{"id":1669,"date":"2019-04-25T12:25:20","date_gmt":"2019-04-25T10:25:20","guid":{"rendered":"https:\/\/blog.wedos.cz\/?p=1669"},"modified":"2019-04-26T09:14:04","modified_gmt":"2019-04-26T07:14:04","slug":"lepsi-a-prisnejsi-filtrace-utoku-a-zbytecnych-robotu-u-webhostingu","status":"publish","type":"post","link":"https:\/\/blog.wedos.com\/cs\/lepsi-a-prisnejsi-filtrace-utoku-a-zbytecnych-robotu-u-webhostingu","title":{"rendered":"Lep\u0161\u00ed a p\u0159\u00edsn\u011bj\u0161\u00ed filtrace \u00fatok\u016f a zbyte\u010dn\u00fdch robot\u016f u webhostingu"},"content":{"rendered":"<p>V druh\u00e9 polovin\u011b roku 2015 jsme spustili na\u0161\u00ed IPS\/IDS <em>(Intrusion Prevention Systems a Intrusion Detection Systems)<\/em>. Nejprve m\u011bla za \u00fakol pouze sledovat provoz na na\u0161ich serverech (byla to tedy IDS). Byli jsme p\u0159ekvapeni z obrovsk\u00e9ho po\u010dtu \u00fatok\u016f. Nap\u0159\u00edklad po\u010det \u00fatok\u016f na str\u00e1nku s p\u0159ihla\u0161ov\u00e1n\u00edm WordPress (wp-login.php) dos\u00e1hl pr\u016fm\u011brn\u011b 8 za vte\u0159inu. Za\u010d\u00e1tkem minul\u00e9ho t\u00fddne (15.4.2019) jsme to porovnali a ji\u017e to bylo neuv\u011b\u0159iteln\u00fdch 63 pokus\u016f za sekundu. A to um\u00edme zat\u00edm detekovat pouze aktivitu na HTTP. P\u0159itom HTTPS u n\u00e1s u\u017e pou\u017e\u00edv\u00e1 v\u00edce jak polovina slu\u017eeb.<\/p>\n<p><!--more--><\/p>\n<p>Str\u00e1nka wp-login.php se stala nejnav\u0161t\u011bvovan\u011bj\u0161\u00ed str\u00e1nkou na v\u0161ech na\u0161ich str\u00e1nk\u00e1ch. neuv\u011b\u0159iteln\u00e9&#8230;<br \/><br \/>\u00datoky a aktivita neu\u017eite\u010dn\u00fdch robot\u016f u\u017e dos\u00e1hla takov\u00e9 meze, \u017ee se to na n\u011bkter\u00fdch serverech za\u010dalo projevovat ob\u010dasn\u00fdm zpomalen\u00edm z\u00e1kaznick\u00fdch slu\u017eeb. Probl\u00e9m je, \u017ee p\u0159ev\u00e1\u017enou \u010d\u00e1st t\u011bchto \u00fatok\u016f detekujeme jen okrajov\u011b, proto\u017ee sm\u011b\u0159uje na weby vyu\u017e\u00edvaj\u00edc\u00ed HTTPS.<\/p>\n<p>U t\u011bchto web\u016f nem\u016f\u017eeme prozat\u00edm vyu\u017e\u00edt na\u0161i IPS\/IDS ochranu, proto\u017ee nevid\u00edme do provozu. V sou\u010dasnosti na\u0161i v\u00fdvoj\u00e1\u0159i pracuj\u00ed na metod\u011b jak to ud\u011blat. Jenom\u017ee je to n\u00e1ro\u010dn\u00e9, n\u00e1kladn\u00e9 a velice n\u00e1chyln\u00e9 na chyby, proto bude nasazen\u00ed je\u0161t\u011b n\u011bjakou dobu trvat.<\/p>\n<p>Nav\u00edc to bude fungovat pouze pro nov\u00e9 NoLimit na HPE Moonshot (z\u0159izovan\u00e9 od listopadu 2017), kde se vyu\u017e\u00edv\u00e1 technologie proxy server\u016f. Ale nemus\u00edte se b\u00e1t jakmile se v\u0161e odlad\u00ed, tak n\u00e1s \u010dek\u00e1 migrace. V\u0161ichni na\u0161i z\u00e1kazn\u00edci budou p\u0159esunuti na HPE Moonshot, kter\u00e9 vyu\u017e\u00edvaj\u00ed rychlej\u0161\u00ed servery s 3,4 Ghz procesory, NVMe SSD a s podporou mnoha nov\u00fdch modern\u00edch technologi\u00ed. N\u00e1\u0161 NoLimit se vyv\u00edj\u00ed a jsme teprve na za\u010d\u00e1tku \u00fa\u017easn\u00e9 cesty technologick\u00e9ho pokroku \ud83d\ude09<\/p>\n<h3>Prozat\u00edm n\u00e1s ochr\u00e1n\u00ed DDoS ochrana a WEDOS honeypot<\/h3>\n<p>Na\u0161e DDoS ochrana je slo\u017eena z n\u011bkolika vrstev. \u010c\u00e1st m\u00e1 na starosti \u00fatoky hrubou silou a \u010d\u00e1st \u0159e\u0161\u00ed \u0159ekn\u011bme ty chyt\u0159ej\u0161\u00ed \u00fatoky. Tento rok jsme shodou okolnost\u00ed m\u011bli mo\u017enost vyzkou\u0161et si obranu proti n\u011bkolika velice sofistikovan\u00fdm \u00fatok\u016fm. Jeden byl dokonce celkem \u00fasp\u011b\u0161n\u00fd. Pr\u00e1v\u011b kv\u016fli n\u011bmu jsme museli p\u0159idat dal\u0161\u00ed vrstvu.<\/p>\n<p>Sou\u010d\u00e1st\u00ed t\u00e9to vrstvy je i velmi rychl\u00e1 filtrov\u00e1n\u00ed podle p\u016fvodu \u00fatoku a za dosti specifick\u00fdch podm\u00ednek. Shodou okolnost\u00ed pr\u00e1v\u011b to se n\u00e1m te\u010f bude hodit.<\/p>\n<p>Od minul\u00e9ho roku testujeme software na anal\u00fdzu velk\u00e9ho mno\u017estv\u00ed dat. Ze v\u0161ech webhosting\u016f (zhruba 103.000 aktivn\u00edch) se stahuj\u00ed na jeden centr\u00e1ln\u00ed server naprosto v\u0161echny mysliteln\u00e9 logy. Zde se analyzuj\u00ed, vyhodnocuj\u00ed a daj\u00ed i zobrazit. V\u0161e v re\u00e1ln\u00e9m \u010dase. Aktu\u00e1ln\u011b se loguje pr\u016fm\u011brn\u011b 6 a\u017e 10 tis\u00edc z\u00e1znam\u016f za sekundu.<\/p>\n<p>Pr\u00e1v\u011b z t\u011bchto log\u016f z\u00edsk\u00e1me podklady pro filtraci. Jednodu\u0161e \u0159e\u010deno, kdy\u017e n\u011bkdo za\u010dne velice rychle &#8222;bu\u0161it&#8220; t\u0159eba do wp-login.php a to t\u0159eba i nap\u0159\u00ed\u010d servery, tak jeho IP adresa je rychle odesl\u00e1na a zablokov\u00e1na. Tak\u017ee jsme si vlastn\u011b ze v\u0161ech webhosting\u016f ud\u011blali takov\u00fd velk\u00fd honeypot \ud83d\ude42<\/p>\n<p>A takto to vypadalo u 10 nejvyt\u00ed\u017een\u011bj\u0161\u00edch server\u016f:<\/p>\n<p><a href=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2019\/04\/nasazeni-automaticke-ochrany.png\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"aligncenter size-large wp-image-1670 lazyload\" data-src=\"https:\/\/blog.wedos.cz\/wp-content\/uploads\/2019\/04\/nasazeni-automaticke-ochrany-1024x355.png\" alt=\"\" width=\"525\" height=\"182\" data-srcset=\"https:\/\/blog.wedos.com\/wp-content\/uploads\/2019\/04\/nasazeni-automaticke-ochrany-1024x355.png 1024w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2019\/04\/nasazeni-automaticke-ochrany-300x104.png 300w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2019\/04\/nasazeni-automaticke-ochrany-768x266.png 768w, https:\/\/blog.wedos.com\/wp-content\/uploads\/2019\/04\/nasazeni-automaticke-ochrany.png 1123w\" data-sizes=\"(max-width: 525px) 100vw, 525px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 525px; --smush-placeholder-aspect-ratio: 525\/182;\" \/><\/a><\/p>\n<p>\u010c\u00edm v\u00edce \u00fato\u010dn\u00edk\u016f bylo p\u0159id\u00e1v\u00e1no na blacklist, t\u00edm i klesala z\u00e1t\u011b\u017e na servery. Va\u0161e weby te\u010f d\u00edky nov\u00e9 ochran\u011b budou daleko rychlej\u0161\u00ed, proto\u017ee v\u011bt\u0161ina server\u016f se zase za\u010dala nudit a tak to m\u00e1 b\u00fdt \ud83d\ude42<\/p>\n<p>Mimochodem ten velk\u00fd \u010derven\u00fd sloupec to jsou proxy servery, kter\u00e9 v\u011bt\u0161inu provozu odbavily. Pokud m\u00e1te dob\u0159e nastaven\u00e9 cachov\u00e1n\u00ed, tak dok\u00e1\u017e\u00ed velice zrychlit v\u00e1\u0161 web, proto\u017ee se staraj\u00ed o v\u0161echen statick\u00fd obsah.<\/p>\n<h3>Co filtrujeme a jak<\/h3>\n<p>V sou\u010dasn\u00e9 dob\u011b se filtruj\u00ed hlavn\u011b hromadn\u00e9 \u00fatoky na WordPress a to jak p\u0159es HTTP tak i HTTPS. Hlavn\u011b se zam\u011b\u0159ujeme na ty, kter\u00e9 \u00fato\u010d\u00ed na wp-login.php a xmlrpc.php. Do budoucna p\u0159ibudou dal\u0161\u00ed.<\/p>\n<p>D\u00e1le jsme se rozhodli b\u00fdt p\u0159\u00edsn\u011bj\u0161\u00ed k robot\u016fm, kte\u0159\u00ed jsou neohledupln\u00ed. Jsou to v\u011bt\u0161inou roboti, kte\u0159\u00ed sb\u00edraj\u00ed data, sp\u00ed\u0161e by se dalo \u0159\u00edct \u0161m\u00edruj\u00ed, a vyu\u017e\u00edvaj\u00ed je pro marketingov\u00e9 \u00fa\u010dely p\u0159\u00edpadn\u011b nab\u00edz\u00ed data pro SEO. Jeden takov\u00fd robot dokonce d\u011blal 7 % v\u0161ech\u00a0 p\u0159\u00edstup\u016f na v\u0161echny weby, kter\u00e9 u n\u00e1s hostuj\u00ed.<\/p>\n<p>Filtrov\u00e1n\u00ed IP adres je prozat\u00edm nastaveno na 2 &#8211; 6 hodin.<\/p>\n<p>Nov\u00e9 filtrace pr\u016fm\u011brn\u011b blokuj\u00ed 45% provozu! Dal\u0161\u00ed provoz blokuje IDS\/ISP, kter\u00e1 funguje jako dal\u0161\u00ed vrstva filtrac\u00ed.<\/p>\n<h3>Pom\u016f\u017eete n\u00e1m ud\u011blat webhosting rychlej\u0161\u00ed a bezpe\u010dn\u011bj\u0161\u00ed?<\/h3>\n<p>Z na\u0161eho pohledu v\u0161e funguje rychleji a l\u00e9pe. Od nasazen\u00ed nem\u00e1me zat\u00edm \u017e\u00e1dn\u00e9 negativn\u00ed reakce.\u00a0 To v\u0161ak neznamen\u00e1, \u017ee jsme n\u011bco\u00a0 mohli p\u0159ehl\u00e9dnout. Byli bychom v\u00e1m vd\u011b\u010dn\u00ed za zp\u011btnou vazbu k:<\/p>\n<ul>\n<li>Pou\u017e\u00edv\u00e1te roz\u0161\u00ed\u0159en\u00fd redak\u010dn\u00ed syst\u00e9m anebo e-shop a pravideln\u011b se setk\u00e1v\u00e1te s \u00fatoky na n\u011bjak\u00fd konkr\u00e9tn\u00ed soubor?<\/li>\n<li>P\u0159et\u011b\u017euje v\u00e1\u0161 web n\u011bjak\u00fd konkr\u00e9tn\u00ed robot, kter\u00e9ho nikdo nepot\u0159ebuje?<\/li>\n<li>Brzo budeme nab\u00edzet ke v\u0161em slu\u017eb\u00e1m (v\u010detn\u011b VPS a dedikovan\u00fdch server\u016f) mo\u017enost filtrac\u00ed podle zem\u00ed (bu\u010f si n\u011bkter\u00e9 zem\u011b budete blacklistovat nebo naopak whitelistovat &#8211; m\u00e1me otestov\u00e1no a funguje).<\/li>\n<\/ul>\n<h3>Z\u00e1v\u011br<\/h3>\n<p>D\u00edky zv\u00fd\u0161en\u00e9mu po\u010dtu \u00fatok\u016f a aktivit\u011b robot\u016f se obecn\u011b cel\u00fd internet zpomaluje. Nen\u00ed to jen n\u00e1\u0161 dojem a <a href=\"https:\/\/www.root.cz\/zpravicky\/skodlivi-boti-uz-generuji-20-weboveho-provozu\/\" target=\"_blank\" rel=\"noopener\">ned\u011bje se to jen u n\u00e1s<\/a>. N\u00e1s se to jen v\u00edce dot\u00fdk\u00e1 proto\u017ee hostujeme nejv\u00edce mal\u00fdch a st\u0159edn\u00edch web\u016f, kter\u00e9 si nej\u010dast\u011bji vol\u00ed redak\u010dn\u00ed syst\u00e9m WordPress. Ten je skv\u011bl\u00fd a dob\u0159e u n\u00e1s funguje. Jen je \u010d\u00edslem jedna pro automatick\u00e9 hromadn\u00e9 \u00fatoky. Ty v\u011bt\u0161inou sel\u017eou, ale st\u00e1le generuj\u00ed z\u00e1t\u011b\u017e.<\/p>\n<p>Postupn\u011b p\u0159ineseme n\u011bjak\u00e9 statistiky.\u00a0<\/p>\n<p>V\u0161em proto doporu\u010dujeme s\u00e1hnout po n\u011bkter\u00e9m z bezpe\u010dnostn\u00edch plugin\u016f jako je t\u0159eba <a href=\"https:\/\/cs.wordpress.org\/plugins\/wordfence\/\" target=\"_blank\" rel=\"noopener\">WordFence<\/a>.<\/p>\n<p>\u00a0<\/p>\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>V druh\u00e9 polovin\u011b roku 2015 jsme spustili na\u0161\u00ed IPS\/IDS (Intrusion Prevention Systems a Intrusion Detection Systems). Nejprve m\u011bla za \u00fakol pouze sledovat provoz na na\u0161ich serverech (byla to tedy IDS). Byli jsme p\u0159ekvapeni z obrovsk\u00e9ho po\u010dtu \u00fatok\u016f. Nap\u0159\u00edklad po\u010det \u00fatok\u016f na str\u00e1nku s p\u0159ihla\u0161ov\u00e1n\u00edm WordPress (wp-login.php) dos\u00e1hl pr\u016fm\u011brn\u011b 8 za vte\u0159inu. Za\u010d\u00e1tkem minul\u00e9ho t\u00fddne (15.4.2019) &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/blog.wedos.com\/cs\/lepsi-a-prisnejsi-filtrace-utoku-a-zbytecnych-robotu-u-webhostingu\" class=\"more-link\">Pokra\u010dovat ve \u010dten\u00ed<span class=\"screen-reader-text\"> &#8222;Lep\u0161\u00ed a p\u0159\u00edsn\u011bj\u0161\u00ed filtrace \u00fatok\u016f a zbyte\u010dn\u00fdch robot\u016f u webhostingu&#8220;<\/span><\/a><\/p>\n","protected":false},"author":9,"featured_media":1670,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[23,68,44,69,67,37],"class_list":["post-1669","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sluzby","tag-bezpecnost","tag-https","tag-ips-idsc-ochrana","tag-utoky","tag-webhosting","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1669","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/comments?post=1669"}],"version-history":[{"count":2,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1669\/revisions"}],"predecessor-version":[{"id":1686,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/posts\/1669\/revisions\/1686"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media\/1670"}],"wp:attachment":[{"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/media?parent=1669"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/categories?post=1669"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.wedos.com\/cs\/wp-json\/wp\/v2\/tags?post=1669"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}