{"id":50,"title":"Her Linux Sunucumda Uygulad\u0131\u011f\u0131m 7 CIS G\u00fcvenlik Uygulamas\u0131","content":"<p>Linux sunucu g&uuml;venli\u011fi konusunda 15+ y\u0131ll\u0131k deneyimim boyunca &ouml;\u011frendi\u011fim en &ouml;nemli \u015fey \u015fu: <strong>Varsay\u0131lan konfig&uuml;rasyonlar hi&ccedil;bir zaman yeterli de\u011fildir<\/strong>. Her yeni Linux sunucu kurdu\u011fumda, sistemi &uuml;retime almadan &ouml;nce mutlaka uygulad\u0131\u011f\u0131m 7 temel CIS (Center for Internet Security) g&uuml;venlik prati\u011fi var. Bu yaz\u0131da, bu uygulamalar\u0131 neden kritik buldu\u011fumu ve nas\u0131l hayata ge&ccedil;irdi\u011fimi anlataca\u011f\u0131m.<\/p>\r\n<h2>CIS Benchmarks Nedir ve Neden &Ouml;nemlidir?<\/h2>\r\n<p>CIS Benchmarks, d&uuml;nyan\u0131n d&ouml;rt bir yan\u0131ndan siber g&uuml;venlik uzmanlar\u0131n\u0131n consensus esasl\u0131 katk\u0131lar\u0131yla geli\u015ftirilmi\u015f, kapsaml\u0131 g&uuml;venlik konfig&uuml;rasyon rehberleridir. CIS standardlar\u0131n\u0131n bilinen g&uuml;venlik a&ccedil;\u0131klar\u0131n\u0131n %80-95'ini eliminate etti\u011fi kan\u0131tlanm\u0131\u015ft\u0131r. <strong>CIS Benchmarks'in Temel Prensipleri:<\/strong><\/p>\r\n<ul>\r\n<li><strong>Consensus-driven<\/strong>: Uzmanlar\u0131n ortakla\u015fa g&ouml;r&uuml;\u015f&uuml;yle geli\u015ftirilir<\/li>\r\n<li><strong>Vendor-neutral<\/strong>: Belirli bir &uuml;reticiye ba\u011fl\u0131 de\u011fildir<\/li>\r\n<li><strong>Level 1 ve Level 2<\/strong>: Temel ve ileri seviye g&uuml;venlik konfig&uuml;rasyonlar\u0131<\/li>\r\n<li><strong>Scored ve Not Scored<\/strong>: Zorunlu ve opsiyonel kontroller<\/li>\r\n<\/ul>\r\n<h2>1. SSH Sertle\u015ftirme: \u0130lk Savunma Hatt\u0131<\/h2>\r\n<p>SSH, Linux sunuculara eri\u015fimin temel y&ouml;ntemi oldu\u011fu i&ccedil;in sertle\u015ftirme s&uuml;recimin en kritik par&ccedil;as\u0131d\u0131r.<\/p>\r\n<h3>Temel SSH Yap\u0131land\u0131rmas\u0131<\/h3>\r\n<pre><code># SSH konfig&uuml;rasyon dosyas\u0131n\u0131 d&uuml;zenle sudo nano \/etc\/ssh\/sshd_config # Kritik ayarlar: Protocol 2 # Sadece SSH v2 kullan PermitRootLogin no # Root kullan\u0131c\u0131s\u0131n\u0131n SSH eri\u015fimini engelle PasswordAuthentication no # Parola tabanl\u0131 giri\u015fi devre d\u0131\u015f\u0131 b\u0131rak PubkeyAuthentication yes # Public key authentication aktif et Port 2222 # Varsay\u0131lan port de\u011fi\u015ftir MaxAuthTries 3 # Maksimum deneme say\u0131s\u0131n\u0131 s\u0131n\u0131rla MaxSessions 4 # E\u015fzamanl\u0131 oturum say\u0131s\u0131n\u0131 s\u0131n\u0131rla LoginGraceTime 30 # Giri\u015f s&uuml;resi s\u0131n\u0131r\u0131 AllowUsers your_username # Sadece belirli kullan\u0131c\u0131lara izin ver ClientAliveInterval 300 # \u0130naktif ba\u011flant\u0131lar\u0131 sonland\u0131r ClientAliveCountMax 2 # Maksimum hayatta kalma kontrol&uuml; HostBasedAuthentication no # Host tabanl\u0131 kimlik do\u011frulamay\u0131 devre d\u0131\u015f\u0131 b\u0131rak IgnoreRhosts yes # .rhosts dosyalar\u0131n\u0131 yoksay <\/code><\/pre>\r\n<h3>G&uuml;&ccedil;l&uuml; SSH Key Olu\u015fturma<\/h3>\r\n<pre><code># RSA 4096 bit key olu\u015ftur ssh-keygen -t rsa -b 4096 -C \"your_email@example.com\" # ED25519 (&ouml;nerilen - daha g&uuml;venli ve h\u0131zl\u0131) ssh-keygen -t ed25519 -C \"your_email@example.com\" # SSH directory g&uuml;venli\u011fini sa\u011fla chmod 700 ~\/.ssh chmod 600 ~\/.ssh\/authorized_keys chmod 600 ~\/.ssh\/id_rsa chmod 644 ~\/.ssh\/id_rsa.pub <\/code><\/pre>\r\n<h3>SSH Monitoring ve Fail2Ban<\/h3>\r\n<pre><code># Fail2Ban kurulumu sudo apt install fail2ban -y # SSH i&ccedil;in jail konfig&uuml;rasyonu sudo nano \/etc\/fail2ban\/jail.local enabled = true port = 2222 filter = sshd logpath = \/var\/log\/auth.log maxretry = 3 bantime = 3600 findtime = 600 sudo systemctl enable fail2ban sudo systemctl start fail2ban <\/code><\/pre>\r\n<h2>2. Firewall Konfig&uuml;rasyonu: A\u011f Trafi\u011fi Kontrol&uuml;<\/h2>\r\n<p>CIS Controls, host-based firewall ile varsay\u0131lan-reddet kural\u0131n\u0131n uygulanmas\u0131n\u0131 &ouml;nermektedir.<\/p>\r\n<h3>UFW (Uncomplicated Firewall) Kurulumu<\/h3>\r\n<pre><code># UFW'yi aktif et sudo ufw enable # Varsay\u0131lan politikalar\u0131 ayarla sudo ufw default deny incoming sudo ufw default allow outgoing # Gerekli portlar\u0131 a&ccedil; sudo ufw allow 2222\/tcp # SSH (&ouml;zel port) sudo ufw allow 80\/tcp # HTTP sudo ufw allow 443\/tcp # HTTPS # Belirli IP'den SSH eri\u015fimi (opsiyonel) sudo ufw allow from 192.168.1.100 to any port 2222 # Rate limiting ile SSH brute force korumas\u0131 sudo ufw limit 2222\/tcp # UFW durumunu kontrol et sudo ufw status verbose <\/code><\/pre>\r\n<h3>\u0130leri Seviye iptables Kurallar\u0131<\/h3>\r\n<pre><code># Temel iptables konfig&uuml;rasyonu #!\/bin\/bash # Mevcut kurallar\u0131 temizle iptables -F iptables -X iptables -t nat -F iptables -t nat -X iptables -t mangle -F iptables -t mangle -X # Varsay\u0131lan politikalar iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT # Loopback trafi\u011fine izin ver iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # Established ve related ba\u011flant\u0131lara izin ver iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # SSH eri\u015fimi (rate limiting ile) iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --set iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP iptables -A INPUT -p tcp --dport 2222 -j ACCEPT # Web servisleri iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT # ICMP (ping) s\u0131n\u0131rl\u0131 izin iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1\/s -j ACCEPT # Kurallar\u0131 kaydet iptables-save &gt; \/etc\/iptables\/rules.v4 <\/code><\/pre>\r\n<h2>3. Kullan\u0131c\u0131 Hesap Y&ouml;netimi: Least Privilege Prensibi<\/h2>\r\n<h3>G&uuml;&ccedil;l&uuml; Parola Politikas\u0131<\/h3>\r\n<pre><code># PAM konfig&uuml;rasyonu ile parola karma\u015f\u0131kl\u0131\u011f\u0131 sudo nano \/etc\/pam.d\/common-password # \u015eu sat\u0131r\u0131 ekle: password requisite pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 ocredit=-1 lcredit=-1 # Parola ge&ccedil;mi\u015fi kontrol&uuml; sudo nano \/etc\/pam.d\/common-password # \u015eu sat\u0131r\u0131 ekle: password required pam_pwhistory.so remember=5 # Hesap kilitleme politikas\u0131 sudo nano \/etc\/pam.d\/common-auth # \u015eu sat\u0131r\u0131 ekle: auth required pam_tally2.so deny=3 unlock_time=600 onerr=fail audit even_deny_root <\/code><\/pre>\r\n<h3>Sudo Konfig&uuml;rasyonu<\/h3>\r\n<pre><code># Sudo konfig&uuml;rasyonunu d&uuml;zenle sudo visudo # Kullan\u0131c\u0131 i&ccedil;in sudo izinleri your_username ALL=(ALL:ALL) ALL # Parola timeout ayar\u0131 Defaults passwd_timeout=5 # Sudo session timeout Defaults timestamp_timeout=15 # Sudo kullan\u0131m\u0131n\u0131 logla Defaults logfile=\"\/var\/log\/sudo.log\" Defaults log_input,log_output <\/code><\/pre>\r\n<h3>Gereksiz Kullan\u0131c\u0131 Hesaplar\u0131n\u0131 Temizleme<\/h3>\r\n<pre><code># Sistem kullan\u0131c\u0131lar\u0131n\u0131 kontrol et cat \/etc\/passwd | grep -v \"\/usr\/sbin\/nologin\\|\/bin\/false\" | cut -d: -f1 # Gereksiz hesaplar\u0131 devre d\u0131\u015f\u0131 b\u0131rak sudo usermod -L username # Hesab\u0131 kilitle sudo usermod -s \/bin\/false username # Shell eri\u015fimini engelle # Son giri\u015f tarihlerini kontrol et sudo lastlog | grep -v \"Never\" # Pasif hesaplar\u0131 tespit et sudo last | head -20 <\/code><\/pre>\r\n<h2>4. Sistem G&uuml;ncellemeleri ve Yamalar\u0131<\/h2>\r\n<h3>Otomatik G&uuml;venlik G&uuml;ncellemeleri<\/h3>\r\n<pre><code># Unattended upgrades kurulumu sudo apt install unattended-upgrades apt-listchanges -y # Konfig&uuml;rasyon sudo dpkg-reconfigure -plow unattended-upgrades # Manuel konfig&uuml;rasyon sudo nano \/etc\/apt\/apt.conf.d\/50unattended-upgrades # \u0130&ccedil;erik: Unattended-Upgrade::Allowed-Origins { \"${distro_id}:${distro_codename}-security\"; \"${distro_id}ESMApps:${distro_codename}-apps-security\"; \"${distro_id}ESM:${distro_codename}-infra-security\"; }; Unattended-Upgrade::AutoFixInterruptedDpkg \"true\"; Unattended-Upgrade::MinimalSteps \"true\"; Unattended-Upgrade::Remove-Unused-Dependencies \"true\"; Unattended-Upgrade::Automatic-Reboot \"false\"; # E-posta bildirimlerini aktif et Unattended-Upgrade::Mail \"admin@yourdomain.com\"; <\/code><\/pre>\r\n<h3>Manuel G&uuml;ncelleme Rutini<\/h3>\r\n<pre><code>#!\/bin\/bash # update_system.sh echo \"Sistem g&uuml;ncelleme ba\u015fl\u0131yor...\" # Paket listesini g&uuml;ncelle apt update # G&uuml;ncellenebilir paketleri listele apt list --upgradable # G&uuml;venlik g&uuml;ncellemelerini uygula apt upgrade -y # Sistem temizleme apt autoremove -y apt autoclean # Kernel g&uuml;ncellemesi kontrol&uuml; if ; then echo \"Sistem yeniden ba\u015flatma gerekiyor!\" echo \"Yeniden ba\u015flatma i&ccedil;in: sudo reboot\" fi echo \"G&uuml;ncelleme tamamland\u0131: $(date)\" <\/code><\/pre>\r\n<h2>5. Logging ve Monitoring: G&uuml;venlik Olaylar\u0131n\u0131 Yakalama<\/h2>\r\n<h3>Rsyslog Konfig&uuml;rasyonu<\/h3>\r\n<pre><code># Rsyslog konfig&uuml;rasyonu sudo nano \/etc\/rsyslog.conf # Uzak log g&ouml;nderimi i&ccedil;in (opsiyonel) *.* @@logserver.yourdomain.com:514 # Lokal log rotasyonu sudo nano \/etc\/logrotate.d\/rsyslog \/var\/log\/syslog { daily missingok rotate 52 compress delaycompress notifempty create 0640 syslog adm postrotate \/usr\/lib\/rsyslog\/rsyslog-rotate endscript } <\/code><\/pre>\r\n<h3>Auditd Kurulumu ve Konfig&uuml;rasyonu<\/h3>\r\n<pre><code># Auditd kurulumu sudo apt install auditd audispd-plugins -y # Auditd kurallar\u0131 sudo nano \/etc\/audit\/rules.d\/audit.rules # Kritik dosya de\u011fi\u015fikliklerini izle -w \/etc\/passwd -p wa -k passwd_changes -w \/etc\/shadow -p wa -k shadow_changes -w \/etc\/group -p wa -k group_changes -w \/etc\/sudoers -p wa -k sudoers_changes -w \/etc\/ssh\/sshd_config -p wa -k ssh_config_changes # Sistem &ccedil;a\u011fr\u0131lar\u0131n\u0131 izle -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change -a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -k time_change # Network konfig&uuml;rasyon de\u011fi\u015fikliklerini izle -w \/etc\/issue -p wa -k system_locale -w \/etc\/issue.net -p wa -k system_locale -w \/etc\/hosts -p wa -k system_locale -w \/etc\/network\/ -p wa -k system_locale # Auditd'yi yeniden ba\u015flat sudo systemctl restart auditd sudo systemctl enable auditd <\/code><\/pre>\r\n<h3>Log Analizi Ara&ccedil;lar\u0131<\/h3>\r\n<pre><code># Logwatch kurulumu sudo apt install logwatch -y # G&uuml;nl&uuml;k rapor konfig&uuml;rasyonu sudo nano \/etc\/logwatch\/conf\/logwatch.conf Detail = High MailTo = admin@yourdomain.com MailFrom = logwatch@yourdomain.com Format = html Range = today # Manuel logwatch raporu sudo logwatch --detail high --mailto admin@yourdomain.com --format html --range today <\/code><\/pre>\r\n<h2>6. Servis Sertle\u015ftirme: Sald\u0131r\u0131 Y&uuml;zeyini Minimize Etme<\/h2>\r\n<h3>Gereksiz Servislerin Tespiti ve Devre D\u0131\u015f\u0131 B\u0131rak\u0131lmas\u0131<\/h3>\r\n<pre><code># &Ccedil;al\u0131\u015fan servisleri listele systemctl list-units --type=service --state=running # A&ccedil;\u0131k portlar\u0131 kontrol et sudo netstat -tulpn sudo ss -tulpn # Gereksiz servisleri devre d\u0131\u015f\u0131 b\u0131rak sudo systemctl disable telnet sudo systemctl disable ftp sudo systemctl disable rsh sudo systemctl disable rlogin sudo systemctl disable tftp sudo systemctl disable xinetd sudo systemctl disable sendmail # E\u011fer mail server de\u011filse # Servis durumlar\u0131n\u0131 kontrol et sudo systemctl is-enabled service_name sudo systemctl is-active service_name <\/code><\/pre>\r\n<h3>Web Server Sertle\u015ftirme (Apache\/Nginx)<\/h3>\r\n<h4>Apache Sertle\u015ftirme<\/h4>\r\n<pre><code># Apache g&uuml;venlik mod&uuml;l&uuml; sudo a2enmod security2 sudo a2enmod headers sudo a2enmod ssl # G&uuml;venlik konfig&uuml;rasyonu sudo nano \/etc\/apache2\/conf-available\/security.conf # \u0130&ccedil;erik: ServerTokens Prod ServerSignature Off TraceEnable Off # G&uuml;venlik ba\u015fl\u0131klar\u0131 Header always set X-Content-Type-Options nosniff Header always set X-Frame-Options DENY Header always set X-XSS-Protection \"1; mode=block\" Header always set Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" Header always set Content-Security-Policy \"default-src 'self'\" # Konfig&uuml;rasyonu aktif et sudo a2enconf security sudo systemctl restart apache2 <\/code><\/pre>\r\n<h4>Nginx Sertle\u015ftirme<\/h4>\r\n<pre><code># Nginx g&uuml;venlik konfig&uuml;rasyonu sudo nano \/etc\/nginx\/nginx.conf # \u0130&ccedil;erik: server_tokens off; # SSL konfig&uuml;rasyonu ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; # Rate limiting limit_req_zone $binary_remote_addr zone=login:10m rate=10r\/m; # G&uuml;venlik ba\u015fl\u0131klar\u0131 add_header X-Frame-Options \"SAMEORIGIN\" always; add_header X-XSS-Protection \"1; mode=block\" always; add_header X-Content-Type-Options \"nosniff\" always; add_header Referrer-Policy \"no-referrer-when-downgrade\" always; add_header Content-Security-Policy \"default-src 'self' http: https: data: blob: 'unsafe-inline'\" always; <\/code><\/pre>\r\n<h2>7. Dosya Sistemi G&uuml;venli\u011fi ve \u0130zinler<\/h2>\r\n<h3>Kritik Dosya \u0130zinlerinin Ayarlanmas\u0131<\/h3>\r\n<pre><code># Sistem dosya izinlerini kontrol et ve d&uuml;zelt sudo chmod 644 \/etc\/passwd sudo chmod 600 \/etc\/shadow sudo chmod 644 \/etc\/group sudo chmod 600 \/etc\/gshadow sudo chmod 600 \/etc\/ssh\/sshd_config sudo chmod 755 \/etc\/ssh # World-writable dosyalar\u0131 bul ve d&uuml;zelt find \/ -type f -perm -002 -exec ls -la {} \\; 2&gt;\/dev\/null find \/ -type d -perm -002 -exec ls -ld {} \\; 2&gt;\/dev\/null # SUID\/SGID dosyalar\u0131n\u0131 kontrol et find \/ -type f \\( -perm -4000 -o -perm -2000 \\) -exec ls -la {} \\; 2&gt;\/dev\/null # Sahibi olmayan dosyalar\u0131 bul find \/ -nouser -o -nogroup 2&gt;\/dev\/null <\/code><\/pre>\r\n<h3>Disk \u015eifreleme ve Mount G&uuml;venli\u011fi<\/h3>\r\n<pre><code># Fstab g&uuml;venlik ayarlar\u0131 sudo nano \/etc\/fstab # &Ouml;rnek g&uuml;venli mount opsisonlar\u0131: \/dev\/sda1 \/tmp ext4 defaults,nodev,nosuid,noexec 0 2 tmpfs \/dev\/shm tmpfs defaults,nodev,nosuid,noexec 0 0 # Dosya sistemi b&uuml;t&uuml;nl&uuml;k kontrol&uuml; (AIDE) sudo apt install aide -y # AIDE veritaban\u0131n\u0131 ba\u015flat sudo aide --init sudo mv \/var\/lib\/aide\/aide.db.new \/var\/lib\/aide\/aide.db # G&uuml;nl&uuml;k b&uuml;t&uuml;nl&uuml;k kontrol&uuml; i&ccedil;in cron job echo \"0 5 * * * root \/usr\/bin\/aide --check | mail -s 'AIDE Integrity Check' admin@yourdomain.com\" &gt;&gt; \/etc\/crontab <\/code><\/pre>\r\n<h2>Otomatik CIS Compliance Kontrolleri<\/h2>\r\n<h3>CIS-CAT Lite ile Automated Assessment<\/h3>\r\n<pre><code>#!\/bin\/bash # cis_assessment.sh # CIS-CAT Lite indir (&uuml;cretsiz versiyon) wget https:\/\/learn.cisecurity.org\/cis-cat-lite # Unzip ve &ccedil;al\u0131\u015ft\u0131r unzip cis-cat-lite.zip cd CIS-CAT-Lite\/ # Ubuntu 20.04 i&ccedil;in assessment &ccedil;al\u0131\u015ft\u0131r .\/CIS-CAT.sh -i -a -x -r \/opt\/cis-reports\/ # Raporu analiz et echo \"CIS Assessment tamamland\u0131. Rapor: \/opt\/cis-reports\/\" <\/code><\/pre>\r\n<h3>Lynis ile Security Auditing<\/h3>\r\n<pre><code># Lynis kurulumu sudo apt install lynis -y # Tam g&uuml;venlik denetimi sudo lynis audit system # Raporu incele sudo lynis show report # &Ouml;neriler i&ccedil;in: sudo lynis show suggestions <\/code><\/pre>\r\n<h2>S&uuml;rekli \u0130yile\u015ftirme ve Monitoring<\/h2>\r\n<h3>Haftal\u0131k G&uuml;venlik Kontrol&uuml; Scripti<\/h3>\r\n<pre><code>#!\/bin\/bash # weekly_security_check.sh echo \"=== Haftal\u0131k G&uuml;venlik Kontrol&uuml; ===\" echo \"Tarih: $(date)\" # 1. Sistem g&uuml;ncellemelerini kontrol et echo \"--- Mevcut G&uuml;ncellemeler ---\" apt list --upgradable # 2. Son giri\u015f yapan kullan\u0131c\u0131lar\u0131 kontrol et echo \"--- Son Kullan\u0131c\u0131 Giri\u015fleri ---\" last | head -10 # 3. Ba\u015far\u0131s\u0131z SSH giri\u015flerini kontrol et echo \"--- Ba\u015far\u0131s\u0131z SSH Giri\u015fleri ---\" grep \"Failed password\" \/var\/log\/auth.log | tail -10 # 4. A&ccedil;\u0131k portlar\u0131 kontrol et echo \"--- A&ccedil;\u0131k Portlar ---\" ss -tulpn # 5. Disk kullan\u0131m\u0131n\u0131 kontrol et echo \"--- Disk Kullan\u0131m\u0131 ---\" df -h # 6. Y&uuml;ksek CPU\/Memory kullan\u0131m\u0131n\u0131 kontrol et echo \"--- Sistem Kaynaklar\u0131 ---\" top -bn1 | head -20 # 7. Fail2Ban durumunu kontrol et echo \"--- Fail2Ban Durumu ---\" fail2ban-client status echo \"=== Kontrol Tamamland\u0131 ===\" <\/code><\/pre>\r\n<h2>Sonu&ccedil; ve Tavsiyeler<\/h2>\r\n<p>Bu 7 CIS g&uuml;venlik prati\u011fi, Linux sunucular\u0131n\u0131z\u0131n g&uuml;venlik seviyesini &ouml;nemli &ouml;l&ccedil;&uuml;de art\u0131racakt\u0131r. <strong>Ancak g&uuml;venlik bir hedef de\u011fil, s&uuml;rekli bir s&uuml;re&ccedil;tir<\/strong>.<\/p>\r\n<h3>Hat\u0131rlanmas\u0131 Gerekenler:<\/h3>\r\n<ol>\r\n<li><strong>Test Ortam\u0131nda Deneyin<\/strong>: &Uuml;retim sunucular\u0131nda de\u011fi\u015fiklik yapmadan &ouml;nce mutlaka test edin<\/li>\r\n<li><strong>Dok&uuml;mante Edin<\/strong>: Her de\u011fi\u015fikli\u011fi kay\u0131t alt\u0131na al\u0131n<\/li>\r\n<li><strong>D&uuml;zenli Kontrol<\/strong>: G&uuml;venlik ayarlar\u0131n\u0131 d&uuml;zenli olarak g&ouml;zden ge&ccedil;irin<\/li>\r\n<li><strong>G&uuml;ncel Kal\u0131n<\/strong>: CIS Benchmarks d&uuml;zenli g&uuml;ncellenir, takip edin<\/li>\r\n<li><strong>Yedekleme<\/strong>: Kritik de\u011fi\u015fiklikler &ouml;ncesi sistem yede\u011fi al\u0131n<\/li>\r\n<\/ol>\r\n<h3>Sonraki Ad\u0131mlar:<\/h3>\r\n<ul>\r\n<li>IDS\/IPS sistemi kurulumu<\/li>\r\n<li>WAF (Web Application Firewall) implementasyonu<\/li>\r\n<li>Vulnerability scanning otomasyonu<\/li>\r\n<li>SIEM entegrasyonu<\/li>\r\n<li>Incident response plan\u0131 geli\u015ftirme<\/li>\r\n<\/ul>\r\n<p>Linux g&uuml;venli\u011fi karma\u015f\u0131k g&ouml;r&uuml;nse de, bu temel CIS pratiklerini sistematik olarak uygulayarak sunucular\u0131n\u0131z\u0131 siber tehditlere kar\u015f\u0131 &ouml;nemli &ouml;l&ccedil;&uuml;de koruyabilirsiniz. G&uuml;venlik katmanlar\u0131 prensibi gere\u011fi, hi&ccedil;bir tek &ouml;nlem %100 koruma sa\u011flamaz, ancak bu 7 uygulaman\u0131n kombinasyonu sald\u0131rganlar i&ccedil;in yeterince y&uuml;ksek bir engel olu\u015fturacakt\u0131r. Her sunucu kurulumunda bu listeyi kontrol ederek, g&uuml;venli bir temel &uuml;zerine in\u015fa etmeye devam edin. Unutmay\u0131n: <strong>En iyi savunma, proaktif &ouml;nlemlerdir<\/strong>.<\/p>","excerpt":"Linux sunucu g\u00fcvenli\u011fi konusunda 15+ y\u0131ll\u0131k deneyimim boyunca \u00f6\u011frendi\u011fim en \u00f6nemli \u015fey \u015fu: Varsay\u0131lan konfig\u00fcrasyonlar hi\u00e7bir zaman...","created_at":"2025-06-12 13:27:19","updated_at":"2026-09-07 14:10:51","category_id":7,"view_count":864,"reading_time":12,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 13:27:19","featured_image":"resimyok.jpg","slug":"her-linux-sunucumda-uyguladigim-7-cis-guvenlik-uygulamasi","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}