{"id":51,"title":"Linux Sunucu G\u00fcvenlik \u0130hlali Sonras\u0131 Yeniden Kurulum","content":"Kimse sunucusunun hacklenmesini d\u00fc\u015f\u00fcnmek istemez. Ancak \u015f\u00fcpheli trafik, de\u011fi\u015ftirilmi\u015f dosyalar veya bilinmeyen kullan\u0131c\u0131lar g\u00f6r\u00fcrseniz, tahmin y\u00fcr\u00fctmektense sistemi yeniden kurmak daha g\u00fcvenlidir. Bu rehberde, bir g\u00fcvenlik ihlali \u015f\u00fcphesi durumunda Linux sunucunuzu nas\u0131l g\u00fcvenli bir \u015fekilde yeniden kuraca\u011f\u0131n\u0131z\u0131, sald\u0131r\u0131n\u0131n nedenini nas\u0131l ara\u015ft\u0131raca\u011f\u0131n\u0131z\u0131 ve yeni sistemi bir sava\u015f alan\u0131na girmi\u015f\u00e7esine nas\u0131l sertle\u015ftirece\u011finizi anlataca\u011f\u0131m. <h2>\ud83d\udea8 \u0130lk Fark Etme: Sunucunuz Ger\u00e7ekten Compromise Edildi mi?<\/h2> <h3>\u015e\u00fcpheli Belirtiler<\/h3> Bir Linux sunucunun g\u00fcvenli\u011finin ihlal edildi\u011fini g\u00f6steren ana belirtiler \u015funlard\u0131r: <strong>Performans Anomalileri:<\/strong> <ul> <li>A\u00e7\u0131klanamayan y\u00fcksek CPU veya memory kullan\u0131m\u0131<\/li> <li>Bilinmeyen s\u00fcre\u00e7lerin \u00e7al\u0131\u015fmas\u0131<\/li> <li>Anormal network trafi\u011fi<\/li> <\/ul> <strong>Sistem De\u011fi\u015fiklikleri:<\/strong> <ul> <li>Yetkilendirilmemi\u015f kullan\u0131c\u0131 hesaplar\u0131<\/li> <li>De\u011fi\u015ftirilmi\u015f sistem dosyalar\u0131<\/li> <li>Web sayfalar\u0131n\u0131n \"Hacked\" mesajlar\u0131yla de\u011fi\u015ftirilmesi<\/li> <li>Beklenmeyen cronjob'lar veya startup script'leri<\/li> <\/ul> <strong>G\u00fcvenlik \u0130hlali \u0130\u015faretleri:<\/strong> <ul> <li>Loglar\u0131n silinmesi veya manip\u00fcle edilmesi<\/li> <li>Bilinen malware imzalar\u0131<\/li> <li>\u015e\u00fcpheli SSH ba\u011flant\u0131lar\u0131<\/li> <li>Rootkit belirtileri<\/li> <\/ul> <h3>H\u0131zl\u0131 De\u011ferlendirme Komutlar\u0131<\/h3> <pre><code ># \u00c7al\u0131\u015fan s\u00fcre\u00e7leri kontrol et ps aux | head -20 ps -elf | grep -v \"^\\ &gt; \/tmp\/suspicious_process_files.txt # Memory bilgileri cat \/proc\/meminfo &gt; \/tmp\/meminfo.txt cat \/proc\/version &gt; \/tmp\/kernel_version.txt <\/code><\/pre> <h3>Log Analizi<\/h3> <pre><code ># Son sistem loglar\u0131n\u0131 incele tail -n 1000 \/var\/log\/syslog &gt; \/tmp\/recent_syslog.txt tail -n 1000 \/var\/log\/auth.log &gt; \/tmp\/recent_auth.txt tail -n 1000 \/var\/log\/apache2\/access.log &gt; \/tmp\/recent_web_access.txt # \u015e\u00fcpheli giri\u015fleri ara grep \"Failed password\" \/var\/log\/auth.log | tail -50 grep \"Accepted password\" \/var\/log\/auth.log | tail -20 grep \"sudo:\" \/var\/log\/auth.log | tail -20 # Son de\u011fi\u015ftirilen dosyalar\u0131 bul find \/ -type f -mtime -1 -ls 2&gt;\/dev\/null | head -100 <\/code><\/pre> <h3>Rootkit Taramas\u0131<\/h3> <pre><code ># Chkrootkit ile tarama sudo chkrootkit &gt; \/tmp\/chkrootkit_results.txt # Rkhunter ile tarama sudo rkhunter -c --sk &gt; \/tmp\/rkhunter_results.txt # AIDE ile dosya b\u00fct\u00fcnl\u00fc\u011f\u00fc kontrol\u00fc sudo aide --check &gt; \/tmp\/aide_results.txt <\/code><\/pre> <h2>\ud83d\udd25 Nuclear Option: Tamamen Yeniden Kurulum<\/h2> <h3>1. Yedek Alma (Temiz Veriler \u0130\u00e7in)<\/h3> <pre><code ># Sadece gerekli kullan\u0131c\u0131 verilerini yedekle mkdir \/tmp\/backup_user_data cp -r \/home\/username\/important_data \/tmp\/backup_user_data\/ cp -r \/var\/www\/html\/uploaded_files \/tmp\/backup_user_data\/ # Konfig\u00fcrasyon dosyalar\u0131n\u0131 g\u00fcvenlik kontrol\u00fc ile yedekle cp \/etc\/apache2\/sites-available\/* \/tmp\/backup_configs\/ cp \/etc\/mysql\/mysql.conf.d\/* \/tmp\/backup_configs\/ <\/code><\/pre> <strong>\u26a0\ufe0f UYARI:<\/strong> Sadece temiz oldu\u011fundan emin oldu\u011funuz dosyalar\u0131 yedekleyin! <h3>2. Forensik \u0130maj Alma<\/h3> <pre><code ># Diskin forensik kopyas\u0131n\u0131 al sudo dd if=\/dev\/sda of=\/external\/disk_image.img bs=4M status=progress sudo sha256sum \/external\/disk_image.img &gt; \/external\/disk_image.sha256 <\/code><\/pre> <h3>3. Tamamen Yeni Kurulum<\/h3> Sistemi yeniden in\u015fa etmek, sisteminiz \u00fczerinde kontrole sahip oldu\u011funuzdan emin olman\u0131n tek yoludur <strong>Fiziksel Sunucu \u0130\u00e7in:<\/strong> <pre><code ># UEFI firmware'i g\u00fcncelle # BIOS ayarlar\u0131n\u0131 s\u0131f\u0131rla # Temiz i\u015fletim sistemi kur <\/code><\/pre> <strong>Sanal Makine \u0130\u00e7in:<\/strong> <pre><code ># Eski diski ay\u0131r # Yeni disk ekle # \u0130\u015fletim sistemini s\u0131f\u0131rdan kur <\/code><\/pre> <h2>\ud83d\udee1\ufe0f Yeni Sistem Sertle\u015ftirme<\/h2> <h3>Temel G\u00fcvenlik Yap\u0131land\u0131rmas\u0131<\/h3> <pre><code ># Sistemi g\u00fcncelle sudo apt update &amp;&amp; sudo apt upgrade -y # Gereksiz servisleri kapat sudo systemctl disable telnet sudo systemctl disable ftp sudo systemctl disable rsh # Firewall konfig\u00fcrasyonu sudo ufw enable sudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow ssh sudo ufw allow http sudo ufw allow https <\/code><\/pre> <h3>SSH Sertle\u015ftirme<\/h3> <pre><code ># SSH konfig\u00fcrasyonunu d\u00fczenle sudo nano \/etc\/ssh\/sshd_config # Yap\u0131lacak de\u011fi\u015fiklikler: # PermitRootLogin no # PasswordAuthentication no # PubkeyAuthentication yes # Port 2222 (default port de\u011fi\u015ftir) # MaxAuthTries 3 # LoginGraceTime 30 # AllowUsers your_username sudo systemctl restart ssh <\/code><\/pre> <h3>Otomatik G\u00fcvenlik Ara\u00e7lar\u0131<\/h3> <pre><code ># Fail2Ban kurulumu sudo apt install fail2ban -y # Fail2Ban konfig\u00fcrasyonu sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local sudo nano \/etc\/fail2ban\/jail.local # ClamAV antivirus kurulumu sudo apt install clamav clamav-daemon -y sudo freshclam sudo systemctl enable clamav-freshclam # AIDE dosya b\u00fct\u00fcnl\u00fck izleme sudo apt install aide -y sudo aide --init sudo mv \/var\/lib\/aide\/aide.db.new \/var\/lib\/aide\/aide.db <\/code><\/pre> <h3>Log \u0130zleme ve SIEM<\/h3> <pre><code ># Rsyslog konfig\u00fcrasyonu sudo nano \/etc\/rsyslog.conf # Loglar\u0131 merkezi sunucuya g\u00f6nder # Auditd kurulumu sudo apt install auditd -y sudo systemctl enable auditd # \u00d6nemli dosyalar\u0131 izleme alt\u0131na al sudo auditctl -w \/etc\/passwd -p wa -k passwd_changes sudo auditctl -w \/etc\/shadow -p wa -k shadow_changes sudo auditctl -w \/etc\/sudoers -p wa -k sudoers_changes <\/code><\/pre> <h2>\ud83d\udd0d Vulnerability Patching<\/h2> <h3>Sistem G\u00fcncellemeleri<\/h3> <pre><code ># Unattended upgrades kurulumu sudo apt install unattended-upgrades -y sudo dpkg-reconfigure -plow unattended-upgrades # Manual g\u00fcvenlik g\u00fcncellemeleri sudo apt list --upgradable sudo apt upgrade -y <\/code><\/pre> <h3>Uygulama G\u00fcvenli\u011fi<\/h3> <pre><code ># Web server sertle\u015ftirme (Apache) sudo nano \/etc\/apache2\/conf-available\/security.conf # ServerTokens Prod # ServerSignature Off # PHP sertle\u015ftirme sudo nano \/etc\/php\/7.4\/apache2\/php.ini # expose_php = Off # allow_url_fopen = Off # allow_url_include = Off # MySQL sertle\u015ftirme sudo mysql_secure_installation <\/code><\/pre> <h2>\ud83d\udcca \u0130zleme ve Alerting<\/h2> <h3>Sistem \u0130zleme<\/h3> <pre><code ># Netdata kurulumu (ger\u00e7ek zamanl\u0131 izleme) bash &lt;(curl -Ss https:\/\/my-netdata.io\/kickstart.sh) # OSSEC HIDS kurulumu wget -q -O - https:\/\/updates.atomicorp.com\/installers\/atomic | sudo bash sudo yum install ossec-hids ossec-hids-server <\/code><\/pre> <h3>Log Analizi<\/h3> <pre><code ># Logwatch kurulumu sudo apt install logwatch -y # Fail2Ban notification konfig\u00fcrasyonu sudo nano \/etc\/fail2ban\/jail.local # action = %(action_mwl)s # mta = sendmail <\/code><\/pre> <h2>\ud83d\ude80 Recovery ve Restore<\/h2> <h3>Veri Geri Y\u00fckleme<\/h3> <pre><code ># Temiz verileri geri y\u00fckle sudo rsync -av \/backup\/clean_data\/ \/var\/www\/html\/ sudo chown -R www-data:www-data \/var\/www\/html\/ # Veritaban\u0131n\u0131 geri y\u00fckle mysql -u root -p database_name &lt; \/backup\/clean_database.sql <\/code><\/pre> <h3>Servis Restorasyonu<\/h3> <pre><code ># Web servisi ba\u015flat sudo systemctl enable apache2 sudo systemctl start apache2 # Veritaban\u0131 servisi sudo systemctl enable mysql sudo systemctl start mysql # SSL sertifikalar\u0131n\u0131 yenile sudo certbot renew --force-renewal <\/code><\/pre> <h2>\ud83d\udcdd Incident Response Dok\u00fcmantasyonu<\/h2> <h3>Olay Raporu \u015eablonu<\/h3> <pre><code ># G\u00fcvenlik Olay\u0131 Raporu ## Olay \u00d6zeti - Tarih\/Saat: - Etkilenen Sistem: - Sald\u0131r\u0131 T\u00fcr\u00fc: - Etki D\u00fczeyi: ## Ke\u015fif - \u0130lk fark eden: - Ke\u015fif y\u00f6ntemi: - \u0130lk g\u00f6zlemler: ## Analiz - Sald\u0131r\u0131 vekt\u00f6r\u00fc: - Kullan\u0131lan ara\u00e7lar: - Zarar verilen dosyalar: - \u00c7al\u0131nan veriler: ## M\u00fcdahale - Al\u0131nan \u00f6nlemler: - Kullan\u0131lan ara\u00e7lar: - Temizlik ad\u0131mlar\u0131: ## Kurtarma - Restore i\u015flemleri: - Servis durumu: - Performans testi: ## Lessons Learned - Sald\u0131r\u0131n\u0131n nedeni: - Al\u0131nacak \u00f6nlemler: - Policy de\u011fi\u015fiklikleri: <\/code><\/pre> <h2>\ud83c\udfaf \u00d6nleyici Tedbirler<\/h2> <h3>D\u00fczenli G\u00fcvenlik De\u011ferlendirmesi<\/h3> <pre><code ># Haftal\u0131k g\u00fcvenlik taramas\u0131 scripti #!\/bin\/bash # security_scan.sh echo \"=== G\u00fcvenlik Taramas\u0131 Ba\u015fl\u0131yor ===\" date # Port taramas\u0131 nmap -sS localhost # Rootkit kontrol\u00fc rkhunter -c --sk # Log analizi grep \"Failed password\" \/var\/log\/auth.log | tail -10 # Disk kullan\u0131m\u0131 df -h # \u00c7al\u0131\u015fan servisler systemctl list-units --type=service --state=running echo \"=== Tarama Tamamland\u0131 ===\" <\/code><\/pre> <h3>Yedekleme Stratejisi<\/h3> <pre><code >#!\/bin\/bash # backup_script.sh BACKUP_DIR=\"\/backup\/$(date +%Y%m%d)\" mkdir -p $BACKUP_DIR # Sistem konfig\u00fcrasyonlar\u0131 tar -czf $BACKUP_DIR\/etc_backup.tar.gz \/etc\/ # Kullan\u0131c\u0131 verileri tar -czf $BACKUP_DIR\/home_backup.tar.gz \/home\/ # Veritaban\u0131 yedekleme mysqldump --all-databases &gt; $BACKUP_DIR\/all_databases.sql # Web dosyalar\u0131 tar -czf $BACKUP_DIR\/web_backup.tar.gz \/var\/www\/ # Yedekleri uzak sunucuya g\u00f6nder rsync -av $BACKUP_DIR\/ backup_server:\/backups\/ <\/code><\/pre> <h2>\ud83d\udd27 Otomasyonla \u0130yile\u015ftirme<\/h2> <h3>Ansible Playbook ile Otomatik Sertle\u015ftirme<\/h3> <pre><code ># security_hardening.yml --- - hosts: all become: yes tasks: - name: Update system packages apt: update_cache: yes upgrade: dist - name: Install security tools apt: name: - fail2ban - rkhunter - aide - clamav state: present - name: Configure SSH lineinfile: path: \/etc\/ssh\/sshd_config regexp: \"{{ item.regexp }}\" line: \"{{ item.line }}\" with_items: - { regexp: '^PermitRootLogin', line: 'PermitRootLogin no' } - { regexp: '^PasswordAuthentication', line: 'PasswordAuthentication no' } notify: restart ssh - name: Configure firewall ufw: rule: \"{{ item.rule }}\" port: \"{{ item.port }}\" proto: \"{{ item.proto }}\" with_items: - { rule: 'allow', port: '22', proto: 'tcp' } - { rule: 'allow', port: '80', proto: 'tcp' } - { rule: 'allow', port: '443', proto: 'tcp' } handlers: - name: restart ssh service: name: ssh state: restarted <\/code><\/pre> <h2>\ud83c\udf93 Sonu\u00e7 ve Tavsiyeler<\/h2> <h3>Ana \u00c7\u0131kar\u0131mlar<\/h3> <ol> <li><strong>H\u0131zl\u0131 M\u00fcdahale Kritiktir<\/strong>: Bir hacker sisteme girdi\u011finde, sistemde ne yapt\u0131\u011f\u0131 hakk\u0131nda hi\u00e7bir fikriniz olmaz - yeni SSH portlar\u0131, yeni hesaplar, yeni payla\u015f\u0131mlar, Apache kurallar\u0131nda ince de\u011fi\u015fiklikler ekleyebilir<\/li> <li><strong>Tam Yeniden Kurulum En G\u00fcvenli Se\u00e7enektir<\/strong>: Sistemin tamamen temizlenmesi ve yeniden kurulmas\u0131, kontrol\u00fcn size ait oldu\u011fundan emin olman\u0131n tek yoludur.<\/li> <li><strong>Prevention &gt; Reaction<\/strong>: D\u00fczenli g\u00fcncellemeler, g\u00fc\u00e7l\u00fc kimlik do\u011frulama ve monitoring ile sald\u0131r\u0131lar\u0131 \u00f6nlemek, m\u00fcdahale etmekten \u00e7ok daha etkilidir.<\/li> <li><strong>Dok\u00fcmantasyon Vazge\u00e7ilmezdir<\/strong>: Her ad\u0131m\u0131 belgeleyin, gelecekteki olaylardan ders \u00e7\u0131kar\u0131n.<\/li> <\/ol> <h3>Son Kontrol Listesi<\/h3> <ul> <li> A\u011f trafi\u011fi izleme aktif<\/li> <li> Otomatik yedekleme \u00e7al\u0131\u015f\u0131yor<\/li> <li> G\u00fcvenlik g\u00fcncellemeleri otomatik<\/li> <li> IDS\/IPS sistemleri aktif<\/li> <li> Log analizi yap\u0131l\u0131yor<\/li> <li>\u00a0plan\u0131 g\u00fcncel<\/li> <li> Tak\u0131m e\u011fitimi tamamland\u0131<\/li> <li> Forensik ara\u00e7lar haz\u0131r<\/li> <\/ul> <strong>Unutmay\u0131n:<\/strong> G\u00fcvenlik ihlali sadece teknik bir sorun de\u011fildir, t\u00fcm \u015firketi etkileyebilir ve ald\u0131\u011f\u0131n\u0131z aksiyonlar maliyetli olabilir. Bu y\u00fczden do\u011fru planlanm\u0131\u015f, sistematik bir yakla\u015f\u0131m benimseyin ve asla tek ba\u015f\u0131n\u0131za hareket etmeyin. Linux sunucu g\u00fcvenli\u011fi s\u00fcrekli bir s\u00fcre\u00e7tir. Bu rehberi temel alarak kendi incident response plan\u0131n\u0131z\u0131 geli\u015ftirin ve d\u00fczenli olarak test edin. \u00c7\u00fcnk\u00fc sald\u0131r\u0131 \"e\u011fer\" de\u011fil \"ne zaman\" sorusudur.","excerpt":"Kimse sunucusunun hacklenmesini d\u00fc\u015f\u00fcnmek istemez. Ancak \u015f\u00fcpheli trafik, de\u011fi\u015ftirilmi\u015f dosyalar veya bilinmeyen kullan\u0131c\u0131lar g\u00f6r\u00fcrseniz,...","created_at":"2025-06-12 13:19:22","updated_at":"2026-09-07 13:48:52","category_id":7,"view_count":733,"reading_time":8,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 13:19:22","featured_image":"resimyok.jpg","slug":"linux-sunucu-guvenlik-ihlali-sonrasi-yeniden-kurulum","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}