img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/8911da77f90d8843a2c0da3c1cb1d5b0.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p><noindex><a rel=\"nofollow\" href=\"http:\/\/ruvds.com\/ru-rub?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=ek&amp;utm_content=snort-ili-suricata-2#order\"><img decoding=\"async\" alt=\"Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata\" src=\"\/wp-content\/uploads\/2020\/06\/f9220be24979f78c539e08d755f4257f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<br \/>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ruvds\/blog\/507234\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS. \u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043a\u0443\u043f\u0430\u0442\u044c \u0434\u043e\u0440\u043e\u0433\u043e\u0441\u0442\u043e\u044f\u0449\u0435\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0436\u0435\u043b\u0435\u0437\u043e, \u043d\u043e \u0435\u0441\u0442\u044c \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u043e\u0434\u0435\u0448\u0435\u0432\u043b\u0435 \u2014 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0438\u0441\u0442\u0435\u043c \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u041c\u043d\u043e\u0433\u0438\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u044b \u0441\u0447\u0438\u0442\u0430\u044e\u0442, \u0431\u0443\u0434\u0442\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0438 \u0441\u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u0443\u044e IPS [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85991,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-85990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-20T23:42:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-20T23:42:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snort eller Suricata. Del 2: installation och grundl\u00e4ggande konfiguration av Suricata | ProHoster","description":"Om man f\u00e5r tro statistiken \u00f6kar volymen av n\u00e4tverkstrafik med ungef\u00e4r 50 % varje \u00e5r. Detta leder till \u00f6kad belastning p\u00e5 utrustningen och st\u00e4ller s\u00e4rskilt h\u00f6gre krav p\u00e5 prestanda f\u00f6r IDS\/IPS.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snort \u0438\u043b\u0438 Suricata. \u0427\u0430\u0441\u0442\u044c 2: \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0438 \u043f\u0435\u0440\u0432\u0438\u0447\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 Suricata | ProHoster","og:description":"\u0415\u0441\u043b\u0438 \u0432\u0435\u0440\u0438\u0442\u044c \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0435, \u043e\u0431\u044a\u0435\u043c \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u043d\u0430 50% \u043a\u0430\u0436\u0434\u044b\u0439 \u0433\u043e\u0434. \u042d\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0440\u043e\u0441\u0442\u0443 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0438, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 IDS\/IPS.","og:url":"https:\/\/prohoster.info\/sv\/blog\/administrirovanie\/snort-ili-suricata-chast-2-ustanovka-i-pervichnaya-nastrojka-suricata","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-20T23:42:12+00:00","article:modified_time":"2020-06-20T23:42:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85990","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:26:01","updated":"2026-08-11 12:50:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/85990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=85990"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/85990\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/85991"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=85990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=85990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=85990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}