{"id":145,"title":"Olay M\u00fcdahalesi Nedir?","content":"Olay M\u00fcdahalesi, bir bilgisayar veya a\u011f g\u00fcvenlik olay\u0131 meydana geldi\u011finde izlenen bir eylem s\u00fcreci olarak tan\u0131mlanabilir. Bir Olay M\u00fcdahale Uzman\u0131 olarak, sistemlerinizde neyin bulunmas\u0131 gerekti\u011fi ve neyin bulunmamas\u0131 gerekti\u011fi konusunda her zaman bilin\u00e7li olmal\u0131s\u0131n\u0131z. G\u00fcvenlik olaylar\u0131 \u015fu y\u00f6ntemlerle a\u015f\u0131labilir: - \u00c7al\u0131\u015fan s\u00fcre\u00e7leri inceleyerek - Fiziksel bellek i\u00e7eri\u011fine dair bilgi sahibi olarak - Ana bilgisayar ad\u0131, IP adresi, i\u015fletim sistemi gibi detaylar\u0131 toplayarak - Sistem servisleri hakk\u0131nda bilgi toplayarak - Sisteme giri\u015f yapm\u0131\u015f t\u00fcm bilinen ve bilinmeyen kullan\u0131c\u0131lar\u0131 tespit ederek - A\u011f ba\u011flant\u0131lar\u0131n\u0131, a\u00e7\u0131k portlar\u0131 ve herhangi bir a\u011f etkinli\u011fini kontrol ederek - Mevcut \u00e7e\u015fitli dosyalar\u0131 belirleyerek <strong>Kullan\u0131c\u0131 Hesaplar\u0131<\/strong> Bir Olay M\u00fcdahale Uzman\u0131 olarak, kullan\u0131c\u0131 hesaplar\u0131n\u0131n aktivitelerini ara\u015ft\u0131rmak \u00e7ok \u00f6nemlidir. Bu, giri\u015f yapm\u0131\u015f kullan\u0131c\u0131lar\u0131, mevcut kullan\u0131c\u0131lar\u0131, ola\u011fan veya ola\u011fan d\u0131\u015f\u0131 giri\u015fleri, ba\u015far\u0131s\u0131z giri\u015f denemelerini, izinleri, sudo eri\u015fimlerini anlaman\u0131za yard\u0131mc\u0131 olur. Kullan\u0131c\u0131 hesap aktivitesini kontrol etmek i\u00e7in \u00e7e\u015fitli komutlar: \/etc\/passwd Sisteminizde \u015f\u00fcpheli g\u00f6r\u00fcnebilecek bir hesap giri\u015fi olup olmad\u0131\u011f\u0131n\u0131 belirlemek i\u00e7in kullan\u0131l\u0131r. Bu komut genellikle kullan\u0131c\u0131 hesab\u0131yla ilgili t\u00fcm bilgileri getirir. Bunu yapmak i\u00e7in \u015funu yaz\u0131n: <pre  data-enlighter-language=\"python\">cat \/etc\/passwd <\/pre> &nbsp; \u00d6rnek \u00e7\u0131kt\u0131: <pre  data-enlighter-language=\"prolog\">root@ubuntu:z = Cat \/etc\/passwd root:x:0 src=x:\/root:\/blu\/bash deconrx:1:1:deconrx:\/usr\/sbtn:\/usr\/sbtn\/nologin bln:x:22:2:btn:\/btn:\/usr\/sbtn\/nologin sysr:3:33:sysr:\/dev:\/usr\/sbtn\/nologin sync:x:5:65534:sync:\/bsn:\/blu\/sync games:x:5:68 games:\/usr\/games:\/usr\/sbtn\/nologin nBN:x:6:12:nBN:\/usr\/cache\/nan:\/usr\/sbtn\/nologin lp:x:7:7:8:p:\/var\/spool:\/gb:\/usr\/sbtn\/nologin na1l:x:8:ne:la:f:\/var\/na1l:\/usr\/sbtn\/nologin news:x:9:9:news:\/var\/spool\/news:\/usr\/sbtn\/nologin upe9:x:10:10:news:\/var\/spool\/user:\/usr\/sbtn\/nologin proxy:x:13:13:proxy:\/blu:\/usr\/sbtn\/nologin new-data:x:31:33:new-data:\/var\/new:\/usr\/sbtn\/nologin backup:x:34:34:backup:\/var\/packups:\/usr\/sbtn\/nologin list:x:33:38:na1l:ll:x:4:Manner:\/var\/list:\/usr\/sbtn\/nologin trc:x:39:39:trcd:\/var\/run\/trcd:\/usr\/sbtn\/nologin gnat:x:44:41:Gnats:Big-Peeporting System (admin):\/var\/lib\/gnats:\/usr joboby:x:65534:65534:mobody:\/home:dcten:t:\/usr\/sbtn\/nologin<\/pre> Linux'ta Kullan\u0131c\u0131 Hesap \u0130nceleme Komutlar\u0131 <strong>passwd -s Komutu<\/strong> Linux'ta 'Setuid' se\u00e7ene\u011fi, \u00f6zel bir dosya iznidir. Bir kullan\u0131c\u0131 \u015fifre de\u011fi\u015ftirmek istedi\u011finde 'passwd' komutunu \u00e7al\u0131\u015ft\u0131rabilir. Root hesab\u0131 setuid olarak i\u015faretlendi\u011fi i\u00e7in ge\u00e7ici izinler elde edebilirsiniz. passwd -s raj \u00d6rnek \u00e7\u0131kt\u0131: <pre  data-enlighter-language=\"python\">root@ubuntu:~# passwd -s raj raj P 07\/05\/2020 0 99999 7 -1 root@ubuntu:~#<\/pre> &nbsp; &nbsp; ## grep Komutu Grep, d\u00fcz metin i\u00e7inde bir d\u00fczenli ifadeyle e\u015fle\u015fen sat\u0131rlar\u0131 aramak i\u00e7in kullan\u0131l\u0131r. `:0:` ifadesi, \/etc\/passwd dosyas\u0131ndaki 'UID 0' (root) kay\u0131tlar\u0131n\u0131 g\u00f6stermek i\u00e7in kullan\u0131l\u0131r. \u00d6rnek kullan\u0131m: <pre  data-enlighter-language=\"python\">grep :0: \/etc\/passwd<\/pre> &nbsp; &nbsp; \u00d6rnek \u00e7\u0131kt\u0131: <pre  data-enlighter-language=\"python\">root@ubuntu:~# grep :0: \/etc\/passwd root=x:0:0:root:\/root:\/bin\/bash<\/pre> &nbsp; <h2>find \/ -nouser Komutu<\/h2> Bir sald\u0131rgan\u0131n sald\u0131r\u0131 ger\u00e7ekle\u015ftirmek i\u00e7in ge\u00e7ici bir kullan\u0131c\u0131 olu\u015fturup olu\u015fturmad\u0131\u011f\u0131n\u0131 belirlemek ve g\u00f6r\u00fcnt\u00fclemek i\u00e7in kullan\u0131l\u0131r (sistemde tan\u0131ml\u0131 olmayan sahipsiz dosyalar\u0131 bulur). \u00d6rnek kullan\u0131m: <pre  data-enlighter-language=\"python\">find \/ -nouser -print<\/pre> \u00d6rnek \u00e7\u0131kt\u0131: <pre  data-enlighter-language=\"python\">root@ubuntu:~# find \/ -nouser -print find: '\/run\/user\/1000\/doc': Permission denied find: '\/run\/user\/1000\/gvfs': Permission denied \/var\/cache\/private\/fwupdngr \/var\/cache\/private\/fwupdngr\/fwupd \/var\/cache\/private\/fwupdngr\/fwupd\/lvfs-netadata.xml.gz.asc \/var\/cache\/private\/fwupdngr\/fwupd\/lvfs-netadata.xml.gz <\/pre> &nbsp; &nbsp; <pre  data-enlighter-language=\"bash\">cat \/etc\/shadow<\/pre> &nbsp; \u00d6rnek \u00e7\u0131kt\u0131: <pre  data-enlighter-language=\"bash\">root@ubuntu:~# cat \/etc\/shadow root1::18448:0:99999:7::: daemon:*:18375:0:99999:7::: bin:*:18375:0:99999:7:::<\/pre> &nbsp; **A\u00e7\u0131klama:** - `\/etc\/shadow` dosyas\u0131 \u015fifrelenmi\u015f parolalar\u0131 ve parola detaylar\u0131n\u0131 i\u00e7erir - Sadece **root** kullan\u0131c\u0131lar\u0131 taraf\u0131ndan eri\u015filebilir - Her sat\u0131r bir kullan\u0131c\u0131y\u0131 temsil eder ve `:` ile ayr\u0131lm\u0131\u015f 9 alan i\u00e7erir **Alanlar\u0131n Anlam\u0131:** 1. Kullan\u0131c\u0131 ad\u0131 2. \u015eifrelenmi\u015f parola (`*` hesab\u0131n kilitli oldu\u011funu, `!!` parola olmad\u0131\u011f\u0131n\u0131 g\u00f6sterir) 3. Son parola de\u011fi\u015fikli\u011fi tarihi (Unix zaman damgas\u0131) 4. Minimum parola \u00f6mr\u00fc (g\u00fcn) 5. Maksimum parola \u00f6mr\u00fc (g\u00fcn) 6. Parola de\u011fi\u015fikli\u011fi uyar\u0131 s\u00fcresi (g\u00fcn) 7. Hesap inaktivite s\u00fcresi (g\u00fcn) 8. Hesap son kullanma tarihi 9. Rezerve alan **\u00d6rnek Format:** <pre  data-enlighter-language=\"bash\">username:encrypted_password:last_change:min:max:warn:inactive:expire:reserved<\/pre> &nbsp; <pre  data-enlighter-language=\"python\">cat \/etc\/group root@ubuntu:~# cat \/etc\/group root:x:0: daemon:x:1: bin:x:2: sys:x:3: adm:x:4:syslog,raj,mtsp ttw:x:5:<\/pre> A\u00e7\u0131klama: - `\/etc\/group` dosyas\u0131, sistemdeki **kullan\u0131c\u0131 gruplar\u0131n\u0131n bilgilerini** i\u00e7erir. - Her sat\u0131r bir grubu temsil eder ve `:` ile ayr\u0131lm\u0131\u015f 4 alandan olu\u015fur: 1. **Grup ad\u0131** (\u00f6r. `root`, `adm`) 2. **Grup \u015fifresi** (genellikle `x` ile g\u00f6sterilir, \u015fifre `\/etc\/gshadow`'da saklan\u0131r) 3. **Grup ID (GID)** (\u00f6r. `0` root grubu i\u00e7in) 4. **Gruba ait kullan\u0131c\u0131lar** (virg\u00fclle ayr\u0131lm\u0131\u015f liste, \u00f6r. `syslog,raj,mtsp`) \u00d6nemli Gruplar: - `root` (GID 0): S\u00fcper kullan\u0131c\u0131 grubu. - `adm` (GID 4): Sistem loglar\u0131na eri\u015fimi olan kullan\u0131c\u0131lar (\u00f6r. `syslog`). - `sudo`: Sudo komutunu kullanabilen kullan\u0131c\u0131lar (bu \u00f6rnekte g\u00f6r\u00fcnm\u00fcyor ancak genellikle bulunur). Kullan\u0131m Senaryolar\u0131: 1. **Bir gruptaki kullan\u0131c\u0131lar\u0131 listelemek**: <pre  data-enlighter-language=\"python\">grep adm \/etc\/group<\/pre> &nbsp; \u00c7\u0131kt\u0131: `adm:x:4:syslog,raj,mtsp` 2.Kullan\u0131c\u0131n\u0131n ait oldu\u011fu gruplar\u0131 g\u00f6rmek: <pre  data-enlighter-language=\"python\">groups raj<\/pre> \u00c7\u0131kt\u0131: `raj : adm ...` (raj kullan\u0131c\u0131s\u0131n\u0131n `adm` grubunda oldu\u011funu g\u00f6sterir). sudo yap\u0131land\u0131rmas\u0131: `\/etc\/sudoers` dosyas\u0131n\u0131n i\u00e7eri\u011fi g\u00f6r\u00fcnt\u00fcleniyor. Bu dosya, sudo komutunun kimin hangi yetkilerle kullanabilece\u011fini belirleyen yap\u0131land\u0131rma dosyas\u0131d\u0131r. \u00e7al\u0131\u015ft\u0131r\u0131lan komut: <pre  data-enlighter-language=\"python\">cat \/etc\/sudoers <\/pre> Dosyan\u0131n i\u00e7eri\u011fi \u015funlar\u0131 g\u00f6steriyor: - Dosyan\u0131n sadece 'visudo' komutu ile d\u00fczenlenmesi gerekti\u011fi konusunda uyar\u0131 - Yerel de\u011fi\u015fikliklerin do\u011frudan bu dosyaya de\u011fil, `\/etc\/sudoers.d\/` dizini alt\u0131ndaki dosyalara eklenmesi \u00f6nerisi - Varsay\u0131lan ayarlar: env_reset, mail_badpass, secure_path - Kullan\u0131c\u0131 yetkileri: - root kullan\u0131c\u0131s\u0131 t\u00fcm komutlar\u0131 \u00e7al\u0131\u015ft\u0131rabilir: `root ALL=(ALL:ALL) ALL` - admin grubunun \u00fcyeleri root yetkilerine sahip olabilir: `%admin ALL=(ALL) ALL` - sudo grubunun \u00fcyeleri herhangi bir komutu \u00e7al\u0131\u015ft\u0131rabilir: `%sudo ALL=(ALL:ALL) ALL` - \/etc\/sudoers.d dizinindeki di\u011fer dosyalar\u0131n da dahil edildi\u011fini g\u00f6steren sat\u0131r <img  src=\"https:\/\/ondernet.net\/wp-content\/uploads\/2025\/03\/Screenshot_2-300x290.jpg\" alt=\"\" width=\"300\" height=\"290\" \/> Bu dosya, sistem y\u00f6neticisi taraf\u0131ndan dikkatle d\u00fczenlenmesi gereken kritik bir sistem dosyas\u0131d\u0131r. ..to be continued","excerpt":"Olay M\u00fcdahalesi, bir bilgisayar veya a\u011f g\u00fcvenlik olay\u0131 meydana geldi\u011finde izlenen bir eylem s\u00fcreci olarak tan\u0131mlanabilir. Bir Olay M\u00fcdahale...","created_at":"2025-03-27 22:52:41","updated_at":"2026-09-08 00:56:20","category_id":7,"view_count":680,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-03-27 22:52:41","featured_image":"resimyok.jpg","slug":"olay-mudahalesi-nedir","category_name":"Cyber Security","category_slug":"cyber-security"}