Sunucu altyap\u0131s\u0131n\u0131n g\u00fcvenli\u011fi, modern bilgi i\u015flem d\u00fcnyas\u0131nda en kritik \u00f6nceliklerden biridir. Siber tehditlerin s\u00fcrekli evrildi\u011fi bir ortamda, sunuculara yetkisiz eri\u015fimi engellemek, veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flamak ve operasyonel s\u00fcreklili\u011fi garantilemek, her kurulu\u015f i\u00e7in hayati \u00f6nem ta\u015f\u0131r. Geleneksel olarak, sunucu yap\u0131land\u0131rmalar\u0131 manuel y\u00f6ntemlerle yap\u0131lmakta, bu da insan hatalar\u0131na, tutars\u0131zl\u0131klara ve g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilmektedir. Bu durum, \u00f6zellikle b\u00fcy\u00fcyen ve karma\u015f\u0131kla\u015fan altyap\u0131larda y\u00f6netimi imkans\u0131z hale getirebilir.<\/p>\n
Bu makalede, sunucu altyap\u0131n\u0131z\u0131 hem yap\u0131land\u0131rma hem de ileti\u015fim d\u00fczeyinde g\u00fcvenli hale getirmek i\u00e7in iki g\u00fc\u00e7l\u00fc a\u00e7\u0131k kaynak arac\u0131n\u0131 \u2013 Ansible ve Tinc VPN\u2019i \u2013 nas\u0131l entegre edebilece\u011fimizi ayr\u0131nt\u0131l\u0131 olarak inceleyece\u011fiz. Ansible, sunucu yap\u0131land\u0131rmas\u0131n\u0131 otomatikle\u015ftiren ve tutarl\u0131 bir \u015fekilde uygulayan bir otomasyon motorudur. Tinc VPN ise, da\u011f\u0131t\u0131k ve e\u015fler aras\u0131 (peer-to-peer) bir VPN \u00e7\u00f6z\u00fcm\u00fc sunarak sunucular aras\u0131 t\u00fcm ileti\u015fimi \u015fifreleyen g\u00fcvenli bir t\u00fcnel olu\u015fturur. Bu iki teknolojinin birle\u015fimi, sunucular\u0131n\u0131z\u0131n sadece do\u011fru \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131n\u0131 de\u011fil, ayn\u0131 zamanda aralar\u0131ndaki t\u00fcm trafi\u011fin de \u015fifreli ve g\u00fcvenli bir a\u011f \u00fczerinden ger\u00e7ekle\u015fmesini sa\u011flar.<\/p>\n
Amac\u0131m\u0131z, bu makalenin sonunda okuyuculara, Ansible kullanarak Tinc VPN a\u011f\u0131n\u0131 nas\u0131l kuracaklar\u0131, y\u00f6netecekleri ve bu g\u00fcvenli a\u011f \u00fczerinden sunucu altyap\u0131lar\u0131n\u0131 nas\u0131l otomatikle\u015ftirecekleri konusunda kapsaml\u0131 bir rehber sunmakt\u0131r. B\u00f6ylece, hem operasyonel verimlilik artacak hem de altyap\u0131n\u0131z\u0131n genel g\u00fcvenlik duru\u015fu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lenecektir.<\/p>\n
Ansible, IT otomasyonu i\u00e7in tasarlanm\u0131\u015f, kullan\u0131m\u0131 kolay ve g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. Sunucu yap\u0131land\u0131rmas\u0131, uygulama da\u011f\u0131t\u0131m\u0131, orkestrasyon ve di\u011fer bir\u00e7ok IT g\u00f6revini otomatikle\u015ftirmek i\u00e7in kullan\u0131l\u0131r. Ansible’\u0131n en belirgin \u00f6zelliklerinden biri, “agent-less” (ajans\u0131z) yap\u0131s\u0131d\u0131r. Bu, y\u00f6netilecek sunucularda \u00f6zel bir yaz\u0131l\u0131m (agent) kurma gereksinimini ortadan kald\u0131r\u0131r. Bunun yerine, standart SSH protokol\u00fc \u00fczerinden sunucularla ileti\u015fim kurar ve Python yorumlay\u0131c\u0131s\u0131n\u0131 kullanarak g\u00f6revleri y\u00fcr\u00fct\u00fcr. Bu \u00f6zellik, kurulumu basitle\u015ftirir ve g\u00fcvenlik risklerini azalt\u0131r.<\/p>\n
Ansible’\u0131n Temel \u00d6zellikleri ve G\u00fcvenlik Faydalar\u0131:<\/strong><\/p>\n * Basitlik ve Okunabilirlik:<\/strong> Ansible, yap\u0131land\u0131rma dosyalar\u0131n\u0131 YAML format\u0131nda yazar. Bu, playbook’lar\u0131n (Ansible g\u00f6revlerini tan\u0131mlayan dosyalar) insan taraf\u0131ndan kolayca okunabilir ve anla\u015f\u0131labilir olmas\u0131n\u0131 sa\u011flar. Karma\u015f\u0131k betik dilleri \u00f6\u011frenme ihtiyac\u0131n\u0131 ortadan kald\u0131r\u0131r. Temel Ansible Kavramlar\u0131:<\/strong><\/p>\n * Inventory:<\/strong> Y\u00f6netilecek sunucular\u0131n listesi ve grupland\u0131r\u0131lmas\u0131. IP adresleri, ana bilgisayar adlar\u0131 ve di\u011fer de\u011fi\u015fkenler burada tan\u0131mlan\u0131r. Tinc VPN, da\u011f\u0131t\u0131k ve e\u015fler aras\u0131 (peer-to-peer) bir VPN \u00e7\u00f6z\u00fcm\u00fcd\u00fcr. Geleneksel merkezi VPN \u00e7\u00f6z\u00fcmlerinin (\u00f6rne\u011fin OpenVPN sunucusu) aksine, Tinc merkezi bir sunucuya ba\u011f\u0131ml\u0131 de\u011fildir. Her Tinc d\u00fc\u011f\u00fcm\u00fc (node) birbiriyle do\u011frudan ba\u011flant\u0131 kurabilir ve bu da onu y\u00fcksek oranda esnek ve hataya dayan\u0131kl\u0131 hale getirir.<\/p>\n Tinc’in Temel \u00d6zellikleri ve G\u00fcvenlik Avantajlar\u0131:<\/strong><\/p>\n * Mesh Network Yap\u0131s\u0131:<\/strong> Tinc, bir mesh (a\u011f) topolojisi olu\u015fturur. Bu, a\u011fdaki her d\u00fc\u011f\u00fcm\u00fcn di\u011fer herhangi bir d\u00fc\u011f\u00fcmle do\u011frudan ileti\u015fim kurabilece\u011fi anlam\u0131na gelir. Veri, bir d\u00fc\u011f\u00fcmden di\u011ferine en k\u0131sa ve en uygun yol \u00fczerinden y\u00f6nlendirilir. Bu yap\u0131, merkezi bir sunucunun ar\u0131zalanmas\u0131 durumunda t\u00fcm a\u011f\u0131n \u00e7\u00f6kmesini engeller (tek hata noktas\u0131 olmamas\u0131). Di\u011fer VPN \u00c7\u00f6z\u00fcmlerine G\u00f6re Avantajlar\u0131:<\/strong><\/p>\n * OpenVPN:<\/strong> Genellikle istemci-sunucu mimarisine dayan\u0131r ve merkezi bir sunucu tek hata noktas\u0131 olabilir. Tinc’in mesh yap\u0131s\u0131, da\u011f\u0131t\u0131k altyap\u0131lar i\u00e7in daha uygun olabilir. \u00d6zetle, Tinc VPN, sunucular\u0131n\u0131z aras\u0131nda g\u00fcvenli, \u015fifreli ve merkezi olmayan bir ileti\u015fim kanal\u0131 olu\u015fturmak i\u00e7in m\u00fckemmel bir se\u00e7imdir. Ansible ile birlikte kullan\u0131ld\u0131\u011f\u0131nda, bu g\u00fcvenli a\u011f\u0131 kurma ve y\u00f6netme s\u00fcreci son derece verimli hale gelir.<\/p>\n Ansible ve Tinc VPN’i bir araya getirmenin temel amac\u0131, t\u00fcm sunucular\u0131n\u0131z\u0131n g\u00fcvenli bir Tinc a\u011f\u0131 \u00fczerinden ileti\u015fim kurmas\u0131n\u0131 sa\u011flamak ve Ansible’\u0131n bu g\u00fcvenli a\u011f \u00fczerinden sunucular\u0131 y\u00f6netmesidir. Bu yakla\u015f\u0131m, hem sunucular aras\u0131 ileti\u015fimi \u015fifreleyerek g\u00fcvenli\u011fi art\u0131r\u0131r hem de Ansible’\u0131n y\u00f6netim trafi\u011finin de bu \u015fifreli t\u00fcnel \u00fczerinden ge\u00e7mesini sa\u011flayarak ek bir g\u00fcvenlik katman\u0131 ekler.<\/p>\n Hedef Mimari:<\/strong><\/p>\n T\u00fcm y\u00f6netilen sunucular\u0131n\u0131z, birbirleriyle e\u015fler aras\u0131 ba\u011flant\u0131 kurabilen bir Tinc VPN a\u011f\u0131na dahil olacak. Ansible kontrol makinesi (Ansible’\u0131 \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131z makine) de bu Tinc a\u011f\u0131na dahil olacak veya bu a\u011fa eri\u015febilen bir konumda bulunacak. B\u00f6ylece, Ansible, ba\u015flang\u0131\u00e7ta genel IP adresleri \u00fczerinden sunuculara SSH ile eri\u015fip Tinc’i kurduktan sonra, t\u00fcm sonraki y\u00f6netim i\u015flemlerini Tinc taraf\u0131ndan atanan \u00f6zel IP adresleri \u00fczerinden ger\u00e7ekle\u015ftirecek.<\/p>\n Entegrasyon Ad\u0131mlar\u0131 ve Yakla\u015f\u0131m:<\/strong><\/p>\n 1. Tinc Kurulumu ve Temel Yap\u0131land\u0131rma (Ansible ile):<\/strong> Ansible, t\u00fcm hedef sunucularda Tinc paketini kuracak ve her sunucu i\u00e7in temel Tinc yap\u0131land\u0131rma dosyalar\u0131n\u0131 (tinc.conf) olu\u015fturacak. Mimari A\u00e7\u0131klamas\u0131:<\/strong><\/p>\n Hayal edin ki \u00fc\u00e7 sunucunuz var: * Ba\u015flang\u0131\u00e7 Durumu:<\/strong> Bu entegrasyon, altyap\u0131n\u0131z\u0131n hem y\u00f6netim katman\u0131nda hem de ileti\u015fim katman\u0131nda g\u00fc\u00e7l\u00fc bir g\u00fcvenlik sa\u011flamas\u0131na olanak tan\u0131r.<\/p>\n Bu b\u00f6l\u00fcmde, Ansible ve Tinc VPN entegrasyonunu ad\u0131m ad\u0131m nas\u0131l ger\u00e7ekle\u015ftirece\u011finizi pratik bir \u015fekilde a\u00e7\u0131klayaca\u011f\u0131z.<\/p>\n 1. Ansible Kontrol Makinesi:<\/strong> Ansible projelerinizi d\u00fczenli tutmak i\u00e7in belirli bir dizin yap\u0131s\u0131 kullanmak en iyi uygulamad\u0131r.<\/p>\n Ba\u015flang\u0131\u00e7ta, Ansible’\u0131n sunuculara eri\u015febilmesi i\u00e7in genel IP adreslerini kullanaca\u011f\u0131z. Tinc kurulduktan sonra bu inventory’yi Tinc IP’leri ile g\u00fcncelleyece\u011fiz.<\/p>\n Yukar\u0131daki Bu rol, Tinc paketini kuracak, yap\u0131land\u0131rma dosyalar\u0131n\u0131 olu\u015fturacak ve Tinc servisini y\u00f6netecek.<\/p>\n Her sunucunun kendi genel anahtar\u0131n\u0131 di\u011fer sunucularla payla\u015fmas\u0131 ve di\u011ferlerinin genel anahtarlar\u0131n\u0131 almas\u0131 gerekir. Bu dinamik bir s\u00fcre\u00e7tir. Ansible, bu s\u00fcreci otomatikle\u015ftirebilir.<\/p>\n Bu ad\u0131m\u0131 ger\u00e7ekle\u015ftirmek i\u00e7in, her sunucunun kendi Bu de\u011fi\u015fkenleri kullanmak i\u00e7in, T\u00fcm Host Anahtarlar\u0131n\u0131 Toplama ve Da\u011f\u0131tma:<\/strong><\/p>\n Bu, biraz daha karma\u015f\u0131k bir ad\u0131md\u0131r ve genellikle iki a\u015famal\u0131 bir playbook gerektirir: Bu dinamik da\u011f\u0131t\u0131m i\u00e7in, Bu g\u00f6revler, Ansible’\u0131n her sunucunun genel anahtar\u0131n\u0131 toplay\u0131p, di\u011fer sunucular\u0131n genel anahtarlar\u0131n\u0131 i\u00e7eren host dosyalar\u0131n\u0131 olu\u015fturmas\u0131n\u0131 sa\u011flar. Tinc a\u011f\u0131 kurulduktan sonra, sunucular\u0131n\u0131zdaki SSH (ve di\u011fer y\u00f6netim servisleri) eri\u015fimini sadece Tinc a\u011f\u0131 \u00fczerinden gelmesine izin verecek \u015fekilde s\u0131k\u0131la\u015ft\u0131rmak \u00f6nemlidir.<\/p>\n Bu kurallar, SSH ba\u011flant\u0131lar\u0131n\u0131n sadece Tinc a\u011f\u0131 (\u00f6rne\u011fin 10.0.0.0\/24) i\u00e7inden gelmesine izin verir. Di\u011fer t\u00fcm genel IP’lerden gelen SSH ba\u011flant\u0131lar\u0131 engellenecektir. Bu, sunucular\u0131n\u0131z\u0131n d\u0131\u015far\u0131dan gelen do\u011frudan sald\u0131r\u0131lara kar\u015f\u0131 daha diren\u00e7li olmas\u0131n\u0131 sa\u011flar.<\/p>\n \u015eimdi, t\u00fcm bu rol\u00fc \u00e7al\u0131\u015ft\u0131racak ana playbook’u olu\u015ftural\u0131m.<\/p>\n \u0130lk playbook’u \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra ( Art\u0131k, Ansible’\u0131 \u00e7al\u0131\u015ft\u0131r\u0131rken bu yeni inventory dosyas\u0131n\u0131 kullanabilirsiniz:<\/p>\n Bu, Ansible’\u0131n t\u00fcm ileti\u015fimini Tinc VPN t\u00fcneli \u00fczerinden \u015fifreli olarak yapmas\u0131n\u0131 sa\u011flar.<\/p>\n \u00d6nemli Not:<\/strong> Ansible ve Tinc VPN kullanarak sunucu altyap\u0131n\u0131z\u0131 g\u00fcvence alt\u0131na al\u0131rken, genel g\u00fcvenlik prensiplerini ve en iyi uygulamalar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurmak hayati \u00f6nem ta\u015f\u0131r.<\/p>\n * Ansible Vault Kullan\u0131m\u0131:<\/strong> Hassas verileri (veritaban\u0131 \u015fifreleri, API anahtarlar\u0131, SSH \u00f6zel anahtarlar\u0131 vb.) asla a\u00e7\u0131k metin olarak depolamay\u0131n. Ansible Vault kullanarak bu verileri \u015fifreleyin. Vault parolalar\u0131n\u0131z\u0131 g\u00fcvenli bir \u015fekilde y\u00f6netin (\u00f6rne\u011fin, bir parola y\u00f6neticisi veya donan\u0131m g\u00fcvenlik mod\u00fcl\u00fc ile). * Sa\u011flam Anahtar Y\u00f6netimi:<\/strong> Tinc, RSA anahtarlar\u0131n\u0131 kullan\u0131r. Bu anahtarlar\u0131n g\u00fcvenli\u011fi, VPN a\u011f\u0131n\u0131z\u0131n g\u00fcvenli\u011fi i\u00e7in temeldir. * D\u00fczenli G\u00fcncellemeler:<\/strong> T\u00fcm i\u015fletim sistemlerini ve y\u00fckl\u00fc yaz\u0131l\u0131mlar\u0131 (Tinc ve Ansible dahil) d\u00fczenli olarak g\u00fcncelleyin. G\u00fcvenlik yamalar\u0131, bilinen zafiyetleri kapatmak i\u00e7in kritik \u00f6neme sahiptir. Bu en iyi uygulamalar\u0131 takip ederek, Ansible ve Tinc VPN’in sundu\u011fu g\u00fc\u00e7l\u00fc otomasyon ve g\u00fcvenlik \u00f6zelliklerinden tam olarak faydalanabilir ve sunucu altyap\u0131n\u0131z\u0131n genel g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirebilirsiniz.<\/p>\n Sunucu altyap\u0131lar\u0131n\u0131n g\u00fcvenli\u011fi, g\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda vazge\u00e7ilmez bir unsurdur. Geleneksel manuel yap\u0131land\u0131rma y\u00f6ntemleri, artan karma\u015f\u0131kl\u0131k ve siber tehditlerin evrimi kar\u015f\u0131s\u0131nda yetersiz kalmaktad\u0131r. Bu makalede ele ald\u0131\u011f\u0131m\u0131z Ansible ve Tinc VPN entegrasyonu, bu zorluklara kar\u015f\u0131 g\u00fc\u00e7l\u00fc ve esnek bir \u00e7\u00f6z\u00fcm sunmaktad\u0131r.<\/p>\n Ansible, agent-less yap\u0131s\u0131, idempotency \u00f6zelli\u011fi ve YAML tabanl\u0131 basitli\u011fi sayesinde sunucu yap\u0131land\u0131rmalar\u0131n\u0131 otomatikle\u015ftirmede, tutarl\u0131l\u0131k sa\u011flamada ve g\u00fcvenlik yamalar\u0131n\u0131 h\u0131zla da\u011f\u0131tmada benzersiz avantajlar sunar. Ansible Vault ile hassas verilerin g\u00fcvenli bir \u015fekilde y\u00f6netilmesi, otomasyon s\u00fcre\u00e7lerinin g\u00fcvenlik duru\u015funu daha da g\u00fc\u00e7lendirir.<\/p>\n Tinc VPN ise, merkezi olmayan, e\u015fler aras\u0131 (mesh) a\u011f yap\u0131s\u0131yla sunucular aras\u0131 ileti\u015fimi \u015fifreleyerek g\u00fcvenli bir t\u00fcnel olu\u015fturur. Tek hata noktas\u0131 olmamas\u0131, kolay yap\u0131land\u0131rma ve otomatik anahtar de\u011fi\u015fimi gibi \u00f6zellikler, Tinc’i da\u011f\u0131t\u0131k altyap\u0131lar i\u00e7in ideal bir VPN \u00e7\u00f6z\u00fcm\u00fc haline getirir. Tinc, sunucular\u0131n\u0131z\u0131n genel internet \u00fczerinden de\u011fil, kendi \u00f6zel ve \u015fifreli a\u011flar\u0131 \u00fczerinden ileti\u015fim kurmas\u0131n\u0131 sa\u011flayarak d\u0131\u015far\u0131dan gelen sald\u0131r\u0131lara kar\u015f\u0131 \u00f6nemli bir bariyer olu\u015fturur.<\/p>\n Bu iki teknolojinin birle\u015fimi, bir sinerji yaratarak altyap\u0131 g\u00fcvenli\u011finizi \u00e7ift katmanl\u0131 bir yakla\u015f\u0131mla art\u0131r\u0131r:<\/p>\n 1. Yap\u0131land\u0131rma G\u00fcvenli\u011fi:<\/strong> Ansible, t\u00fcm sunucular\u0131n g\u00fcvenlik politikalar\u0131n\u0131, servisleri ve paketleri tutarl\u0131 bir \u015fekilde yap\u0131land\u0131rmas\u0131n\u0131 sa\u011flar, b\u00f6ylece yap\u0131land\u0131rma sapmalar\u0131ndan kaynaklanan zafiyetleri ortadan kald\u0131r\u0131r. Pratik uygulama b\u00f6l\u00fcm\u00fcnde ad\u0131m ad\u0131m g\u00f6sterildi\u011fi gibi, Ansible rolleri ve playbook’lar\u0131 kullanarak Tinc VPN a\u011f\u0131n\u0131 kurmak, anahtarlar\u0131 y\u00f6netmek, g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 yap\u0131land\u0131rmak ve son olarak Ansible’\u0131 bu g\u00fcvenli a\u011f \u00fczerinden \u00e7al\u0131\u015ft\u0131rmak m\u00fcmk\u00fcnd\u00fcr. Bu s\u00fcre\u00e7, manuel m\u00fcdahaleyi minimuma indirerek insan hatalar\u0131n\u0131 azalt\u0131r ve da\u011f\u0131t\u0131m h\u0131z\u0131n\u0131 art\u0131r\u0131r.<\/p>\n Gelecek Perspektifleri ve Di\u011fer G\u00fcvenlik Katmanlar\u0131:<\/strong><\/p>\n Bu \u00e7\u00f6z\u00fcm, altyap\u0131n\u0131z\u0131n temel g\u00fcvenlik katmanlar\u0131ndan birini olu\u015fturur. Ancak, tam te\u015fekk\u00fcll\u00fc bir g\u00fcvenlik stratejisi i\u00e7in ek katmanlar da d\u00fc\u015f\u00fcn\u00fclmelidir:<\/p>\n * \u0130zleme ve Log Y\u00f6netimi:<\/strong> Sunucular\u0131n\u0131z\u0131n ve Tinc a\u011f\u0131n\u0131n s\u00fcrekli olarak izlenmesi, anormal aktivitelerin erken tespiti i\u00e7in kritik \u00f6neme sahiptir. Merkezi loglama sistemleri bu konuda b\u00fcy\u00fck fayda sa\u011flar. Sonu\u00e7 olarak, Ansible ve Tinc VPN entegrasyonu, modern, da\u011f\u0131t\u0131k sunucu altyap\u0131lar\u0131n\u0131 y\u00f6netmek ve g\u00fcvence alt\u0131na almak isteyen kurulu\u015flar i\u00e7in g\u00fc\u00e7l\u00fc, \u00f6l\u00e7eklenebilir ve uygun maliyetli bir \u00e7\u00f6z\u00fcmd\u00fcr. Bu yakla\u015f\u0131m, hem operasyonel verimlili\u011fi art\u0131r\u0131r hem de siber g\u00fcvenlik tehditlerine kar\u015f\u0131 daha diren\u00e7li bir altyap\u0131 olu\u015fturulmas\u0131na yard\u0131mc\u0131 olur. Bu makaledeki bilgileri kullanarak, kendi g\u00fcvenli sunucu altyap\u0131n\u0131z\u0131 in\u015fa etme yolunda \u00f6nemli bir ad\u0131m atm\u0131\u015f olacaks\u0131n\u0131z.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Ansible ve Tinc VPN ile Sunucu Altyap\u0131n\u0131z\u0131 G\u00fcvenli Hale Getirme\nSunucu altyap\u0131s\u0131n\u0131n g\u00fcvenli\u011fi, modern bilgi i\u015flem d\u00fcnyas\u0131nda en kritik \u00f6","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-31146","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
\n* Idempotency (Tekrarlanabilirlik):<\/strong> Ansible playbook’lar\u0131 idempotent’tir. Bu, bir playbook’u birden \u00e7ok kez \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, sistemin her zaman ayn\u0131 nihai duruma gelmesini sa\u011flar. E\u011fer bir g\u00f6rev zaten tamamlanm\u0131\u015fsa, Ansible o g\u00f6revi tekrar \u00e7al\u0131\u015ft\u0131rmaz. Bu \u00f6zellik, yap\u0131land\u0131rma tutarl\u0131l\u0131\u011f\u0131n\u0131 garanti eder ve istenmeyen de\u011fi\u015fiklikleri \u00f6nler. G\u00fcvenlik a\u00e7\u0131s\u0131ndan, bu, bir sunucunun her zaman beklenen g\u00fcvenlik yap\u0131land\u0131rmas\u0131na sahip olmas\u0131n\u0131 sa\u011flar.
\n* Mod\u00fcler Yap\u0131 ve Geni\u015f Ekosistem:<\/strong> Ansible, binlerce mod\u00fcl ve eklentiye sahiptir. Bu mod\u00fcller, \u00e7e\u015fitli i\u015fletim sistemleri, a\u011f cihazlar\u0131, bulut platformlar\u0131 ve uygulamalarla etkile\u015fim kurmak i\u00e7in kullan\u0131labilir. Bu geni\u015f ekosistem, hemen hemen her t\u00fcrl\u00fc IT otomasyon ihtiyac\u0131n\u0131 kar\u015f\u0131layabilir.
\n* G\u00fcvenlik A\u00e7\u0131s\u0131ndan Faydalar\u0131:<\/strong>
\n * Tutarl\u0131 Yap\u0131land\u0131rma:<\/strong> T\u00fcm sunucularda ayn\u0131 g\u00fcvenlik politikalar\u0131n\u0131n, kullan\u0131c\u0131lar\u0131n, paketlerin ve servislerin tutarl\u0131 bir \u015fekilde da\u011f\u0131t\u0131lmas\u0131n\u0131 sa\u011flar. Bu, yap\u0131land\u0131rma sapmalar\u0131ndan kaynaklanan g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 minimize eder.
\n * H\u0131zl\u0131 Yama Y\u00f6netimi:<\/strong> G\u00fcvenlik yamalar\u0131n\u0131n ve g\u00fcncellemelerinin t\u00fcm altyap\u0131ya h\u0131zl\u0131 ve g\u00fcvenilir bir \u015fekilde da\u011f\u0131t\u0131lmas\u0131n\u0131 otomatikle\u015ftirebilir. Bu, kritik g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131n kapat\u0131lma s\u00fcresini k\u0131salt\u0131r.
\n * Denetlenebilirlik:<\/strong> Her Ansible \u00e7al\u0131\u015ft\u0131rmas\u0131, hangi de\u011fi\u015fikliklerin ne zaman ve kim taraf\u0131ndan yap\u0131ld\u0131\u011f\u0131n\u0131n kayd\u0131n\u0131 tutar. Bu, g\u00fcvenlik denetimleri ve uyumluluk gereksinimleri i\u00e7in de\u011ferli bir kaynak sa\u011flar.
\n * Hassas Veri Y\u00f6netimi (Ansible Vault):<\/strong> Ansible Vault, \u015fifreler, API anahtarlar\u0131, SSH anahtarlar\u0131 gibi hassas verileri \u015fifreleyerek playbook’lar i\u00e7inde g\u00fcvenli bir \u015fekilde saklaman\u0131z\u0131 sa\u011flar. Bu, bu t\u00fcr bilgilerin a\u00e7\u0131k metin olarak depolanmas\u0131n\u0131 \u00f6nler.<\/p>\n
\n* Playbook:<\/strong> Ansible’\u0131n ger\u00e7ekle\u015ftirece\u011fi g\u00f6revleri (tasks) ve rolleri (roles) tan\u0131mlayan YAML dosyalar\u0131d\u0131r.
\n* Task:<\/strong> Bir playbook i\u00e7indeki tek bir eylemdir (\u00f6rne\u011fin, bir paket kurma, bir servis ba\u015flatma, bir dosya kopyalama).
\n* Role:<\/strong> \u0130lgili g\u00f6revleri, \u015fablonlar\u0131, de\u011fi\u015fkenleri ve i\u015fleyicileri bir araya getiren organize bir yap\u0131land\u0131rma birimidir. Karma\u015f\u0131k projeleri y\u00f6netmeyi kolayla\u015ft\u0131r\u0131r.
\n* Variable:<\/strong> Playbook’larda dinamik de\u011ferler kullanmak i\u00e7in tan\u0131mlanan anahtar-de\u011fer \u00e7iftleridir.
\n* Vault:<\/strong> Hassas verileri \u015fifrelemek ve g\u00fcvenli bir \u015fekilde saklamak i\u00e7in kullan\u0131lan bir Ansible \u00f6zelli\u011fidir.<\/p>\nNeden Tinc VPN?<\/h3>\n
\n* Da\u011f\u0131t\u0131k ve Merkezi Olmayan Yap\u0131:<\/strong> Merkezi bir sunucuya ihtiya\u00e7 duymamas\u0131, Tinc’i olduk\u00e7a dayan\u0131kl\u0131 k\u0131lar. Bir d\u00fc\u011f\u00fcm \u00e7evrimd\u0131\u015f\u0131 olsa bile, di\u011fer d\u00fc\u011f\u00fcmler aras\u0131ndaki ileti\u015fim devam eder. Bu, y\u00fcksek eri\u015filebilirlik gerektiren altyap\u0131lar i\u00e7in idealdir.
\n* Kolay Yap\u0131land\u0131rma ve Otomatik Anahtar De\u011fi\u015fimi:<\/strong> Tinc, OpenSSL kullanarak g\u00fc\u00e7l\u00fc \u015fifreleme sa\u011flar ve anahtar de\u011fi\u015fimini otomatik olarak y\u00f6netir. Her d\u00fc\u011f\u00fcm kendi RSA anahtar \u00e7iftini olu\u015fturur ve di\u011fer d\u00fc\u011f\u00fcmlerin genel anahtarlar\u0131n\u0131 toplar. Bu, kurulumu basitle\u015ftirir ve manuel anahtar y\u00f6netiminin getirdi\u011fi hatalar\u0131 azalt\u0131r.
\n* G\u00fcvenlik Avantajlar\u0131:<\/strong>
\n * \u015eifreli \u0130leti\u015fim:<\/strong> T\u00fcm Tinc a\u011f\u0131 i\u00e7indeki trafik, g\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131 kullan\u0131larak \u015fifrelenir. Bu, yetkisiz dinlemeyi (eavesdropping) \u00f6nler ve veri gizlili\u011fini sa\u011flar.
\n * Eri\u015fim Kontrol\u00fc:<\/strong> Tinc, her d\u00fc\u011f\u00fcm\u00fcn kendi IP adresine sahip oldu\u011fu \u00f6zel bir sanal a\u011f olu\u015fturur. G\u00fcvenlik duvar\u0131 kurallar\u0131 (iptables\/nftables) ile bu sanal a\u011fdaki trafi\u011fi kontrol edebilir, b\u00f6ylece yaln\u0131zca g\u00fcvenilir d\u00fc\u011f\u00fcmlerin belirli servislere eri\u015fmesine izin verebilirsiniz.
\n * Esneklik:<\/strong> Yeni sunucular\u0131 a\u011fa eklemek veya mevcut sunucular\u0131 \u00e7\u0131karmak olduk\u00e7a kolayd\u0131r. Sadece ilgili d\u00fc\u011f\u00fcm\u00fcn yap\u0131land\u0131rmas\u0131n\u0131 g\u00fcncelleyip anahtarlar\u0131n\u0131 di\u011fer d\u00fc\u011f\u00fcmlerle payla\u015fmak yeterlidir.
\n * NAT Traversal:<\/strong> Tinc, NAT (Network Address Translation) arkas\u0131ndaki d\u00fc\u011f\u00fcmlerin bile birbirleriyle do\u011frudan ba\u011flant\u0131 kurmas\u0131n\u0131 sa\u011flayabilir. Bu, farkl\u0131 a\u011flardaki sunucular\u0131 tek bir g\u00fcvenli VPN a\u011f\u0131na dahil etmeyi kolayla\u015ft\u0131r\u0131r.<\/p>\n
\n* WireGuard:<\/strong> Daha yeni ve daha h\u0131zl\u0131 bir VPN \u00e7\u00f6z\u00fcm\u00fc olmakla birlikte, WireGuard’\u0131n varsay\u0131lan yap\u0131land\u0131rmas\u0131 genellikle manuel anahtar de\u011fi\u015fimi gerektirir ve mesh yap\u0131s\u0131 i\u00e7in ek ara\u00e7lar veya karma\u015f\u0131k yap\u0131land\u0131rmalar gerekebilir. Tinc, mesh yap\u0131s\u0131n\u0131 ve anahtar y\u00f6netimini do\u011fal olarak sunar.<\/p>\nAnsible ve Tinc VPN Entegrasyonu: Mimari ve Yakla\u015f\u0131m<\/h3>\n
\n2. Tinc Anahtar Y\u00f6netimi (Ansible Vault ile G\u00fcvenli):<\/strong> Her Tinc d\u00fc\u011f\u00fcm\u00fc i\u00e7in gerekli olan RSA anahtar \u00e7iftleri (public\/private) olu\u015fturulacak. Bu anahtarlar, \u00f6zellikle \u00f6zel anahtarlar, Ansible Vault kullan\u0131larak g\u00fcvenli bir \u015fekilde saklanacak ve yaln\u0131zca ilgili sunucuya da\u011f\u0131t\u0131lacak. Her d\u00fc\u011f\u00fcm\u00fcn genel anahtar\u0131, di\u011fer t\u00fcm d\u00fc\u011f\u00fcmlerle payla\u015f\u0131lacak.
\n3. Ansible Inventory’sinin G\u00fcncellenmesi:<\/strong> Tinc a\u011f\u0131 kurulduktan ve her sunucuya bir Tinc IP adresi atand\u0131ktan sonra, Ansible’\u0131n inventory dosyas\u0131, sunucular\u0131n genel IP adresleri yerine Tinc IP adreslerini kullanacak \u015fekilde g\u00fcncellenecek. Bu, Ansible’\u0131n Tinc t\u00fcneli \u00fczerinden ileti\u015fim kurmas\u0131n\u0131 sa\u011flayacak.
\n4. G\u00fcvenlik Duvar\u0131 Kurallar\u0131:<\/strong> Her sunucudaki g\u00fcvenlik duvar\u0131 (UFW, Firewalld veya iptables) Tinc’in kulland\u0131\u011f\u0131 UDP portuna (genellikle 655) izin verecek \u015fekilde yap\u0131land\u0131r\u0131lacak. Ayr\u0131ca, Tinc a\u011f\u0131 kurulduktan sonra, SSH eri\u015fimi gibi y\u00f6netim portlar\u0131n\u0131n sadece Tinc a\u011f\u0131 i\u00e7indeki IP adreslerinden gelmesine izin verecek \u015fekilde s\u0131k\u0131la\u015ft\u0131r\u0131lmas\u0131 \u00f6nemli bir g\u00fcvenlik ad\u0131m\u0131d\u0131r.<\/p>\nserver1<\/code>, server2<\/code>, server3<\/code> ve bir de ansible_control<\/code> makineniz.<\/p>\nansible_control<\/code> makinesi, server1<\/code>, server2<\/code>, server3<\/code>‘e genel IP adresleri \u00fczerinden SSH ile eri\u015febilir.
\n* Ad\u0131m 1 (Ansible ile Tinc Kurulumu):<\/strong> ansible_control<\/code> makinesi, bir Ansible playbook’u \u00e7al\u0131\u015ft\u0131rarak t\u00fcm sunuculara Tinc’i kurar, her sunucu i\u00e7in benzersiz bir Tinc a\u011f ad\u0131 ve anahtar \u00e7ifti olu\u015fturur. Bu anahtarlar g\u00fcvenli bir \u015fekilde da\u011f\u0131t\u0131l\u0131r.
\n* Ad\u0131m 2 (Tinc A\u011f\u0131n\u0131n Olu\u015fturulmas\u0131):<\/strong> Her sunucu, kendi tinc.conf<\/code> dosyas\u0131n\u0131 ve di\u011fer t\u00fcm sunucular\u0131n genel anahtarlar\u0131n\u0131 i\u00e7eren hosts<\/code> dizinini yap\u0131land\u0131r\u0131r. Tinc servisi ba\u015flat\u0131ld\u0131\u011f\u0131nda, sunucular birbirleriyle ba\u011flant\u0131 kurmaya \u00e7al\u0131\u015f\u0131r ve \u015fifreli bir mesh VPN a\u011f\u0131 olu\u015fturur. Her sunucuya \u00f6zel bir Tinc IP adresi atan\u0131r (\u00f6rne\u011fin, server1<\/code> -> 10.0.0.1, server2<\/code> -> 10.0.0.2, server3<\/code> -> 10.0.0.3). ansible_control<\/code> makinesi de bu a\u011f\u0131n bir par\u00e7as\u0131 olur (\u00f6rne\u011fin, 10.0.0.4).
\n* Ad\u0131m 3 (Ansible Inventory G\u00fcncellemesi):<\/strong> Ansible’\u0131n inventory.ini<\/code> dosyas\u0131, sunucular\u0131n IP adreslerini genel IP’lerden Tinc IP’lerine (10.0.0.1<\/code>, 10.0.0.2<\/code>, 10.0.0.3<\/code>) d\u00f6n\u00fc\u015ft\u00fcr\u00fcl\u00fcr.
\n* Ad\u0131m 4 (G\u00fcvenlik Duvar\u0131 S\u0131k\u0131la\u015ft\u0131rmas\u0131):<\/strong> Sunuculardaki g\u00fcvenlik duvarlar\u0131, SSH (port 22) gibi kritik portlara sadece 10.0.0.0\/24 a\u011f\u0131 i\u00e7inden eri\u015fime izin verecek \u015fekilde ayarlan\u0131r. Tinc’in kulland\u0131\u011f\u0131 port (varsay\u0131lan olarak 655 UDP) d\u0131\u015far\u0131dan eri\u015fime a\u00e7\u0131k kal\u0131r.
\n* Son Durum:<\/strong> Art\u0131k ansible_control<\/code> makinesi, server1<\/code>, server2<\/code>, server3<\/code> ile 10.0.0.x IP adresleri \u00fczerinden ve \u015fifreli Tinc t\u00fcneli arac\u0131l\u0131\u011f\u0131yla ileti\u015fim kurar. T\u00fcm y\u00f6netim trafi\u011fi g\u00fcvenli bir \u015fekilde ger\u00e7ekle\u015fir.<\/p>\nPratik Uygulama: Ad\u0131m Ad\u0131m Kurulum ve Yap\u0131land\u0131rma<\/h3>\n
\u00d6n Gereksinimler<\/h4>\n
\n * Linux veya macOS i\u015fletim sistemi.
\n * Python 3 ve pip y\u00fckl\u00fc.
\n * Ansible y\u00fckl\u00fc (pip install ansible<\/code>).
\n * Y\u00f6netilecek sunuculara SSH anahtar tabanl\u0131 eri\u015fim yetene\u011fi.
\n2. Y\u00f6netilecek Sunucular:<\/strong>
\n * Linux i\u015fletim sistemi (Ubuntu, CentOS, Debian vb.).
\n * SSH eri\u015fimi a\u00e7\u0131k ve kontrol makinesinin SSH genel anahtar\u0131 yetkilendirilmi\u015f olmal\u0131.
\n * Sudo yetkisi olan bir kullan\u0131c\u0131.
\n * Temel a\u011f bilgisi ve g\u00fcvenlik duvar\u0131 (UFW\/Firewalld) y\u00f6netimi hakk\u0131nda bilgi.<\/p>\nAd\u0131m 1: Ansible Proje Yap\u0131s\u0131n\u0131n Olu\u015fturulmas\u0131<\/h4>\n
mkdir ansible-tinc-vpn\ncd ansible-tinc-vpn\nmkdir group_vars host_vars roles playbooks\nmkdir roles\/tinc_vpn\/{tasks,templates,handlers,vars,meta}\ntouch inventory.ini\ntouch playbooks\/deploy_tinc.yml<\/code><\/pre>\nAd\u0131m 2: Ansible Inventory Dosyas\u0131 (
inventory.ini<\/code>)<\/h4>\n# inventory.ini\n[servers]\nserver1 ansible_host=YOUR_SERVER1_PUBLIC_IP\nserver2 ansible_host=YOUR_SERVER2_PUBLIC_IP\nserver3 ansible_host=YOUR_SERVER3_PUBLIC_IP\n\n[ansible_control]\nansible_control_node ansible_host=YOUR_ANSIBLE_CONTROL_PUBLIC_IP\n\n[all:vars]\nansible_user=your_ssh_username # Sunucularda sudo yetkisi olan kullan\u0131c\u0131n\u0131z\nansible_python_interpreter=\/usr\/bin\/python3<\/code><\/pre>\nYOUR_SERVERX_PUBLIC_IP<\/code> ve YOUR_ANSIBLE_CONTROL_PUBLIC_IP<\/code> k\u0131s\u0131mlar\u0131n\u0131 kendi sunucular\u0131n\u0131z\u0131n genel IP adresleriyle, your_ssh_username<\/code> k\u0131sm\u0131n\u0131 ise sunuculara SSH ile ba\u011fland\u0131\u011f\u0131n\u0131z kullan\u0131c\u0131 ad\u0131yla de\u011fi\u015ftirin.<\/p>\nAd\u0131m 3: Tinc Kurulumu i\u00e7in Ansible Rol\u00fc (
roles\/tinc_vpn<\/code>)<\/h4>\nroles\/tinc_vpn\/vars\/main.yml<\/code>:<\/strong><\/p>\n# roles\/tinc_vpn\/vars\/main.yml\ntinc_network_name: myvpn\ntinc_port: 655\ntinc_subnet: 10.0.0.0\/24\ntinc_base_ip: 10.0.0<\/code><\/pre>\nroles\/tinc_vpn\/tasks\/main.yml<\/code>:<\/strong><\/p>\n# roles\/tinc_vpn\/tasks\/main.yml\n- name: Tinc paketini kur\n become: yes\n package:\n name: tinc\n state: present\n\n- name: Tinc a\u011f dizinini olu\u015ftur\n become: yes\n file:\n path: \"\/etc\/tinc\/{{ tinc_network_name }}\"\n state: directory\n mode: '0700'\n\n- name: Tinc host dizinini olu\u015ftur\n become: yes\n file:\n path: \"\/etc\/tinc\/{{ tinc_network_name }}\/hosts\"\n state: directory\n mode: '0700'\n\n- name: Tinc yap\u0131land\u0131rma dosyas\u0131n\u0131 olu\u015ftur (tinc.conf)\n become: yes\n template:\n src: tinc.conf.j2\n dest: \"\/etc\/tinc\/{{ tinc_network_name }}\/tinc.conf\"\n mode: '0600'\n notify: Restart tinc\n\n- name: Tinc anahtar \u00e7iftini olu\u015ftur (e\u011fer yoksa)\n become: yes\n command: tinc -n {{ tinc_network_name }} generate-keys\n args:\n creates: \"\/etc\/tinc\/{{ tinc_network_name }}\/rsa_key.priv\"\n\n- name: Tinc genel anahtar\u0131n\u0131 oku\n become: yes\n slurp:\n src: \"\/etc\/tinc\/{{ tinc_network_name }}\/rsa_key.pub\"\n register: tinc_public_key_content\n\n- name: Tinc host dosyas\u0131n\u0131 olu\u015ftur ve genel anahtar\u0131 ekle\n become: yes\n template:\n src: host_config.j2\n dest: \"\/etc\/tinc\/{{ tinc_network_name }}\/hosts\/{{ inventory_hostname }}\"\n mode: '0600'\n vars:\n tinc_node_public_key: \"{{ tinc_public_key_content['content'] | b64decode }}\"\n notify: Restart tinc\n\n- name: Tinc post-up ve pre-down scriptlerini olu\u015ftur\n become: yes\n template:\n src: \"{{ item }}.j2\"\n dest: \"\/etc\/tinc\/{{ tinc_network_name }}\/{{ item }}\"\n mode: '0755'\n loop:\n - tinc-up\n - tinc-down\n notify: Restart tinc\n\n- name: Tinc servisini ba\u015flat ve etkinle\u015ftir\n become: yes\n systemd:\n name: \"tinc@{{ tinc_network_name }}\"\n state: started\n enabled: yes\n\n- name: Tinc portunu g\u00fcvenlik duvar\u0131nda a\u00e7 (UFW)\n become: yes\n community.general.ufw:\n rule: allow\n port: \"{{ tinc_port }}\"\n proto: udp\n when: ansible_os_family == \"Debian\" or ansible_os_family == \"Ubuntu\"\n\n- name: Tinc portunu g\u00fcvenlik duvar\u0131nda a\u00e7 (Firewalld)\n become: yes\n ansible.posix.firewalld:\n port: \"{{ tinc_port }}\/udp\"\n permanent: yes\n state: enabled\n when: ansible_os_family == \"RedHat\"\n notify: Reload firewalld<\/code><\/pre>\nroles\/tinc_vpn\/templates\/tinc.conf.j2<\/code>:<\/strong><\/p>\n# roles\/tinc_vpn\/templates\/tinc.conf.j2\nName = {{ inventory_hostname }}\nAddressFamily = ipv4\nPort = {{ tinc_port }}\nMode = switch\nDevice = \/dev\/net\/tun\nDi\u011fer host'lar\u0131n genel IP adreslerini buraya ekleyece\u011fiz (sonraki ad\u0131mda)<\/code><\/pre>\n<\/h2>\n
roles\/tinc_vpn\/templates\/host_config.j2<\/code>:<\/strong><\/p>\n# roles\/tinc_vpn\/templates\/host_config.j2\nAddress = {{ hostvars[inventory_hostname]['ansible_host'] }}\nSubnet = {{ tinc_base_ip }}.{{ hostvars[inventory_hostname]['tinc_node_id'] }}\/32\n\nGenel anahtar buraya eklenecek<\/h2>\n{{ tinc_node_public_key }}<\/code><\/pre>\n
roles\/tinc_vpn\/templates\/tinc-up.j2<\/code>:<\/strong><\/p>\n#!\/bin\/sh\nroles\/tinc_vpn\/templates\/tinc-up.j2<\/h2>\nip link set $INTERFACE up\nip addr add {{ tinc_base_ip }}.{{ hostvars[inventory_hostname]['tinc_node_id'] }}\/24 dev $INTERFACE\nip route add {{ tinc_subnet }} dev $INTERFACE\n
G\u00fcvenlik duvar\u0131 kurallar\u0131 (iste\u011fe ba\u011fl\u0131)<\/h2>\n
iptables -A INPUT -i $INTERFACE -j ACCEPT<\/h2>\n
iptables -A FORWARD -i $INTERFACE -j ACCEPT<\/code><\/pre>\n<\/h2>\n
roles\/tinc_vpn\/templates\/tinc-down.j2<\/code>:<\/strong><\/p>\n#!\/bin\/sh\nroles\/tinc_vpn\/templates\/tinc-down.j2<\/h2>\nip addr del {{ tinc_base_ip }}.{{ hostvars[inventory_hostname]['tinc_node_id'] }}\/24 dev $INTERFACE\nip link set $INTERFACE down<\/code><\/pre>\n
roles\/tinc_vpn\/handlers\/main.yml<\/code>:<\/strong><\/p>\n# roles\/tinc_vpn\/handlers\/main.yml\n- name: Restart tinc\n become: yes\n systemd:\n name: \"tinc@{{ tinc_network_name }}\"\n state: restarted\n\n- name: Reload firewalld\n become: yes\n ansible.posix.firewalld:\n state: reloaded\n when: ansible_os_family == \"RedHat\"<\/code><\/pre>\nAd\u0131m 4: Tinc Anahtarlar\u0131n\u0131n G\u00fcvenli Y\u00f6netimi ve Host Dosyalar\u0131<\/h4>\n
tinc_node_id<\/code>‘sine sahip olmas\u0131 ve bu ID’nin Tinc IP adresini belirlemesi gerekir. Ayr\u0131ca, t\u00fcm sunucular\u0131n genel anahtarlar\u0131n\u0131 toplay\u0131p her sunucuya da\u011f\u0131tmal\u0131y\u0131z.<\/p>\ngroup_vars\/all.yml<\/code>:<\/strong>
\nHer sunucuya benzersiz bir ID atay\u0131n. Bu ID, Tinc IP adresinin son oktetini belirleyecek.<\/p>\n# group_vars\/all.yml\ntinc_nodes:\n server1:\n tinc_node_id: 1\n server2:\n tinc_node_id: 2\n server3:\n tinc_node_id: 3\n ansible_control_node:\n tinc_node_id: 4 # Ansible kontrol makinesi de a\u011f\u0131n bir par\u00e7as\u0131 olacak<\/code><\/pre>\nhost_config.j2<\/code> dosyas\u0131nda tinc_node_id<\/code>‘yi hostvars[inventory_hostname]['tinc_node_id']<\/code> olarak \u00e7a\u011f\u0131rabilirsiniz.<\/p>\n
\n1. \u0130lk \u00e7al\u0131\u015ft\u0131rmada, her sunucu kendi anahtar\u0131n\u0131 olu\u015fturur ve genel anahtar\u0131n\u0131 Ansible kontrol makinesine g\u00f6nderir.
\n2. \u0130kinci \u00e7al\u0131\u015ft\u0131rmada, Ansible kontrol makinesi t\u00fcm genel anahtarlar\u0131 toplar ve her sunucuya, di\u011fer t\u00fcm sunucular\u0131n genel anahtarlar\u0131n\u0131 i\u00e7eren hosts\/<\/code> dizinini olu\u015fturacak \u015fekilde da\u011f\u0131t\u0131r.<\/p>\ntinc_vpn<\/code> rol\u00fcne ek g\u00f6revler ekleyebiliriz:<\/p>\nroles\/tinc_vpn\/tasks\/main.yml<\/code> (eklenecek g\u00f6revler):<\/strong><\/p>\n# ... \u00f6nceki g\u00f6revler ...\n\n- name: Genel anahtar\u0131 topla\n become: yes\n slurp:\n src: \"\/etc\/tinc\/{{ tinc_network_name }}\/rsa_key.pub\"\n register: current_host_public_key\n\n- name: Genel anahtarlar\u0131 kaydet (ge\u00e7ici olarak)\n ansible.builtin.set_fact:\n tinc_all_public_keys: \"{{ tinc_all_public_keys | default({}) | combine({inventory_hostname: current_host_public_key.content | b64decode}) }}\"\n delegate_to: localhost\n run_once: true # Sadece bir kez \u00e7al\u0131\u015ft\u0131r\n\n- name: T\u00fcm genel anahtarlar\u0131 da\u011f\u0131t\n become: yes\n template:\n src: host_peer_config.j2\n dest: \"\/etc\/tinc\/{{ tinc_network_name }}\/hosts\/{{ item.key }}\"\n mode: '0600'\n loop: \"{{ tinc_all_public_keys | dict2items }}\"\n loop_control:\n label: \"{{ item.key }}\"\n when: item.key != inventory_hostname # Kendi host dosyas\u0131n\u0131 tekrar yazma\n vars:\n peer_tinc_node_id: \"{{ tinc_nodes[item.key].tinc_node_id }}\"\n peer_tinc_public_key: \"{{ item.value }}\"\n peer_public_ip: \"{{ hostvars[item.key]['ansible_host'] }}\"\n notify: Restart tinc<\/code><\/pre>\nroles\/tinc_vpn\/templates\/host_peer_config.j2<\/code>:<\/strong><\/p>\n# roles\/tinc_vpn\/templates\/host_peer_config.j2\nAddress = {{ peer_public_ip }}\nSubnet = {{ tinc_base_ip }}.{{ peer_tinc_node_id }}\/32\n\n{{ peer_tinc_public_key }}<\/code><\/pre>\ntinc_all_public_keys<\/code> de\u011fi\u015fkeni, delegate_to: localhost<\/code> ve run_once: true<\/code> ile kontrol makinesinde bir kez toplan\u0131r ve ard\u0131ndan loop<\/code> ile t\u00fcm sunuculara da\u011f\u0131t\u0131l\u0131r.<\/p>\nAd\u0131m 5: G\u00fcvenlik Duvar\u0131 Yap\u0131land\u0131rmas\u0131 (S\u0131k\u0131la\u015ft\u0131rma)<\/h4>\n
roles\/tinc_vpn\/tasks\/main.yml<\/code> (eklenecek g\u00f6revler):<\/strong><\/p>\n# ... \u00f6nceki g\u00f6revler ...\n\n- name: SSH eri\u015fimini Tinc a\u011f\u0131 ile s\u0131n\u0131rla (UFW)\n become: yes\n community.general.ufw:\n rule: allow\n port: '22'\n proto: tcp\n src: \"{{ tinc_subnet }}\"\n when: ansible_os_family == \"Debian\" or ansible_os_family == \"Ubuntu\"\n\n- name: SSH eri\u015fimini Tinc a\u011f\u0131 ile s\u0131n\u0131rla (Firewalld)\n become: yes\n ansible.posix.firewalld:\n port: 22\/tcp\n source: \"{{ tinc_subnet }}\"\n permanent: yes\n state: enabled\n when: ansible_os_family == \"RedHat\"\n notify: Reload firewalld<\/code><\/pre>\nAd\u0131m 6: Playbook Olu\u015fturma (
playbooks\/deploy_tinc.yml<\/code>)<\/h4>\n# playbooks\/deploy_tinc.yml\n- name: Tinc VPN a\u011f\u0131n\u0131 da\u011f\u0131t ve yap\u0131land\u0131r\n hosts: all\n gather_facts: yes\n roles:\n - tinc_vpn\n vars:\n ansible_ssh_common_args: '-o StrictHostKeyChecking=no' # \u0130lk ba\u011flant\u0131 i\u00e7in gerekli olabilir\n\n- name: Ansible inventory'sini Tinc IP'leriyle g\u00fcncelle\n hosts: localhost\n connection: local\n gather_facts: no\n tasks:\n - name: Dinamik inventory olu\u015ftur\n template:\n src: dynamic_inventory.ini.j2\n dest: inventory_tinc.ini\n vars:\n tinc_nodes_data: \"{{ hostvars | dict2items | selectattr('key', 'in', groups['all']) | list }}\"<\/code><\/pre>\nplaybooks\/dynamic_inventory.ini.j2<\/code>:<\/strong><\/p>\n# playbooks\/dynamic_inventory.ini.j2\n[servers]\n{% for host in tinc_nodes_data %}\n{% if host.key != 'ansible_control_node' %}\n{{ host.key }} ansible_host={{ tinc_base_ip }}.{{ host.value.tinc_node_id }}\n{% endif %}\n{% endfor %}\n\n[ansible_control]\nansible_control_node ansible_host={{ tinc_base_ip }}.{{ hostvars['ansible_control_node'].tinc_node_id }}\n\n[all:vars]\nansible_user=your_ssh_username\nansible_python_interpreter=\/usr\/bin\/python3<\/code><\/pre>\nAd\u0131m 7: Tinc A\u011f\u0131 \u00dczerinden Ansible Y\u00f6netimi<\/h4>\n
ansible-playbook playbooks\/deploy_tinc.yml -i inventory.ini<\/code>), inventory_tinc.ini<\/code> ad\u0131nda yeni bir inventory dosyas\u0131 olu\u015facak. Bu dosya, sunucular\u0131n\u0131z\u0131n Tinc IP adreslerini i\u00e7erecek.<\/p>\nansible-playbook your_other_playbook.yml -i inventory_tinc.ini<\/code><\/pre>\ntinc_all_public_keys<\/code> de\u011fi\u015fkeninin topland\u0131\u011f\u0131 ve da\u011f\u0131t\u0131ld\u0131\u011f\u0131 k\u0131s\u0131m, Ansible’\u0131n “run_once” ve “delegate_to: localhost” \u00f6zelliklerini kullanarak t\u00fcm sunucular\u0131n anahtarlar\u0131n\u0131 kontrol makinesinde toplamas\u0131n\u0131 ve ard\u0131ndan bu anahtarlar\u0131 her sunucuya ayr\u0131 ayr\u0131 da\u011f\u0131tmas\u0131n\u0131 sa\u011flar. Bu, Tinc’in mesh yap\u0131s\u0131 i\u00e7in gerekli olan “her d\u00fc\u011f\u00fcm di\u011fer t\u00fcm d\u00fc\u011f\u00fcmlerin genel anahtar\u0131na sahip olmal\u0131” kural\u0131n\u0131 otomatikle\u015ftirir.<\/p>\nG\u00fcvenlik ve En \u0130yi Uygulamalar<\/h3>\n
Ansible G\u00fcvenli\u011fi<\/h4>\n
\n* Minimum Yetki Prensibi:<\/strong> Ansible’\u0131n y\u00f6netti\u011fi sunucularda sudo<\/code> veya root<\/code> yetkilerini yaln\u0131zca kesinlikle gerekti\u011finde kullan\u0131n. M\u00fcmk\u00fcnse, belirli g\u00f6revler i\u00e7in daha k\u0131s\u0131tl\u0131 yetkilere sahip \u00f6zel kullan\u0131c\u0131lar olu\u015fturun. SSH anahtarlar\u0131n\u0131z\u0131 da minimum yetki prensibine g\u00f6re yap\u0131land\u0131r\u0131n.
\n* Ansible Kontrol Makinesinin G\u00fcvenli\u011fi:<\/strong> Ansible kontrol makinesi, t\u00fcm altyap\u0131n\u0131z\u0131n anahtar noktas\u0131d\u0131r. Bu makinenin g\u00fcvenli\u011fini sa\u011flamak kritik \u00f6neme sahiptir.
\n * S\u0131k\u0131 g\u00fcvenlik duvar\u0131 kurallar\u0131 uygulay\u0131n.
\n * SSH eri\u015fimini anahtar tabanl\u0131 kimlik do\u011frulama ile s\u0131n\u0131rlay\u0131n ve parolal\u0131 eri\u015fimi devre d\u0131\u015f\u0131 b\u0131rak\u0131n.
\n * \u0130ki fakt\u00f6rl\u00fc kimlik do\u011frulama (2FA) kullan\u0131n.
\n * D\u00fczenli g\u00fcvenlik g\u00fcncellemeleri yap\u0131n.
\n * Eri\u015fimi yaln\u0131zca yetkili ki\u015filere verin.
\n* Denetlenebilirlik ve Loglama:<\/strong> Ansible \u00e7al\u0131\u015ft\u0131rmalar\u0131n\u0131 ve de\u011fi\u015fikliklerini d\u00fczenli olarak loglay\u0131n. Bu loglar, g\u00fcvenlik denetimleri ve olas\u0131 ihlallerin tespiti i\u00e7in de\u011ferli bilgiler sa\u011flar. Ansible’\u0131n callback_plugins<\/code> \u00f6zelli\u011fi ile loglama mekanizmalar\u0131n\u0131 \u00f6zelle\u015ftirebilirsiniz.
\n* Kod \u0130ncelemesi:<\/strong> Playbook’lar\u0131n\u0131z\u0131 ve rolllerinizi d\u00fczenli olarak g\u00fcvenlik a\u00e7\u0131klar\u0131na kar\u015f\u0131 inceleyin. G\u00fcvenlik standartlar\u0131na uygun oldu\u011fundan emin olun.<\/p>\nTinc G\u00fcvenli\u011fi<\/h4>\n
\n * \u00d6zel anahtarlar\u0131n asla a\u00e7\u0131\u011fa \u00e7\u0131kmad\u0131\u011f\u0131ndan emin olun. Ansible Vault, bu anahtarlar\u0131 da\u011f\u0131t\u0131rken ve saklarken yard\u0131mc\u0131 olabilir.
\n * Gerekirse anahtarlar\u0131 d\u00fczenli olarak yenileyin.
\n* Sadece Gerekli Portlar\u0131n A\u00e7\u0131lmas\u0131:<\/strong> Sunucular\u0131n\u0131zdaki g\u00fcvenlik duvarlar\u0131nda Tinc’in kulland\u0131\u011f\u0131 UDP portu (varsay\u0131lan 655) d\u0131\u015f\u0131nda gereksiz hi\u00e7bir portu d\u0131\u015far\u0131ya a\u00e7may\u0131n. Tinc a\u011f\u0131 kurulduktan sonra, SSH gibi y\u00f6netim portlar\u0131na d\u0131\u015far\u0131dan eri\u015fimi tamamen kapat\u0131n ve yaln\u0131zca Tinc a\u011f\u0131 i\u00e7indeki IP adreslerinden eri\u015fime izin verin.
\n* Tinc A\u011f\u0131n\u0131n \u0130zlenmesi:<\/strong> Tinc a\u011f\u0131n\u0131z\u0131n etkinli\u011fini ve ba\u011flant\u0131 durumunu d\u00fczenli olarak izleyin. Anormal trafik desenleri veya ba\u011flant\u0131 kesintileri potansiyel g\u00fcvenlik sorunlar\u0131na i\u015faret edebilir.
\n* Eri\u015fim Kontrol\u00fc (iptables\/nftables):<\/strong> Tinc’in olu\u015fturdu\u011fu sanal a\u011f aray\u00fcz\u00fc (tinc-myvpn<\/code> gibi) \u00fczerinde ek g\u00fcvenlik duvar\u0131 kurallar\u0131 uygulayarak, Tinc a\u011f\u0131 i\u00e7indeki trafi\u011fi daha da s\u0131k\u0131la\u015ft\u0131rabilirsiniz. \u00d6rne\u011fin, belirli sunucular\u0131n sadece belirli portlara eri\u015fmesine izin verebilirsiniz.<\/p>\nGenel G\u00fcvenlik Uygulamalar\u0131<\/h4>\n
\n* \u0130zleme ve Loglama:<\/strong> Sunucular\u0131n\u0131zdaki sistem loglar\u0131n\u0131 (auth.log, syslog vb.) ve Tinc loglar\u0131n\u0131 merkezi bir log y\u00f6netim sistemi (ELK Stack, Grafana Loki vb.) ile toplay\u0131n ve izleyin. Anormal davran\u0131\u015flar\u0131 tespit etmek i\u00e7in alarm mekanizmalar\u0131 kurun.
\n* Yedekleme Stratejileri:<\/strong> Tinc yap\u0131land\u0131rma dosyalar\u0131, anahtarlar ve Ansible playbook’lar\u0131 dahil olmak \u00fczere t\u00fcm kritik verilerin d\u00fczenli yedeklerini al\u0131n. Bu yedekleri g\u00fcvenli ve ayr\u0131 bir konumda saklay\u0131n.
\n* \u0130ki Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (2FA):<\/strong> M\u00fcmk\u00fcn olan her yerde (SSH eri\u015fimi, bulut sa\u011flay\u0131c\u0131 panelleri vb.) iki fakt\u00f6rl\u00fc kimlik do\u011frulama kullan\u0131n.
\n* A\u011f Segmentasyonu:<\/strong> Tinc VPN, sunucular\u0131n\u0131z aras\u0131nda g\u00fcvenli bir segmentasyon sa\u011flar. Bu prensibi geni\u015fleterek, farkl\u0131 g\u00fcvenlik seviyelerine sahip sunucular\u0131 ayr\u0131 Tinc a\u011flar\u0131na veya farkl\u0131 sanal alt a\u011flara ay\u0131rmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz.<\/p>\nSonu\u00e7<\/h3>\n
\n2. \u0130leti\u015fim G\u00fcvenli\u011fi:<\/strong> Tinc VPN, sunucular aras\u0131 t\u00fcm trafi\u011fi \u015fifreleyerek veri gizlili\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korur. Ansible’\u0131n Tinc a\u011f\u0131 \u00fczerinden \u00e7al\u0131\u015fmas\u0131, y\u00f6netim trafi\u011finin de bu g\u00fcvenli t\u00fcnel \u00fczerinden ge\u00e7mesini sa\u011flar.<\/p>\n
\n* Kimlik ve Eri\u015fim Y\u00f6netimi (IAM):<\/strong> Kullan\u0131c\u0131lar\u0131n ve servislerin eri\u015fim yetkilerini s\u0131k\u0131 bir \u015fekilde y\u00f6netmek, yetkisiz eri\u015fimi engellemek i\u00e7in esast\u0131r.
\n* S\u0131zma Testleri ve G\u00fcvenlik Denetimleri:<\/strong> Altyap\u0131n\u0131z\u0131n d\u00fczenli olarak s\u0131zma testlerine tabi tutulmas\u0131 ve g\u00fcvenlik denetimlerinden ge\u00e7irilmesi, potansiyel zafiyetleri ortaya \u00e7\u0131kar\u0131r.
\n* Yedekleme ve Felaket Kurtarma:<\/strong> Kritik verilerin ve sistemlerin d\u00fczenli yedeklenmesi, olas\u0131 veri kayb\u0131 veya sistem ar\u0131zas\u0131 durumunda h\u0131zl\u0131 kurtarma imkan\u0131 sunar.<\/p>\n