{"id":2269,"date":"2025-06-05T12:10:27","date_gmt":"2025-06-05T12:10:27","guid":{"rendered":"https:\/\/teknodc.net\/blog\/?p=2269"},"modified":"2025-06-05T12:10:27","modified_gmt":"2025-06-05T12:10:27","slug":"linux-sunucular-icin-temel-guvenlik-ayarlari","status":"publish","type":"post","link":"https:\/\/teknodc.net\/blog\/linux-sunucular-icin-temel-guvenlik-ayarlari\/","title":{"rendered":"Linux Sunucular i\u00e7in Temel G\u00fcvenlik Ayarlar\u0131"},"content":{"rendered":"<h2 data-sourcepos=\"3:1-3:47\">Linux Sunucular i\u00e7in Temel G\u00fcvenlik Ayarlar\u0131<\/h2>\n<p data-sourcepos=\"5:1-5:626\">Linux sunucular, esneklikleri, g\u00fc\u00e7l\u00fc yap\u0131lar\u0131 ve performanslar\u0131yla dijital d\u00fcnyan\u0131n belkemi\u011fini olu\u015fturur. Ancak, bu g\u00fcc\u00fcn beraberinde getirdi\u011fi en b\u00fcy\u00fck sorumluluklardan biri de Linux sunucu g\u00fcvenli\u011fidir. Siber tehditlerin her ge\u00e7en g\u00fcn artt\u0131\u011f\u0131 bu ortamda, sunucular\u0131n\u0131z\u0131 potansiyel sald\u0131r\u0131lara kar\u015f\u0131 korumak hayati \u00f6nem ta\u015f\u0131r. Peki, Linux g\u00fcvenlik ayarlar\u0131n\u0131 nas\u0131l do\u011fru bir \u015fekilde yap\u0131land\u0131rabilir ve sunucu g\u00fcvenli\u011fi nas\u0131l sa\u011flan\u0131r sorusuna kapsaml\u0131 bir yan\u0131t verebiliriz? Bu yaz\u0131m\u0131zda, Linux sunucular\u0131n\u0131z\u0131 daha diren\u00e7li hale getirecek temel g\u00fcvenlik ad\u0131mlar\u0131n\u0131 ve en iyi uygulamalar\u0131 detayl\u0131ca ele alaca\u011f\u0131z.<\/p>\n<h2 data-sourcepos=\"7:1-7:46\">Linux Sunucu G\u00fcvenli\u011fi Neden \u00d6nceliklidir?<\/h2>\n<p data-sourcepos=\"9:1-9:574\">Linux i\u015fletim sistemi, a\u00e7\u0131k kaynak kodlu olmas\u0131 ve geni\u015f bir geli\u015ftirici toplulu\u011funa sahip olmas\u0131 nedeniyle do\u011fas\u0131 gere\u011fi g\u00fcvenli kabul edilir. Ancak, bir <a href=\"https:\/\/www.google.com\/search?q=Sunucu+site%3Ateknodc.net&amp;oq=sunucu&amp;gs_lcrp=EgZjaHJvbWUqCAgAEEUYJxg7MggIABBFGCcYOzIJCAEQRRg5GIAEMgYIAhBFGDsyCAgDEEUYJxg7MgcIBBAAGIAEMgYIBRBFGDwyBggGEEUYPDIGCAcQRRg80gEIMjA1NmowajeoAgCwAgA&amp;sourceid=chrome&amp;ie=UTF-8\">sunucu<\/a> internete a\u00e7\u0131ld\u0131\u011f\u0131nda, d\u00fcnya \u00fczerindeki milyonlarca k\u00f6t\u00fc niyetli tarama ve sald\u0131r\u0131 giri\u015fimine maruz kal\u0131r. Zay\u0131f parolalar, g\u00fcncel olmayan yaz\u0131l\u0131mlar veya yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f ayarlar, sunucunuzu siber sald\u0131rganlar i\u00e7in kolay bir hedef haline getirebilir. Bu nedenle, proaktif Linux sunucu g\u00fcvenli\u011f<strong>i<\/strong> \u00f6nlemleri almak, verilerinizin, uygulamalar\u0131n\u0131z\u0131n ve itibar\u0131n\u0131z\u0131n korunmas\u0131 i\u00e7in mutlak bir zorunluluktur.<\/p>\n<h3 data-sourcepos=\"11:1-11:58\">Linux G\u00fcvenlik Ayarlar\u0131: Temel Ad\u0131mlar ve Yap\u0131land\u0131rma<\/h3>\n<p data-sourcepos=\"13:1-13:90\">Linux g\u00fcvenlik ayarlar\u0131n\u0131 yaparken izlemeniz gereken baz\u0131 temel ad\u0131mlar bulunmaktad\u0131r:<\/p>\n<ol data-sourcepos=\"15:1-44:0\">\n<li data-sourcepos=\"15:1-20:0\">\n<p data-sourcepos=\"15:5-15:31\"><strong>G\u00fcncel Tutma (Updates):<\/strong><\/p>\n<ul data-sourcepos=\"16:5-20:0\">\n<li data-sourcepos=\"16:5-16:244\">Sunucunuzu g\u00fcvende tutman\u0131n en basit ve en etkili yollar\u0131ndan biri, i\u015fletim sisteminizi ve t\u00fcm y\u00fckl\u00fc yaz\u0131l\u0131mlar\u0131 d\u00fczenli olarak g\u00fcncellemektir. G\u00fcvenlik yamalar\u0131, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapat\u0131r ve sisteminizi zafiyetlere kar\u015f\u0131 korur.<\/li>\n<li data-sourcepos=\"17:5-17:70\"><strong>Debian\/Ubuntu:<\/strong> <code>sudo apt update &amp;&amp; sudo apt upgrade<\/code><\/li>\n<li data-sourcepos=\"18:5-18:63\"><strong>CentOS\/RHEL:<\/strong> <code>sudo yum update<\/code> veya <code>sudo dnf update<\/code><\/li>\n<li data-sourcepos=\"19:5-20:0\">Otomatik g\u00fcncelleme ara\u00e7lar\u0131 (\u00f6rne\u011fin unattended-upgrades) kullanmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz, ancak kritik sunucularda g\u00fcncellemeleri manuel olarak kontrol etmek daha g\u00fcvenli olabilir.<\/li>\n<\/ul>\n<\/li>\n<li data-sourcepos=\"21:1-27:0\">\n<p data-sourcepos=\"21:5-22:113\"><strong>SSH G\u00fcvenli\u011fini Sa\u011flama:<\/strong> SSH (Secure Shell), Linux sunuculara uzaktan eri\u015fimin anahtar\u0131d\u0131r ve siber sald\u0131rganlar\u0131n birincil hedefidir.<\/p>\n<ul data-sourcepos=\"23:5-27:0\">\n<li data-sourcepos=\"23:5-23:269\"><strong>Root Eri\u015fimi Kapatma:<\/strong> Do\u011frudan root eri\u015fimi kapatma (SSH \u00fczerinden root ile giri\u015f yapmay\u0131 engelleme) Linux sunucu g\u00fcvenli\u011fi i\u00e7in hayati bir ad\u0131md\u0131r. Bunun yerine, normal bir kullan\u0131c\u0131 olu\u015fturun ve y\u00f6netici yetkisi gerektiren i\u015flemler i\u00e7in <code>sudo<\/code> kullan\u0131n.<\/li>\n<li data-sourcepos=\"24:5-24:202\"><strong>SSH Portu De\u011fi\u015ftirme:<\/strong> SSH&#8217;\u0131n varsay\u0131lan 22 numaral\u0131 portunu de\u011fi\u015ftirmek (\u00f6rn. 2222 gibi daha az bilinen bir port), otomatik bot taramalar\u0131n\u0131 ve brute-force sald\u0131r\u0131lar\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r.<\/li>\n<li data-sourcepos=\"25:5-25:207\"><strong>Parola Yerine SSH Anahtar Do\u011frulamas\u0131:<\/strong> SSH anahtar \u00e7iftleri, parola tabanl\u0131 kimlik do\u011frulamadan \u00e7ok daha g\u00fcvenlidir. Anahtar tabanl\u0131 do\u011frulamay\u0131 etkinle\u015ftirip parola do\u011frulamay\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n.<\/li>\n<li data-sourcepos=\"26:5-27:0\"><strong>\u0130ki Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (2FA):<\/strong> Ek bir g\u00fcvenlik katman\u0131 i\u00e7in SSH giri\u015flerinde 2FA&#8217;y\u0131 etkinle\u015ftirin.<\/li>\n<\/ul>\n<\/li>\n<li data-sourcepos=\"28:1-32:0\">\n<p data-sourcepos=\"28:5-28:48\"><strong>G\u00fcvenlik Duvar\u0131 Yap\u0131land\u0131rma (Firewall):<\/strong><\/p>\n<ul data-sourcepos=\"29:5-32:0\">\n<li data-sourcepos=\"29:5-29:164\">Bir g\u00fcvenlik duvar\u0131, sunucunuza gelen ve giden trafi\u011fi kontrol eden bir bariyerdir. Sadece ihtiya\u00e7 duydu\u011funuz portlara izin vererek sald\u0131r\u0131 y\u00fczeyini daralt\u0131r.<\/li>\n<li data-sourcepos=\"30:5-30:238\"><strong>UFW (Uncomplicated Firewall):<\/strong> Yeni ba\u015flayanlar i\u00e7in kolayd\u0131r. <code>sudo ufw default deny incoming<\/code> ile t\u00fcm gelen ba\u011flant\u0131lar\u0131 engelleyin, ard\u0131ndan sadece gerekli portlara (\u00f6rn. SSH i\u00e7in yeni portunuz, HTTP 80, HTTPS 443) izin verin.<\/li>\n<li data-sourcepos=\"31:5-32:0\"><strong>firewalld:<\/strong> CentOS\/RHEL sistemlerinde yayg\u0131n olarak kullan\u0131l\u0131r.<\/li>\n<\/ul>\n<\/li>\n<li data-sourcepos=\"33:1-36:0\">\n<p data-sourcepos=\"33:5-33:36\"><strong>Kullan\u0131c\u0131 ve Yetki Y\u00f6netimi:<\/strong><\/p>\n<ul data-sourcepos=\"34:5-36:0\">\n<li data-sourcepos=\"34:5-34:197\"><strong>En Az Yetki Prensibi:<\/strong> Her kullan\u0131c\u0131ya sadece i\u015fini yapmas\u0131 i\u00e7in gereken minimum yetkiyi verin. Root yetkisini yaln\u0131zca ger\u00e7ekten ihtiya\u00e7 duyan ki\u015filere ve \u00e7ok dikkatli bir \u015fekilde atay\u0131n.<\/li>\n<li data-sourcepos=\"35:5-36:0\"><strong>Kullan\u0131c\u0131lar\u0131n G\u00fcvenli\u011fi:<\/strong> Uzun s\u00fcredir kullan\u0131lmayan hesaplar\u0131 silin. G\u00fc\u00e7l\u00fc ve benzersiz parolalar kullan\u0131lmas\u0131n\u0131 zorunlu k\u0131l\u0131n.<\/li>\n<\/ul>\n<\/li>\n<li data-sourcepos=\"37:1-40:0\">\n<p data-sourcepos=\"37:5-37:39\"><strong>Hizmetleri G\u00fcvence Alt\u0131na Alma:<\/strong><\/p>\n<ul data-sourcepos=\"38:5-40:0\">\n<li data-sourcepos=\"38:5-38:173\"><strong>Gereksiz Servisleri Kapatma:<\/strong> Sunucunuzda \u00e7al\u0131\u015fmayan veya ihtiya\u00e7 duymad\u0131\u011f\u0131n\u0131z t\u00fcm servisleri devre d\u0131\u015f\u0131 b\u0131rak\u0131n. Her a\u00e7\u0131k servis, potansiyel bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r.<\/li>\n<li data-sourcepos=\"39:5-40:0\"><strong>Uygulama G\u00fcvenli\u011fi:<\/strong> Web sunucular\u0131 (Apache, Nginx), veritabanlar\u0131 (MySQL, PostgreSQL) ve di\u011fer uygulamalar\u0131n da kendi \u00f6zel g\u00fcvenlik ayarlar\u0131n\u0131 ve optimizasyonlar\u0131n\u0131 yapt\u0131\u011f\u0131n\u0131zdan emin olun.<\/li>\n<\/ul>\n<\/li>\n<li data-sourcepos=\"41:1-44:0\">\n<p data-sourcepos=\"41:5-41:31\"><strong>Log Y\u00f6netimi ve \u0130zleme:<\/strong><\/p>\n<ul data-sourcepos=\"42:5-44:0\">\n<li data-sourcepos=\"42:5-42:186\"><a href=\"\/virtualprivateserver\">Sunucu<\/a> loglar\u0131n\u0131 (g\u00fcnl\u00fck kay\u0131tlar\u0131n\u0131) d\u00fczenli olarak inceleyin. \u015e\u00fcpheli aktiviteleri veya hata mesajlar\u0131n\u0131 takip ederek olas\u0131 sald\u0131r\u0131lar\u0131 veya sorunlar\u0131 erken tespit edebilirsiniz.<\/li>\n<li data-sourcepos=\"43:5-44:0\">Fail2ban gibi ara\u00e7lar, belirli say\u0131da hatal\u0131 giri\u015f denemesinden sonra <a href=\"\/iprent\">IP adresleri<\/a>ni otomatik olarak engelleyerek brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<h3 data-sourcepos=\"45:1-45:61\">Sunucu G\u00fcvenli\u011fi Nas\u0131l Sa\u011flan\u0131r: B\u00fct\u00fcnsel Bir Bak\u0131\u015f A\u00e7\u0131s\u0131<\/h3>\n<p data-sourcepos=\"47:1-47:568\">Linux sunucu g\u00fcvenli\u011fi, tek seferlik bir i\u015flem de\u011fildir; s\u00fcrekli dikkat ve bak\u0131m gerektiren bir s\u00fcre\u00e7tir. Linux g\u00fcvenlik ayarlar\u0131n\u0131 yukar\u0131daki gibi temel ad\u0131mlarla g\u00fc\u00e7lendirmenin yan\u0131 s\u0131ra, d\u00fczenli yedeklemeler almak, s\u0131zma testleri yapmak, g\u00fcvenlik denetimleri ger\u00e7ekle\u015ftirmek ve bir felaket kurtarma plan\u0131 olu\u015fturmak da genel <a href=\"\/dedicated\">sunucu<\/a> g\u00fcvenli\u011fi nas\u0131l sa\u011flan\u0131r sorusuna verilen kapsaml\u0131 yan\u0131t\u0131n par\u00e7as\u0131d\u0131r. G\u00fcvenli\u011fi bir \u00f6ncelik haline getirerek, sunucular\u0131n\u0131z\u0131 ve \u00fczerindeki de\u011ferli verileri potansiyel tehditlere kar\u015f\u0131 daha diren\u00e7li hale getirebilirsiniz.<\/p>\n<hr data-sourcepos=\"49:1-49:3\" \/>\n<h3 data-sourcepos=\"51:1-51:30\">S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n<ul data-sourcepos=\"53:1-66:246\">\n<li data-sourcepos=\"53:1-55:0\">\n<h4 data-sourcepos=\"53:5-53:64\"><strong>Linux sunucu g\u00fcvenli\u011fi i\u00e7in ilk ve en \u00f6nemli ad\u0131m nedir?<\/strong><\/h4>\n<\/li>\n<\/ul>\n<p>Linux sunucu g\u00fcvenli\u011fi i\u00e7in ilk ve en \u00f6nemli ad\u0131m, i\u015fletim sistemi ve t\u00fcm yaz\u0131l\u0131mlar\u0131n d\u00fczenli olarak g\u00fcncel tutulmas\u0131d\u0131r. Bu, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n kapat\u0131lmas\u0131n\u0131 sa\u011flar.<\/p>\n<ul data-sourcepos=\"53:1-66:246\">\n<li data-sourcepos=\"56:1-58:0\">\n<h4 data-sourcepos=\"56:5-56:62\"><strong>Root eri\u015fimi kapatma neden \u00f6nemlidir ve nas\u0131l yap\u0131l\u0131r?<\/strong><\/h4>\n<\/li>\n<\/ul>\n<p>Root eri\u015fimi kapatma, sistemdeki en y\u00fcksek yetkili root kullan\u0131c\u0131s\u0131n\u0131n do\u011frudan SSH \u00fczerinden giri\u015f yapmas\u0131n\u0131 engeller, bu da sunucunun ele ge\u00e7irilme riskini azalt\u0131r. Bu, SSH yap\u0131land\u0131rma dosyas\u0131nda <code>PermitRootLogin no<\/code> ayarlamas\u0131 ve yeni bir sudo kullan\u0131c\u0131s\u0131 olu\u015fturarak yap\u0131l\u0131r.<\/p>\n<ul data-sourcepos=\"53:1-66:246\">\n<li data-sourcepos=\"59:1-61:0\">\n<h4 data-sourcepos=\"59:5-59:78\"><strong>SSH portunu de\u011fi\u015ftirmek sunucumu siber sald\u0131r\u0131lardan tamamen korur mu?<\/strong><\/h4>\n<\/li>\n<\/ul>\n<p>SSH portunu de\u011fi\u015ftirmek, otomatik botlar\u0131n ve basit tarama ara\u00e7lar\u0131n\u0131n sunucunuza eri\u015fim denemelerini b\u00fcy\u00fck \u00f6l\u00e7\u00fcde engeller, ancak hedefli sald\u0131r\u0131lara kar\u015f\u0131 tek ba\u015f\u0131na yeterli de\u011fildir. Ek g\u00fcvenlik katmanlar\u0131 (SSH anahtarlar\u0131, 2FA) kullanmak \u00f6nemlidir.<\/p>\n<ul data-sourcepos=\"53:1-66:246\">\n<li data-sourcepos=\"62:1-64:0\">\n<h4 data-sourcepos=\"62:5-62:80\"><strong>Sunucu g\u00fcvenli\u011fi nas\u0131l sa\u011flan\u0131r sorusunda g\u00fcvenlik duvar\u0131n\u0131n rol\u00fc nedir?<\/strong><\/h4>\n<\/li>\n<\/ul>\n<p>G\u00fcvenlik duvar\u0131, sunucu g\u00fcvenli\u011fi nas\u0131l sa\u011flan\u0131r sorusunun temel yan\u0131tlar\u0131ndan biridir. Sunucuya gelen ve giden a\u011f trafi\u011fini kontrol ederek, sadece izin verilen (beyaz listeye al\u0131nan) ba\u011flant\u0131lara izin verir ve yetkisiz eri\u015fimi engeller.<\/p>\n<ul data-sourcepos=\"53:1-66:246\">\n<li data-sourcepos=\"65:1-66:246\">\n<h4 data-sourcepos=\"65:5-65:79\"><strong>Fail2ban gibi ara\u00e7lar Linux sunucu g\u00fcvenli\u011fine ne gibi katk\u0131lar sa\u011flar?<\/strong><\/h4>\n<\/li>\n<\/ul>\n<p>Fail2ban gibi ara\u00e7lar, belirli bir IP adresinden gelen hatal\u0131 giri\u015f denemelerini (brute-force sald\u0131r\u0131lar\u0131) otomatik olarak alg\u0131lar ve bu IP adresini ge\u00e7ici veya kal\u0131c\u0131 olarak engeller. Bu, \u00f6zellikle SSH gibi servislerin g\u00fcvenli\u011fini art\u0131r\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Linux Sunucular i\u00e7in Temel G\u00fcvenlik Ayarlar\u0131 Linux sunucular, esneklikleri, g\u00fc\u00e7l\u00fc yap\u0131lar\u0131 ve performanslar\u0131yla dijital d\u00fcnyan\u0131n belkemi\u011fini&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2270,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[26],"tags":[],"class_list":["post-2269","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sunucu"],"_links":{"self":[{"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/posts\/2269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/comments?post=2269"}],"version-history":[{"count":1,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/posts\/2269\/revisions"}],"predecessor-version":[{"id":2271,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/posts\/2269\/revisions\/2271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/media\/2270"}],"wp:attachment":[{"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/media?parent=2269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/categories?post=2269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknodc.net\/blog\/wp-json\/wp\/v2\/tags?post=2269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}