[{"id":49,"title":"SSH Brute-Force Sald\u0131r\u0131lar\u0131n\u0131 Ubuntu ve Red Hat'te Otomatik Olarak Nas\u0131l Engelleriz","content":"SSH servislerin \u00e7al\u0131\u015ft\u0131\u011f\u0131 herhangi bir sunucunun log dosyalar\u0131n\u0131 inceleyecek olursan\u0131z, sistematik giri\u015f denemelerini, bot'lar\u0131n ve sald\u0131rganlar\u0131n s\u00fcrekli parola deneme giri\u015fimlerini g\u00f6receksiniz. Bu brute-force sald\u0131r\u0131lar\u0131, Linux sunucular\u0131n\u0131n g\u00fcvenli\u011fini tehlikeye atman\u0131n en yayg\u0131n y\u00f6ntemlerinden biridir. Bu yaz\u0131da, Ubuntu ve Red Hat tabanl\u0131 sistemlerde SSH brute-force sald\u0131r\u0131lar\u0131n\u0131 otomatik olarak engellemek i\u00e7in kullanabilece\u011finiz pratik \u00e7\u00f6z\u00fcmleri detayl\u0131 olarak anlataca\u011f\u0131m. <h2>SSH Brute-Force Sald\u0131r\u0131lar\u0131 Nedir?<\/h2> Brute-force sald\u0131r\u0131lar\u0131, sald\u0131rganlar\u0131n sistematik olarak farkl\u0131 kullan\u0131c\u0131 ad\u0131 ve parola kombinasyonlar\u0131n\u0131 deneyerek sisteme yetkisiz eri\u015fim sa\u011flamaya \u00e7al\u0131\u015ft\u0131\u011f\u0131 otomatik sald\u0131r\u0131lard\u0131r. Bu sald\u0131r\u0131lar: <ul> <li><strong>Y\u00fcksek Frekansl\u0131<\/strong>: Saniyede y\u00fczlerce deneme yapabilir<\/li> <li><strong>S\u00fcrekli<\/strong>: 7\/24 devam edebilir<\/li> <li><strong>Otomatik<\/strong>: Bot'lar ve script'ler taraf\u0131ndan ger\u00e7ekle\u015ftirilir<\/li> <li><strong>Hedef Odakl\u0131<\/strong>: SSH (port 22) en pop\u00fcler hedeftir<\/li> <\/ul> <strong>Ger\u00e7ek D\u00fcnya \u00d6rne\u011fi:<\/strong> <pre><code ># Tipik brute-force sald\u0131r\u0131 log'u Jun 10 15:32:15 server sshd: Failed password for admin from 192.168.1.100 port 45678 ssh2 Jun 10 15:32:17 server sshd: Failed password for root from 192.168.1.100 port 45679 ssh2 Jun 10 15:32:19 server sshd: Failed password for user from 192.168.1.100 port 45680 ssh2 <\/code><\/pre> <h2>\u00c7\u00f6z\u00fcm 1: Fail2Ban - Dinamik IP Banlama<\/h2> Fail2ban, log dosyalar\u0131n\u0131 s\u00fcrekli izleyerek \u015f\u00fcpheli aktiviteleri tespit eden ve otomatik olarak firewall kurallar\u0131 olu\u015fturan bir intrusion prevention sistemidir. <h3>Ubuntu'da Fail2Ban Kurulumu<\/h3> <pre><code ># Paket listesini g\u00fcncelle sudo apt update # Fail2ban kurulumu sudo apt install fail2ban -y # Servisi etkinle\u015ftir ve ba\u015flat sudo systemctl enable fail2ban sudo systemctl start fail2ban # Durumu kontrol et sudo systemctl status fail2ban <\/code><\/pre> <h3>Red Hat\/CentOS'ta Fail2Ban Kurulumu<\/h3> <pre><code ># EPEL repository'yi etkinle\u015ftir (gerekiyorsa) sudo yum install epel-release -y # RHEL 8\/9 i\u00e7in sudo dnf install fail2ban -y # RHEL 7\/CentOS 7 i\u00e7in sudo yum install fail2ban -y # Servisi ba\u015flat sudo systemctl enable fail2ban sudo systemctl start fail2ban <\/code><\/pre> <h3>Fail2Ban SSH Jail Konfig\u00fcrasyonu<\/h3> <pre><code ># Ana konfig\u00fcrasyon dosyas\u0131n\u0131 kopyala sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local # SSH jail'i i\u00e7in \u00f6zel konfig\u00fcrasyon sudo nano \/etc\/fail2ban\/jail.d\/sshd.local <\/code><\/pre> <strong>SSH Jail Konfig\u00fcrasyonu (<code>\/etc\/fail2ban\/jail.d\/sshd.local<\/code>):<\/strong> <pre><code > enabled = true port = ssh filter = sshd logpath = \/var\/log\/auth.log # Ubuntu #logpath = \/var\/log\/secure # Red Hat\/CentOS maxretry = 3 # 3 ba\u015far\u0131s\u0131z denemeden sonra banla bantime = 3600 # 1 saat ban s\u00fcresi (3600 saniye) findtime = 600 # 10 dakika i\u00e7inde 3 deneme ignoreip = 127.0.0.1\/8 # Yerel IP'leri hari\u00e7 tut backend = systemd # Modern sistemler i\u00e7in # E-posta bildirimleri i\u00e7in (opsiyonel) action = %(action_mwl)s <\/code><\/pre> <strong>\u0130leri Seviye SSH Jail Konfig\u00fcrasyonu:<\/strong> <pre><code > enabled = true port = ssh filter = sshd logpath = \/var\/log\/auth.log maxretry = 2 # Daha agresif: 2 deneme bantime = 86400 # 24 saat ban findtime = 300 # 5 dakika pencere backend = systemd # Recidive (tekrar eden) sald\u0131rganlar i\u00e7in enabled = true filter = recidive logpath = \/var\/log\/fail2ban.log maxretry = 3 bantime = 604800 # 1 hafta ban findtime = 86400 # 24 saat i\u00e7inde <\/code><\/pre> <h3>Fail2Ban Servisini Yeniden Ba\u015flatma ve Test<\/h3> <pre><code ># Konfig\u00fcrasyonu test et sudo fail2ban-client -t # Servisi yeniden ba\u015flat sudo systemctl restart fail2ban # SSH jail durumunu kontrol et sudo fail2ban-client status sshd # Fail2ban genel durumu sudo fail2ban-client status <\/code><\/pre> <h3>Fail2Ban Y\u00f6netimi ve \u0130zleme<\/h3> <pre><code ># Banl\u0131 IP'leri listele sudo fail2ban-client status sshd # Specific IP'yi manuel banla sudo fail2ban-client set sshd banip 192.168.1.100 # IP ban'\u0131n\u0131 kald\u0131r sudo fail2ban-client set sshd unbanip 192.168.1.100 # T\u00fcm ban'lar\u0131 temizle sudo fail2ban-client unban --all # Fail2ban log'lar\u0131n\u0131 izle sudo tail -f \/var\/log\/fail2ban.log <\/code><\/pre> <h2>\u00c7\u00f6z\u00fcm 2: PAM Faillock - Sistem Seviyesi Hesap Kilitleme<\/h2> PAM (Pluggable Authentication Modules) faillock, ba\u015far\u0131s\u0131z giri\u015f denemelerinden sonra kullan\u0131c\u0131 hesaplar\u0131n\u0131 sistem seviyesinde kilitleyen bir mod\u00fcld\u00fcr. <h3>Ubuntu'da PAM_tally2 Kullan\u0131m\u0131<\/h3> Ubuntu sistemlerinde genellikle <code>pam_tally2<\/code> mod\u00fcl\u00fc kullan\u0131l\u0131r: <pre><code ># PAM konfig\u00fcrasyon dosyalar\u0131n\u0131 d\u00fczenle sudo nano \/etc\/pam.d\/common-auth # \u015eu sat\u0131rlar\u0131 ekle: auth required pam_tally2.so deny=3 unlock_time=1800 onerr=fail audit even_deny_root # Account konfig\u00fcrasyonu sudo nano \/etc\/pam.d\/common-account # \u015eu sat\u0131r\u0131 ekle: account required pam_tally2.so <\/code><\/pre> <strong>PAM_tally2 Parametreleri:<\/strong> <ul> <li><code>deny=3<\/code>: 3 ba\u015far\u0131s\u0131z denemeden sonra kilitle<\/li> <li><code>unlock_time=1800<\/code>: 30 dakika sonra otomatik kilidi a\u00e7<\/li> <li><code>onerr=fail<\/code>: Hata durumunda ba\u015far\u0131s\u0131z say<\/li> <li><code>audit<\/code>: Giri\u015fimleri logla<\/li> <li><code>even_deny_root<\/code>: Root kullan\u0131c\u0131s\u0131n\u0131 da kilitle<\/li> <\/ul> <h3>Red Hat\/CentOS'ta PAM_faillock Kullan\u0131m\u0131<\/h3> Modern Red Hat sistemlerinde <code>pam_faillock<\/code> tercih edilir: <pre><code ># Sistem auth konfig\u00fcrasyonu sudo nano \/etc\/pam.d\/system-auth # Auth b\u00f6l\u00fcm\u00fcne ekle: auth required pam_faillock.so preauth silent audit deny=3 unlock_time=1800 auth required pam_faillock.so authfail audit deny=3 unlock_time=1800 # Account b\u00f6l\u00fcm\u00fcne ekle: account required pam_faillock.so # Password auth konfig\u00fcrasyonu sudo nano \/etc\/pam.d\/password-auth # Ayn\u0131 sat\u0131rlar\u0131 buraya da ekle <\/code><\/pre> <strong>Modern PAM_faillock Konfig\u00fcrasyonu (\/etc\/security\/faillock.conf):<\/strong> <pre><code ># Faillock konfig\u00fcrasyonu deny = 3 # Maksimum ba\u015far\u0131s\u0131z deneme unlock_time = 1800 # Kilit s\u00fcresi (saniye) fail_interval = 900 # Ba\u015far\u0131s\u0131z deneme penceresi dir = \/var\/run\/faillock # Faillock dosya dizini audit # Audit loglar\u0131 aktif silent # Sessiz mod even_deny_root # Root'u da kilitle <\/code><\/pre> <h3>PAM Faillock Y\u00f6netimi<\/h3> <pre><code ># Kullan\u0131c\u0131n\u0131n ba\u015far\u0131s\u0131z deneme say\u0131s\u0131n\u0131 kontrol et sudo faillock --user username # Kullan\u0131c\u0131n\u0131n kilitini a\u00e7 sudo faillock --user username --reset # T\u00fcm kullan\u0131c\u0131lar\u0131n durumunu g\u00f6ster sudo faillock # \u00d6rnek output: # user1: # When Type Source Valid # 2025-06-12 14:30:15 RHOST 192.168.1.100 V # 2025-06-12 14:30:18 RHOST 192.168.1.100 V # 2025-06-12 14:30:21 RHOST 192.168.1.100 V <\/code><\/pre> <h2>\u00c7\u00f6z\u00fcm 3: iptables ile Rate Limiting<\/h2> Iptables kullanarak connection rate limiting uygulayabilirsiniz: <pre><code ># SSH connection rate limiting sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP # Alternatif olarak hashlimit mod\u00fcl\u00fc sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m hashlimit --hashlimit-above 3\/min --hashlimit-burst 3 --hashlimit-mode srcip --hashlimit-name ssh --hashlimit-htable-expire 60000 -j DROP # Kurallar\u0131 kaydet # Ubuntu i\u00e7in: sudo iptables-save &gt; \/etc\/iptables\/rules.v4 # Red Hat i\u00e7in: sudo service iptables save <\/code><\/pre> <h2>\u00c7\u00f6z\u00fcm 4: SSH Konfig\u00fcrasyon Sertle\u015ftirme<\/h2> SSH daemon konfig\u00fcrasyonunu sertle\u015ftirerek sald\u0131r\u0131 y\u00fczeyini azalt\u0131n: <pre><code ># SSH konfig\u00fcrasyonu sudo nano \/etc\/ssh\/sshd_config # G\u00fcvenlik ayarlar\u0131: MaxAuthTries 3 # Maksimum deneme say\u0131s\u0131 MaxSessions 4 # Maksimum e\u015fzamanl\u0131 oturum LoginGraceTime 30 # Giri\u015f s\u00fcresi limiti ClientAliveInterval 300 # Keep-alive s\u00fcresi ClientAliveCountMax 2 # Maksimum keep-alive say\u0131s\u0131 # Ba\u011flant\u0131 s\u0131n\u0131rlamalar\u0131 MaxStartups 3 # Bekleyen ba\u011flant\u0131 say\u0131s\u0131 # Kullan\u0131c\u0131 k\u0131s\u0131tlamalar\u0131 AllowUsers admin user1 # Sadece belirli kullan\u0131c\u0131lar DenyUsers root guest # Yasakl\u0131 kullan\u0131c\u0131lar # Root giri\u015fini engelle PermitRootLogin no # Parola tabanl\u0131 giri\u015fi devre d\u0131\u015f\u0131 b\u0131rak PasswordAuthentication no PubkeyAuthentication yes # SSH restart sudo systemctl restart sshd <\/code><\/pre> <h2>Kombine \u00c7\u00f6z\u00fcm: \u00c7ok Katmanl\u0131 G\u00fcvenlik<\/h2> En etkili yakla\u015f\u0131m, birden fazla y\u00f6ntemi birle\u015ftirmektir: <h3>1. SSH Sertle\u015ftirme + Fail2Ban Kombinasyonu<\/h3> <pre><code ># 1. SSH'\u0131 sertle\u015ftir sudo nano \/etc\/ssh\/sshd_config # MaxAuthTries 2 # LoginGraceTime 20 # 2. Agresif Fail2Ban konfig\u00fcrasyonu sudo nano \/etc\/fail2ban\/jail.d\/ssh-hardened.local <\/code><\/pre> <pre><code > enabled = true port = ssh filter = sshd logpath = \/var\/log\/auth.log maxretry = 2 bantime = 7200 # 2 saat findtime = 300 # 5 dakika backend = systemd enabled = true filter = sshd-ddos port = ssh logpath = \/var\/log\/auth.log maxretry = 6 bantime = 3600 findtime = 60 <\/code><\/pre> <h3>2. PAM Faillock + Fail2Ban Hybrid<\/h3> <pre><code ># PAM ile yerel hesap korumas\u0131 # Fail2Ban ile a\u011f seviyesi korumas\u0131 # \/etc\/security\/faillock.conf deny = 2 unlock_time = 900 # \/etc\/fail2ban\/jail.d\/hybrid.local enabled = true port = ssh filter = sshd maxretry = 3 bantime = 1800 findtime = 600 <\/code><\/pre> <h2>\u0130zleme ve Alerting<\/h2> <h3>1. Fail2Ban E-posta Bildirimleri<\/h3> <pre><code ># Postfix kurulumu (Ubuntu) sudo apt install postfix mailutils -y # Fail2Ban action konfig\u00fcrasyonu sudo nano \/etc\/fail2ban\/action.d\/sendmail-common.local <\/code><\/pre> <pre><code > actionstart = echo \"Fail2ban %(name)s started on %(hostname)s\" | mail -s \"Fail2ban Alert\" admin@yourdomain.com actionstop = echo \"Fail2ban %(name)s stopped on %(hostname)s\" | mail -s \"Fail2ban Alert\" admin@yourdomain.com actionban = echo \"IP %(ip)s banned on %(hostname)s\" | mail -s \"Fail2ban Ban Alert\" admin@yourdomain.com actionunban = echo \"IP %(ip)s unbanned on %(hostname)s\" | mail -s \"Fail2ban Unban Alert\" admin@yourdomain.com <\/code><\/pre> <h3>2. Log \u0130zleme Script'i<\/h3> <pre><code >#!\/bin\/bash # ssh_monitor.sh # SSH sald\u0131r\u0131 analizi echo \"=== SSH Brute Force Analizi ===\" echo \"Son 24 saatteki ba\u015far\u0131s\u0131z SSH giri\u015fleri:\" # Ubuntu i\u00e7in if ; then grep \"Failed password\" \/var\/log\/auth.log | grep \"$(date +'%b %d')\" | \\ awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -10 fi # Red Hat i\u00e7in if ; then grep \"Failed password\" \/var\/log\/secure | grep \"$(date +'%b %d')\" | \\ awk '{print $(NF-3)}' | sort | uniq -c | sort -nr | head -10 fi echo \"\" echo \"=== Fail2Ban Durumu ===\" fail2ban-client status sshd echo \"\" echo \"=== PAM Faillock Durumu ===\" faillock 2&gt;\/dev\/null || pam_tally2 2&gt;\/dev\/null || echo \"PAM faillock\/tally2 bulunamad\u0131\" <\/code><\/pre> <h3>3. Ger\u00e7ek Zamanl\u0131 \u0130zleme<\/h3> <pre><code ># Fail2ban log'lar\u0131n\u0131 canl\u0131 izleme sudo tail -f \/var\/log\/fail2ban.log | grep -E \"(Ban|Unban|NOTICE)\" # SSH giri\u015flerini canl\u0131 izleme sudo tail -f \/var\/log\/auth.log | grep sshd # Ubuntu sudo tail -f \/var\/log\/secure | grep sshd # Red Hat # Banl\u0131 IP'leri periyodik kontrol watch -n 5 'fail2ban-client status sshd' <\/code><\/pre> <h2>Troubleshooting ve Yayg\u0131n Sorunlar<\/h2> <h3>1. Kendimizi Banlad\u0131k<\/h3> <pre><code ># Fiziksel eri\u015fim varsa: sudo fail2ban-client set sshd unbanip YOUR_IP # Alternatif olarak fail2ban'\u0131 durdur sudo systemctl stop fail2ban # IP'yi manuel olarak iptables'dan kald\u0131r sudo iptables -D fail2ban-sshd -s YOUR_IP -j REJECT <\/code><\/pre> <h3>2. PAM Faillock \u00c7al\u0131\u015fm\u0131yor<\/h3> <pre><code ># SSH konfig\u00fcrasyonunu kontrol et sudo nano \/etc\/ssh\/sshd_config # Bu ayarlar olmal\u0131: UsePAM yes ChallengeResponseAuthentication yes PasswordAuthentication no # PAM conversation'\u0131 zorlamak i\u00e7in sudo systemctl restart sshd <\/code><\/pre> <h3>3. Fail2Ban Filter Problemleri<\/h3> <pre><code ># Filter'\u0131 test et sudo fail2ban-regex \/var\/log\/auth.log \/etc\/fail2ban\/filter.d\/sshd.conf # Custom filter olu\u015ftur sudo nano \/etc\/fail2ban\/filter.d\/sshd-custom.conf <\/code><\/pre> <pre><code > failregex = ^%(__prefix_line)s(?:error: PAM: )?uthentication (?:failure|error|failed) for .* from &lt;HOST&gt;( via \\S+)?\\s*$ ^%(__prefix_line)s(?:error: )?Received disconnect from &lt;HOST&gt;: 3: .*: Auth fail$ ^%(__prefix_line)sFailed \\S+ for (?P&lt;preuser&gt;\\S+|\\) from &lt;HOST&gt;(?: port \\d+)?(?: ssh\\d*)?(?:: message repeated \\d+ times)?$ <\/code><\/pre> <h2>Best Practices ve \u00d6neriler<\/h2> <h3>1. Katmanl\u0131 G\u00fcvenlik Stratejisi<\/h3> <pre><code ># 1. SSH Key-based Authentication ssh-keygen -t ed25519 -C \"your_email@example.com\" # 2. SSH Port De\u011fi\u015ftirme sudo nano \/etc\/ssh\/sshd_config # Port 2222 # 3. Fail2Ban + PAM Faillock # Her ikisini de kullan\u0131n # 4. VPN kullan\u0131m\u0131 (\u00fcretim ortamlar\u0131 i\u00e7in) # SSH'\u0131 sadece VPN \u00fczerinden eri\u015filebilir yap\u0131n <\/code><\/pre> <h3>2. Monitoring ve Alerting<\/h3> <pre><code ># Nagios\/Zabbix entegrasyonu # SIEM sistemi entegrasyonu # Log aggregation (ELK Stack, Splunk) <\/code><\/pre> <h3>3. D\u00fczenli G\u00fcvenlik Denetimleri<\/h3> <pre><code >#!\/bin\/bash # security_audit.sh echo \"=== SSH G\u00fcvenlik Denetimi ===\" # SSH konfig\u00fcrasyon kontrol\u00fc sshd -T | grep -E \"(MaxAuthTries|LoginGraceTime|PermitRootLogin)\" # Fail2Ban durumu fail2ban-client status # A\u00e7\u0131k portlar ss -tlnp | grep :22 # Son sald\u0131r\u0131lar grep \"Failed password\" \/var\/log\/auth.log | tail -20 <\/code><\/pre> <h2>Sonu\u00e7<\/h2> SSH brute-force sald\u0131r\u0131lar\u0131ndan korunmak i\u00e7in: <ol> <li><strong>Fail2Ban<\/strong>: A\u011f seviyesi koruma, dinamik IP banlama<\/li> <li><strong>PAM Faillock<\/strong>: Sistem seviyesi hesap kilitleme<\/li> <li><strong>SSH Sertle\u015ftirme<\/strong>: Sald\u0131r\u0131 y\u00fczeyini azaltma<\/li> <li><strong>\u0130zleme<\/strong>: S\u00fcrekli g\u00fcvenlik durumu takibi<\/li> <\/ol> <strong>En \u0130yi Yakla\u015f\u0131m<\/strong>: Bu y\u00f6ntemleri kombine ederek \u00e7ok katmanl\u0131 bir g\u00fcvenlik stratejisi olu\u015fturun. Fail2Ban ile a\u011f seviyesinde koruma sa\u011flarken, PAM ile sistem seviyesinde hesap g\u00fcvenli\u011fini art\u0131r\u0131n. <strong>Unutmay\u0131n<\/strong>: G\u00fcvenlik bir hedef de\u011fil, s\u00fcrekli bir s\u00fcre\u00e7tir. D\u00fczenli olarak log'lar\u0131n\u0131z\u0131 inceleyin, sald\u0131r\u0131 trendlerini takip edin ve g\u00fcvenlik stratejinizi g\u00fcncel tutun. Bu yakla\u015f\u0131mlarla SSH sunucunuzu brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 etkili \u015fekilde koruyabilir ve sistem g\u00fcvenli\u011finizi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rabilirsiniz.","excerpt":"SSH servislerin \u00e7al\u0131\u015ft\u0131\u011f\u0131 herhangi bir sunucunun log dosyalar\u0131n\u0131 inceleyecek olursan\u0131z, sistematik giri\u015f denemelerini, bot'lar\u0131n ve...","created_at":"2025-06-12 13:33:27","updated_at":"2026-09-06 02:53:47","category_id":10,"view_count":747,"reading_time":10,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-12 13:33:27","featured_image":"resimyok.jpg","slug":"ssh-brute-force-saldirilarini-ubuntu-ve-red-hatte-otomatik-olarak-nasil-engelleriz","category_name":"nix Linux Unix","category_slug":"nix-linux-unix","category_color":"#2a1952"}]