[{"id":53,"title":"\u201cJump-Box Forest\u201d (Bastion Forest)","content":"

jump box forest nedir<\/a><\/h2>\r\n

1\ufe0f\u20e3 “Jump-Box Forest” (Bastion Forest) Tasar\u0131m\u0131<\/h2>\r\n


Amaç: Domain Admin kimliklerini “internet-yüzlü” veya üretim sunucular\u0131ndan fiziksel olarak ay\u0131rmak. Böylece bir üretim sunucusu pwn’lense bile etki alan\u0131 tamamen gidemez.
H\u0131zl\u0131 Ölçüt: Tier-0 admin’in girebildi\u011fi tek makineler = bastion forest içindeki DC’ler + PAW’lar. Prod sunucuya asla interaktif logon yok, sadece Privileged Session Manager tüneli.<\/p>\r\n

2\ufe0f\u20e3 Credential Guard + VBS (Virtualization-Based Security)
Nas\u0131l Aç\u0131l\u0131r?<\/h2>\r\n

 <\/p>\r\n

# VBS + Credential Guard GPO\r\nSet-ItemProperty \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard\" `\r\n -Name EnableVirtualizationBasedSecurity -Value 1 -Type Dword\r\n\r\nSet-ItemProperty \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\LSA\" `\r\n -Name LsaCfgFlags -Value 1 -Type Dword\r\n# 1=CG on, 2=off, 0=not set\r\n<\/code><\/pre>\r\n
Kontrol: msinfo32 → “Device Guard - Credential Guard running: Yes”.
Gotcha’lar<\/p>\r\n
    \r\n
  • \r\n
    Klasik smart-card CSP’leri, baz\u0131 VPN sürücüleri ve eski AV çekirdek modülleri uyumsuz kalabilir.<\/p>\r\n<\/li>\r\n
  • \r\n
    Nested Hyper-V içinde VBS desteklenmez; fiziksel host’ta aç.<\/p>\r\n<\/li>\r\n
  • \r\n
    Pass-the-Hash denemeleri LSASS d\u0131\u015f\u0131nda kald\u0131\u011f\u0131 için ba\u015far\u0131s\u0131z olur.<\/p>\r\n<\/li>\r\n<\/ul>\r\n
    3\ufe0f\u20e3 TPM-Tabanl\u0131 BitLocker (OS & Data Disks)<\/h2>\r\n

    TPM’i haz\u0131rlay\u0131n: tpm.msc → “Prepare the TPM”. BIOS’ta PTT\/fTPM de\u011fil, donan\u0131m çipi olmas\u0131 tercih.
    BitLocker-TPM Mode:<\/p>\r\n
    Enable-BitLocker -MountPoint \"C:\" -TpmProtector -UsedSpaceOnly `\r\n -SkipHardwareTest\r\n<\/code><\/pre>\r\n
    Recovery Key Yönetimi<\/p>\r\n
      \r\n
    • \r\n
      Azure AD hybrid iseniz otomatik olarak Azure’daki cihaz objesine yüklenir.<\/p>\r\n<\/li>\r\n
    • \r\n
      On-prem ise GPO → Save BitLocker recovery information to AD DS.
      Network Unlock (iste\u011fe ba\u011fl\u0131): 2012+ DHCP\/WDS sunucusu, RFC 7030 sertifika.
      Pre-Boot PIN? Yaln\u0131zca yüksek tehdit modelleri için; aksi hâlde TPM + Secure Boot zaten yeterlidir.
      Golden rule: TPM 2.0 + Secure Boot + Measured Boot + BitLocker = disk çal\u0131p offline kurcalama ≈ bo\u015funa.<\/p>\r\n<\/li>\r\n<\/ul>\r\n
      4\ufe0f\u20e3 Azure Arc & Defender for Cloud ile Hibrit Sertle\u015ftirme<\/h2>\r\n

      Azure Arc Onboarding<\/p>\r\n
      # 1. Indir + kur\r\nInvoke-WebRequest -Uri https:\/\/aka.ms\/AzureArcAgent -OutFile ArcSetup.msi\r\nmsiexec \/i ArcSetup.msi \/l*v log.txt\r\n\r\n# 2. Azure CLI login\r\naz connectedmachine connect --resource-group RG-OnPrem \\\r\n --name ANT-FSRV01 --location westeurope\r\n<\/code><\/pre>\r\n
        \r\n
      • \r\n
        Sonras\u0131nda makine “Connected Machine” türünde görünür; Tag = Environment=OnPrem.<\/p>\r\n<\/li>\r\n
      • \r\n
        Arc Policy Guest Config sayesinde CIS - Server 2019 denetimlerini istedi\u011fin OU’ya zorlayabilirsin.<\/p>\r\n<\/li>\r\n<\/ul>\r\n
        Pro \u0130pucu: Arc-enabled sunucuyu “Auto-Provisioning = On” yap; Defender ajan\u0131 elle kurma. Alert’leri Sentinel’le birle\u015ftir, MITRE ATT&CK takibi haz\u0131r gelir.<\/p>\r\n
        5\ufe0f\u20e3 Hardware-Rooted Güvenlik: UEFI Secure Boot + Measured Boot + DRTM<\/h2>\r\n

        Etkinle\u015ftirme H\u0131z Turu<\/p>\r\n
          \r\n
        • \r\n
          BIOS → Secure Boot: Enabled, Trusted Execution: On.<\/p>\r\n<\/li>\r\n
        • \r\n
          Windows Features → “Device Health Attestation” ve “Hyper-V-Hypervisor”.<\/p>\r\n<\/li>\r\n
        • \r\n
          Shielded VM senaryosu: HGS kur; önyükleme ölçümlerini kar\u015f\u0131la\u015ft\u0131r\u0131p yaln\u0131z temiz host’ta VM açt\u0131r.<\/p>\r\n<\/li>\r\n<\/ul>\r\n
          Birlikte Çal\u0131\u015f\u0131nca Ne Oluyor?<\/p>\r\n
            \r\n
          • \r\n
            Jump-Box Forest Tier-0 admin kimliklerini ay\u0131r\u0131r.<\/p>\r\n<\/li>\r\n
          • \r\n
            PAW + Credential Guard bu kimliklerin RAM’de bile s\u0131zd\u0131r\u0131lmas\u0131n\u0131 engeller.<\/p>\r\n<\/li>\r\n
          • \r\n
            TPM + BitLocker disk çal\u0131nsa bile offline sald\u0131r\u0131lar\u0131 reddeder.<\/p>\r\n<\/li>\r\n
          • \r\n
            Secure Boot \/ DRTM i\u015fletim sistemi zincirinin ilk bit’ine kadar bütünlü\u011fü ölçer.<\/p>\r\n<\/li>\r\n
          • \r\n
            Azure Arc + Defender katman\u0131, bulut-temelli sürekli konfig uyumu + XDR izleme sunar.<\/p>\r\n<\/li>\r\n<\/ul>\r\n
            Sonuç: Sald\u0131rgan, tek bir sunucudan içeri girse bile domain komple gitmez; kal\u0131c\u0131l\u0131k kuramaz; s\u0131zma erken görünür.<\/p>\r\n
            Daha da Derine \u0130nmek \u0130stersek<\/p>\r\n
              \r\n
            • \r\n
              Windows Hello for Business (Key Trust) ile admin smart-card ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131 kald\u0131r.<\/p>\r\n<\/li>\r\n
            • \r\n
              Hyper-V “vTPM” + Shielding Data = production VM’leri de hardware-root’lu yap.<\/p>\r\n<\/li>\r\n
            • \r\n
              Attested Boot sonuçlar\u0131n\u0131 Azure Policy’de “deny” olarak ayarla → temiz boot etmeyen makine CI\/CD pipeline’a bile giremesin.<\/p>\r\n<\/li>\r\n
            • \r\n
              Intune + Config Mgr Co-Mgmt; PAW’lar için tam disk \u015fifreleme, application allow-listing (WDAC) politikalar\u0131n\u0131 hibrit da\u011f\u0131t.<\/p>\r\n<\/li>\r\n
            • \r\n
              PKI Rollup: Bastion forest içinde offline-root + online-issuing CA kur; tüm cihaz sertifikalar\u0131n\u0131 buradan ver, güven kökü yine Tier-0’da kals\u0131n.<\/p>\r\n<\/li>\r\n<\/ul>\r\n
              1\ufe0f\u20e3 Risk-Bedel Çizelgesi<\/h2>\r\n

              A\u015fa\u011f\u0131daki tabloyu kendi ortam\u0131n\u0131z\u0131n gerçek tehdit modeline (ör. regülasyon, bütçe, SLA) göre tart\u0131n. “Bedel” sat\u0131r\u0131nda 1 = ucuz \/ dü\u015fük efor, 5 = pahal\u0131 \/ yüksek efor; “Risk Azaltma”da 1 = kozmetik, 5 = oyun-de\u011fi\u015ftirici.
              H\u0131zl\u0131 karar kural\u0131: CapEx < 2 & Risk ≥ 4 ise “hemen yap”; CapEx ≥ 4 & Risk ≤ 3 ise POC → C-seviyesinde onay.<\/p>\r\n
              \ud83d\udcc1 0. Pre-Flight<\/p>\r\n
              # ScriptRunner.ps1\r\nInstall-Module -Name PSWindowsUpdate, Az.Accounts -Force -Scope CurrentUser\r\nImport-Module PSWindowsUpdate\r\nWrite-Host \"\u2705 Modüller haz\u0131r\"\r\n\r\n# Güvenli icra politikas\u0131\r\nSet-ExecutionPolicy AllSigned -Scope Process -Force\r\n<\/code><\/pre>\r\n
              \ud83c\udff0 1. Jump-Box Forest Kurulumu<\/p>\r\n
              # 1_Create-BastionForest.ps1\r\n$SecForestName = \"contoso-sec.local\"\r\n$SecNet = \"10.10.0.0\/24\"\r\n$DCEdition = \"Server2019Standard\"\r\n\r\nInstall-WindowsFeature AD-Domain-Services -IncludeManagementTools\r\nInstall-ADDSForest `\r\n -DomainName $SecForestName `\r\n -DatabasePath \"D:\\NTDS\" -SysvolPath \"D:\\SYSVOL\" `\r\n -SafeModeAdministratorPassword (Read-Host -AsSecureString \"DSRM PW\")\r\n\r\n# Tek-yön trust (Prod→Bastion güven)\r\nNew-ADTrust -Name $Env:USERDNSDOMAIN `\r\n -TargetForest $SecForestName `\r\n -Direction Outbound -Forest -Confirm:$false\r\n<\/code><\/pre>\r\n
              Devam eden görevler: Tier0-Admins global grubunu olu\u015ftur, üyelerini yaln\u0131z bastion DC’de tut.
              GPO: “Deny log on locally” → Domain Admin’leri prod DC’lerinde engelle.<\/p>\r\n
              \ud83d\udee1\ufe0f 2. Credential Guard + VBS<\/p>\r\n
              # 2_Enable-CredGuard.ps1\r\n$Servers = @(\"PAW01\",\"PAW02\")\r\nInvoke-Command -ComputerName $Servers -ScriptBlock {\r\n Set-ItemProperty -Path HKLM:\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard `\r\n -Name EnableVirtualizationBasedSecurity -Value 1 -Type DWord\r\n Set-ItemProperty -Path HKLM:\\SYSTEM\\CurrentControlSet\\Control\\LSA `\r\n -Name LsaCfgFlags -Value 1 -Type DWord\r\n gpupdate \/force\r\n}\r\nWrite-Host \"Credential Guard tetiklendi; reboot \u015fart\"\r\n\r\n# test\r\nInvoke-Command $Servers { Get-CimInstance Win32_DeviceGuard }\r\n<\/code><\/pre>\r\n
              \ud83d\udd11 3. TPM BitLocker Devreye Alma<\/p>\r\n
              # 3_Enable-BitLocker.ps1\r\n$Targets = Get-Content .\\servers-bitlocker.txt # her sat\u0131r FQDN\r\nforeach ($srv in $Targets) {\r\n Invoke-Command $srv -ScriptBlock {\r\n  Enable-BitLocker -MountPoint \"C:\" -TpmProtector -UsedSpaceOnly `\r\n  -RecoveryPasswordProtector `\r\n  -SkipHardwareTest\r\n }\r\n}\r\n<\/code><\/pre>\r\n
              Recovery Keys On-prem AD:<\/p>\r\n
              Get-BitLockerRecoveryPassword -MountPoint \"C:\" | Out-File \"\\\\SEC-DC\\Share\\Recovery\\$env:COMPUTERNAME.txt\"\r\n<\/code><\/pre>\r\n
              \ud83d\udd10 4. Secure Boot + DRTM Do\u011frulamas\u0131<\/p>\r\n
              # 4_Verify-SecureBoot.ps1\r\n$report = foreach ($srv in $Targets){\r\n $sb = Confirm-SecureBootUEFI -ErrorAction SilentlyContinue\r\n $tpm = Get-Tpm\r\n @{ Host = $srv; SecureBoot = $sb; TPM20 = $tpm.TpmSpecVersion }\r\n}\r\n$report | Export-Csv .\\SecureBootStatus.csv -NoType\r\n<\/code><\/pre>\r\n
              DRTM BIOS’ta aç\u0131ld\u0131ktan sonra Device Health Attestation servisi ölçü al\u0131r; Arc Policy ile “BootAttestation = Compliant” zorlanabilir.<\/p>\r\n
              \u2601\ufe0f 5. Azure Arc + Defender Birlikte<\/p>\r\n
              # 5_Arc-Defender.ps1\r\nConnect-AzAccount\r\n$rg = \"RG-OnPrem\"\r\n$loc = \"westeurope\"\r\n\r\n# Sunucular\u0131 Arc’e ba\u011fla\r\n$Srv = @(\"ANT-FSRV01\",\"ANT-SQL01\")\r\nforeach ($s in $Srv){\r\n Start-Process \"https:\/\/aka.ms\/AzureArcAgent\" -Wait -ArgumentList \"\/quiet\"\r\n az connectedmachine connect --resource-group $rg --name $s --location $loc\r\n}\r\n\r\n# Otomatik Defender plan\u0131\r\naz security auto-provisioning-setting update `\r\n --name default --auto-provision On\r\n<\/code><\/pre>\r\n
              \ud83d\udd04 \u0130\u015f Ak\u0131\u015f\u0131 & Zaman Çizelgesi (Fast-Track)
              Ek Bilgi:<\/p>\r\n
                \r\n
              • \r\n
                Budget-Savvy Taktik – Defender lisans\u0131n\u0131 “per-server on-demand” aç; yaln\u0131z Tier-0 ve DMZ makinelerinde 7×24 tam EDR.<\/p>\r\n<\/li>\r\n
              • \r\n
                DSC \/ Ansible – Playbook’u DSC’ye çevir; drift → Teams alert’i.<\/p>\r\n<\/li>\r\n
              • \r\n
                Supply-Chain Alarm\u0131 – UEFI Secure Boot ölçü verisini “Azure Attestation” ile CI\/CD pipeline’\u0131na entegre et.<\/p>\r\n<\/li>\r\n<\/ul>","excerpt":"1\ufe0f\u20e3 \u201cJump-Box Forest\u201d (Bastion Forest) Tasar\u0131m\u0131 Ama\u00e7: Domain Admin kimliklerini \u201cinternet-y\u00fczl\u00fc\u201d veya \u00fcretim sunucular\u0131ndan...","created_at":"2025-06-12 12:50:28","updated_at":"2026-09-07 13:55:07","category_id":7,"view_count":907,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 12:50:28","featured_image":"resimyok.jpg","slug":"jump-box-forest-bastion-forest","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}]