{"id":32228,"date":"2025-10-19T07:41:05","date_gmt":"2025-10-19T04:41:05","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=32228"},"modified":"2025-10-19T07:41:05","modified_gmt":"2025-10-19T04:41:05","slug":"nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/","title":{"rendered":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?"},"content":{"rendered":"

<\/p>\n

Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?<\/h2>\n

Nginx, g\u00fcn\u00fcm\u00fcz\u00fcn en pop\u00fcler ve g\u00fc\u00e7l\u00fc a\u00e7\u0131k kaynakl\u0131 web sunucular\u0131ndan biridir. Y\u00fcksek performans, \u00f6l\u00e7eklenebilirlik ve esneklik sunarak milyonlarca web sitesine, web uygulamas\u0131na ve API’ye g\u00fc\u00e7 vermektedir. Ters proxy, y\u00fck dengeleyici ve HTTP \u00f6nbelle\u011fi olarak da kullan\u0131labilen Nginx, modern web altyap\u0131lar\u0131n\u0131n vazge\u00e7ilmez bir bile\u015fenidir. Ancak, internete a\u00e7\u0131k her sunucu gibi Nginx de \u00e7e\u015fitli siber tehditlere maruz kal\u0131r. Brute-force sald\u0131r\u0131lar\u0131, hizmet reddi (DoS) denemeleri, zafiyet taramalar\u0131 ve botnet faaliyetleri gibi k\u00f6t\u00fc niyetli giri\u015fimler, sunucunuzun performans\u0131n\u0131 d\u00fc\u015f\u00fcrebilir, hizmet kesintilerine yol a\u00e7abilir ve hatta hassas verilerin ele ge\u00e7irilmesine neden olabilir.<\/p>\n

Bu makalede, Ubuntu 22.04 i\u015fletim sistemi \u00fczerinde \u00e7al\u0131\u015fan Nginx sunucunuzu, otomatik bir izinsiz giri\u015f \u00f6nleme \u00e7er\u00e7evesi olan Fail2Ban ile nas\u0131l koruyaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m inceleyece\u011fiz. Fail2Ban, sunucu log dosyalar\u0131n\u0131 s\u00fcrekli olarak izleyerek k\u00f6t\u00fc niyetli aktiviteleri tespit eder ve belirli bir say\u0131da ba\u015far\u0131s\u0131z denemenin ard\u0131ndan sald\u0131rgan IP adreslerini otomatik olarak engeller. Bu sayede, sunucunuzun g\u00fcvenli\u011fini art\u0131r\u0131rken, manuel m\u00fcdahale ihtiyac\u0131n\u0131 minimize etmi\u015f olursunuz. Nginx’in \u00e7e\u015fitli log dosyalar\u0131n\u0131 kullanarak, farkl\u0131 sald\u0131r\u0131 t\u00fcrlerine kar\u015f\u0131 nas\u0131l koruma sa\u011flayaca\u011f\u0131m\u0131z\u0131 detayl\u0131 bir \u015fekilde ele alaca\u011f\u0131z.<\/p>\n

Nginx ve Web Sunucusu G\u00fcvenli\u011finin \u00d6nemi<\/h2>\n

Nginx, modern web altyap\u0131lar\u0131n\u0131n temel ta\u015flar\u0131ndan biridir. Y\u00fcksek trafikli sitelerden mikroservis mimarilerine kadar geni\u015f bir yelpazede kullan\u0131l\u0131r. Bu kadar kritik bir rol \u00fcstlenmesi, onun g\u00fcvenli\u011finin de en \u00fcst d\u00fczeyde tutulmas\u0131n\u0131 zorunlu k\u0131lar. Bir Nginx sunucusunun kar\u015f\u0131la\u015fabilece\u011fi ba\u015fl\u0131ca tehditler \u015funlard\u0131r:<\/p>\n

* Brute-Force Sald\u0131r\u0131lar\u0131:<\/strong> \u00d6zellikle HTTP kimlik do\u011frulama veya admin paneli gibi giri\u015f noktalar\u0131n\u0131 hedef alan, \u015fifre deneme yan\u0131lma sald\u0131r\u0131lar\u0131d\u0131r. Sald\u0131rganlar, binlerce farkl\u0131 kullan\u0131c\u0131 ad\u0131 ve \u015fifre kombinasyonunu deneyerek sisteme s\u0131zmaya \u00e7al\u0131\u015f\u0131r.
\n* Hizmet Reddi (DoS\/DDoS) Sald\u0131r\u0131lar\u0131:<\/strong> Sunucuyu a\u015f\u0131r\u0131 isteklerle bo\u011farak me\u015fgul etmeyi ve yasal kullan\u0131c\u0131lar\u0131n hizmetlere eri\u015fimini engellemeyi ama\u00e7lar. Bu sald\u0131r\u0131lar, sunucunun kaynaklar\u0131n\u0131 t\u00fcketerek hizmet kesintisine yol a\u00e7ar.
\n* Zafiyet Taramalar\u0131 ve Ke\u015fif Faaliyetleri:<\/strong> Sald\u0131rganlar, sunucunuzdaki potansiyel zafiyetleri (\u00f6rne\u011fin, eski yaz\u0131l\u0131m s\u00fcr\u00fcmleri, a\u00e7\u0131k portlar, yanl\u0131\u015f yap\u0131land\u0131rmalar) tespit etmek i\u00e7in otomatik ara\u00e7lar kullan\u0131r. Bu taramalar genellikle sisteme s\u0131zma giri\u015fimlerinin ilk ad\u0131m\u0131d\u0131r.
\n* Web Uygulama Sald\u0131r\u0131lar\u0131:<\/strong> Nginx bir ters proxy olarak kullan\u0131ld\u0131\u011f\u0131nda, arkas\u0131ndaki web uygulamalar\u0131n\u0131 hedef alan SQL Enjeksiyonu, XSS (Cross-Site Scripting) gibi sald\u0131r\u0131lara kar\u015f\u0131 birincil savunma hatt\u0131 olabilir.<\/p>\n

Bu tehditler, sadece hizmet kesintisine de\u011fil, ayn\u0131 zamanda veri ihlallerine, itibar kayb\u0131na ve finansal zararlara da yol a\u00e7abilir. Bu nedenle, Nginx sunucular\u0131n\u0131 proaktif g\u00fcvenlik \u00f6nlemleriyle korumak hayati \u00f6nem ta\u015f\u0131r. Fail2Ban, bu \u00f6nlemlerin ba\u015f\u0131nda gelir ve otomatik bir savunma katman\u0131 sunar.<\/p>\n

Fail2Ban’e Yak\u0131ndan Bak\u0131\u015f<\/h2>\n

Fail2Ban, Linux tabanl\u0131 sistemlerde \u00e7al\u0131\u015fan, otomatik bir izinsiz giri\u015f \u00f6nleme yaz\u0131l\u0131m\u0131d\u0131r. Temel amac\u0131, sunucu log dosyalar\u0131n\u0131 (SSH, Apache, Nginx, Postfix vb.) s\u00fcrekli olarak tarayarak k\u00f6t\u00fc niyetli aktiviteleri tespit etmek ve bu aktiviteleri ger\u00e7ekle\u015ftiren IP adreslerini ge\u00e7ici veya kal\u0131c\u0131 olarak engellemektir.<\/p>\n

\u00c7al\u0131\u015fma Prensibi:<\/strong>
\nFail2Ban, belirli bir hizmetin log dosyalar\u0131n\u0131 (\u00f6rne\u011fin, Nginx’in access.log<\/code> veya error.log<\/code> dosyalar\u0131) d\u00fczenli aral\u0131klarla okur. Bu loglarda \u00f6nceden tan\u0131mlanm\u0131\u015f “filtreler” ile e\u015fle\u015fen desenler arar. Bir IP adresinden gelen denemeler belirli bir zaman dilimi i\u00e7inde (\u00f6rne\u011fin, 10 dakika i\u00e7inde 5 ba\u015far\u0131s\u0131z giri\u015f denemesi) e\u015fi\u011fi a\u015farsa, Fail2Ban bu IP adresini bir g\u00fcvenlik duvar\u0131 (genellikle iptables) kural\u0131 ekleyerek engeller. Engelleme s\u00fcresi sona erdi\u011finde, IP adresi otomatik olarak serbest b\u0131rak\u0131l\u0131r.<\/p>\n

Temel Bile\u015fenler:<\/strong><\/p>\n

* Jail (Hapishane):<\/strong> Belirli bir hizmeti (\u00f6rne\u011fin, nginx-http-auth<\/code>, nginx-dos<\/code>, ssh<\/code>) korumak i\u00e7in kullan\u0131lan yap\u0131land\u0131rma birimidir. Her jail, hangi log dosyas\u0131n\u0131n izlenece\u011fini, hangi filtrenin kullan\u0131laca\u011f\u0131n\u0131, engelleme s\u00fcresini (bantime<\/code>), deneme s\u00fcresi penceresini (findtime<\/code>) ve maksimum deneme say\u0131s\u0131n\u0131 (maxretry<\/code>) tan\u0131mlar.
\n* Filter (Filtre):<\/strong> Log dosyalar\u0131ndaki k\u00f6t\u00fc niyetli aktivite kal\u0131plar\u0131n\u0131 tan\u0131mlayan d\u00fczenli ifadeler (regex) i\u00e7erir. \u00d6rne\u011fin, “yanl\u0131\u015f \u015fifre” veya “401 Unauthorized” gibi mesajlar\u0131 arar. Filtreler \/etc\/fail2ban\/filter.d\/<\/code> dizininde bulunur.
\n* Action (Eylem):<\/strong> Bir IP adresi engellendi\u011finde veya engeli kald\u0131r\u0131ld\u0131\u011f\u0131nda ger\u00e7ekle\u015ftirilecek eylemleri tan\u0131mlar. Varsay\u0131lan eylem, iptables kullanarak IP’yi engellemektir, ancak e-posta bildirimi g\u00f6nderme gibi ba\u015fka eylemler de tan\u0131mlanabilir. Eylemler \/etc\/fail2ban\/action.d\/<\/code> dizininde bulunur.<\/p>\n

Avantajlar\u0131:<\/strong><\/p>\n

* Otomatik Koruma:<\/strong> K\u00f6t\u00fc niyetli IP’leri otomatik olarak tespit eder ve engeller, manuel m\u00fcdahale gerektirmez.
\n* Hafif ve Verimli:<\/strong> Kaynak t\u00fcketimi d\u00fc\u015f\u00fckt\u00fcr ve sunucu performans\u0131n\u0131 olumsuz etkilemez.
\n* Esnek Yap\u0131land\u0131rma:<\/strong> Farkl\u0131 hizmetler i\u00e7in \u00f6zelle\u015ftirilebilir filtreler ve eylemler tan\u0131mlanabilir.
\n* Geni\u015f Kapsam:<\/strong> SSH, web sunucular\u0131, e-posta sunucular\u0131 gibi bir\u00e7ok farkl\u0131 hizmeti koruyabilir.<\/p>\n

\u00d6n Gereksinimler<\/h2>\n

Fail2Ban’\u0131 Nginx ile entegre etmeden \u00f6nce a\u015fa\u011f\u0131daki \u00f6n gereksinimlerin kar\u015f\u0131land\u0131\u011f\u0131ndan emin olun:<\/p>\n

* Ubuntu 22.04 Sunucusu:<\/strong> Makaledeki ad\u0131mlar Ubuntu 22.04 LTS s\u00fcr\u00fcm\u00fc i\u00e7in ge\u00e7erlidir.
\n* Nginx Kurulumu:<\/strong> Nginx web sunucusunun sunucunuza kurulu ve \u00e7al\u0131\u015f\u0131r durumda olmas\u0131 gerekmektedir. Nginx’i kurmak i\u00e7in:<\/p>\n

sudo apt update\n    sudo apt install nginx\n    sudo systemctl enable nginx\n    sudo systemctl start nginx<\/code><\/pre>\n
*   Sudo Yetkilerine Sahip Kullan\u0131c\u0131:<\/strong> Komutlar\u0131 \u00e7al\u0131\u015ft\u0131rmak i\u00e7in sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 hesab\u0131n\u0131z olmal\u0131d\u0131r.
\n*   SSH Eri\u015fimi:<\/strong> Sunucuya uzaktan eri\u015fim i\u00e7in SSH ba\u011flant\u0131n\u0131z\u0131n olmas\u0131 gereklidir.<\/p>\n
Fail2Ban Kurulumu<\/h2>\n
Fail2Ban’\u0131 Ubuntu 22.04 sunucunuza kurmak olduk\u00e7a basittir. \u0130lk olarak sistem paket listesini g\u00fcncelleyin ve ard\u0131ndan Fail2Ban paketini y\u00fckleyin:<\/p>\n
1.  Sistem Paketlerini G\u00fcncelleme:<\/strong><\/p>\n
sudo apt update\n    sudo apt upgrade -y<\/code><\/pre>\n
2.  Fail2Ban Paketini Kurma:<\/strong><\/p>\n
sudo apt install fail2ban -y<\/code><\/pre>\n
3.  Fail2Ban Servisinin Durumunu Kontrol Etme:<\/strong>
\n    Kurulum tamamland\u0131ktan sonra, Fail2Ban servisinin \u00e7al\u0131\u015f\u0131r durumda oldu\u011funu do\u011frulay\u0131n:<\/p>\n
sudo systemctl status fail2ban<\/code><\/pre>\n
    \u00c7\u0131kt\u0131da active (running)<\/code> ifadesini g\u00f6rmelisiniz. E\u011fer \u00e7al\u0131\u015fm\u0131yorsa, a\u015fa\u011f\u0131daki komutla ba\u015flatabilirsiniz:<\/p>\n
sudo systemctl enable fail2ban\n    sudo systemctl start fail2ban<\/code><\/pre>\n
Fail2Ban Yap\u0131land\u0131rmas\u0131: Temel Ayarlar<\/h2>\n
Fail2Ban’\u0131n yap\u0131land\u0131rma dosyalar\u0131 \/etc\/fail2ban\/<\/code> dizininde bulunur. Ana yap\u0131land\u0131rma dosyas\u0131 jail.conf<\/code>‘tur. Ancak, bu dosyay\u0131 do\u011frudan d\u00fczenlemek yerine, jail.local<\/code> ad\u0131nda bir kopya olu\u015fturarak de\u011fi\u015fiklikleri bu dosyada yapman\u0131z \u00f6nerilir. Bunun nedeni, jail.conf<\/code> dosyas\u0131n\u0131n Fail2Ban g\u00fcncellemeleri s\u0131ras\u0131nda \u00fczerine yaz\u0131labilmesidir. jail.local<\/code> dosyas\u0131 ise jail.conf<\/code> dosyas\u0131ndaki ayarlar\u0131 ge\u00e7ersiz k\u0131lar ve g\u00fcncellemelerden etkilenmez.<\/p>\n
1.  jail.local<\/code> Dosyas\u0131n\u0131 Olu\u015fturma:<\/strong><\/p>\n
sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n
2.  jail.local<\/code> Dosyas\u0131n\u0131 D\u00fczenleme:<\/strong>
\n    \u015eimdi jail.local<\/code> dosyas\u0131n\u0131 bir metin d\u00fczenleyici ile a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre>\n
    Bu dosyan\u0131n ba\u015f\u0131nda [DEFAULT]<\/code> b\u00f6l\u00fcm\u00fc bulunur. Bu b\u00f6l\u00fcmde, t\u00fcm jail’ler i\u00e7in ge\u00e7erli olacak genel ayarlar\u0131 yap\u0131land\u0131rabilirsiniz.<\/p>\n
    *   ignoreip<\/code>:<\/strong> Engellenmeyecek IP adreslerini veya IP aral\u0131klar\u0131n\u0131 (CIDR format\u0131nda) belirtir. Kendi IP adresinizi veya g\u00fcvenilir sunucular\u0131n IP’lerini buraya eklemek, yanl\u0131\u015fl\u0131kla kendinizi engellemenizi \u00f6nler. Birden fazla IP adresi bo\u015flukla ayr\u0131l\u0131r.<\/p>\n
ignoreip = 127.0.0.1\/8 ::1 192.168.1.0\/24 203.0.113.42<\/code><\/pre>\n
    *   bantime<\/code>:<\/strong> Bir IP adresinin engelli kalaca\u011f\u0131 s\u00fcreyi saniye cinsinden belirtir. Varsay\u0131lan olarak 10 dakika (600 saniye) olarak ayarlanm\u0131\u015ft\u0131r. Daha uzun bir s\u00fcre i\u00e7in (\u00f6rne\u011fin, 1 saat) 3600 saniye yapabilirsiniz. -1<\/code> de\u011feri, IP adresinin kal\u0131c\u0131 olarak engellenece\u011fi anlam\u0131na gelir.<\/p>\n
bantime = 3600<\/code><\/pre>\n
    *   findtime<\/code>:<\/strong> Belirtilen maxretry<\/code> say\u0131s\u0131na ula\u015fmak i\u00e7in IP adresinin ne kadar s\u00fcre i\u00e7inde deneme yapmas\u0131 gerekti\u011fini saniye cinsinden belirtir. Varsay\u0131lan olarak 10 dakika (600 saniye) olarak ayarlanm\u0131\u015ft\u0131r.<\/p>\n
findtime = 600<\/code><\/pre>\n
    *   maxretry<\/code>:<\/strong> Bir IP adresinin findtime<\/code> s\u00fcresi i\u00e7inde ka\u00e7 ba\u015far\u0131s\u0131z denemeden sonra engellenece\u011fini belirtir. Varsay\u0131lan olarak 5 olarak ayarlanm\u0131\u015ft\u0131r.<\/p>\n
maxretry = 5<\/code><\/pre>\n
    *   destemail<\/code>:<\/strong> Engelleme eylemi tetiklendi\u011finde bildirim g\u00f6nderilecek e-posta adresini belirtir.<\/p>\n
destemail = admin@example.com<\/code><\/pre>\n
    *   action<\/code>:<\/strong> Engelleme eylemi i\u00e7in varsay\u0131lan olarak hangi beti\u011fin kullan\u0131laca\u011f\u0131n\u0131 belirtir. %(action_mw)s<\/code> e-posta ile bildirim g\u00f6nderir, %(action_mwl)s<\/code> e-posta ile loglar\u0131 da g\u00f6nderir.<\/p>\n
action = %(action_mwl)s<\/code><\/pre>\n
    \u00d6rnek [DEFAULT]<\/code> yap\u0131land\u0131rmas\u0131:<\/p>\n
[DEFAULT]\n    ignoreip = 127.0.0.1\/8 ::1 192.168.1.0\/24 # Kendi IP adresinizi ekleyin\n    bantime = 3600\n    findtime = 600\n    maxretry = 5\n    destemail = your_email@example.com\n    sendername = Fail2Ban\n    mta = sendmail\n    action = %(action_mwl)s<\/code><\/pre>\n
    De\u011fi\u015fiklikleri kaydedip dosyay\u0131 kapat\u0131n (CTRL+O, Enter, CTRL+X).<\/p>\n
Nginx \u0130\u00e7in Fail2Ban Filtreleri ve Jail’leri Olu\u015fturma<\/h2>\n
Nginx i\u00e7in Fail2Ban yap\u0131land\u0131rmas\u0131, Nginx’in \u00fcretti\u011fi log dosyalar\u0131n\u0131 izleyerek belirli desenleri yakalamaya dayan\u0131r. Nginx genellikle iki ana log dosyas\u0131 kullan\u0131r:
\n*   \/var\/log\/nginx\/access.log<\/code>: T\u00fcm gelen HTTP isteklerini kaydeder.
\n*   \/var\/log\/nginx\/error.log<\/code>: Nginx sunucusunun kar\u015f\u0131la\u015ft\u0131\u011f\u0131 hatalar\u0131 kaydeder.<\/p>\n
Bu iki log dosyas\u0131, farkl\u0131 t\u00fcrdeki sald\u0131r\u0131lar\u0131 tespit etmek i\u00e7in kullan\u0131labilir.<\/p>\n
Nginx HTTP Kimlik Do\u011frulama Korumas\u0131 (Brute-Force)<\/h3>\n
E\u011fer Nginx ile htpasswd<\/code> kullanarak bir dizin veya alan i\u00e7in HTTP temel kimlik do\u011frulamas\u0131 (auth_basic<\/code>) kullan\u0131yorsan\u0131z, brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flamak \u00f6nemlidir. Fail2Ban’\u0131n varsay\u0131lan olarak nginx-http-auth<\/code> filtresi bulunur.<\/p>\n
1.  nginx-http-auth<\/code> Filtresi:<\/strong>
\n    Bu filtre genellikle \/etc\/fail2ban\/filter.d\/nginx-http-auth.conf<\/code> yolunda bulunur ve a\u015fa\u011f\u0131daki gibi bir i\u00e7eri\u011fe sahiptir:<\/p>\n
# Fail2Ban filter for nginx http authentication\n    [Definition]\n    failregex = ^ \\[error\\] \\d+#\\d+: \\*\\d+ user \"\\S+\" client: , server: \\S+, request: \"\\S+ \\S+ HTTP\/\\d\\.\\d\", host: \"\\S+\"$\n                ^ \\[error\\] \\d+#\\d+: \\*\\d+ no user\/password was provided for basic authentication, client: , server: \\S+, request: \"\\S+ \\S+ HTTP\/\\d\\.\\d\", host: \"\\S+\"$\n                ^ \\[error\\] \\d+#\\d+: \\*\\d+ client: , server: \\S+, request: \"\\S+ \\S+ HTTP\/\\d\\.\\d\", host: \"\\S+\" upstream: \"basic:\/\\S+\", user: \"\\S+\", reason: \"password mismatch\"$\n                ^ \\[error\\] \\d+#\\d+: \\*\\d+ user \"\\S+\" was not found in \"\\S+\", client: , server: \\S+, request: \"\\S+ \\S+ HTTP\/\\d\\.\\d\", host: \"\\S+\"$\n    ignoreregex =<\/code><\/pre>\n
    Bu filtre, Nginx’in error.log<\/code> dosyas\u0131nda HTTP kimlik do\u011frulama hatalar\u0131n\u0131 (yanl\u0131\u015f kullan\u0131c\u0131 ad\u0131\/\u015fifre, kimlik bilgisi sa\u011flanmamas\u0131 vb.) arar.<\/p>\n
2.  jail.local<\/code>‘a Jail Ekleme:<\/strong>
\n    jail.local<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n ve dosyan\u0131n sonuna a\u015fa\u011f\u0131daki b\u00f6l\u00fcm\u00fc ekleyin:<\/p>\n
[nginx-http-auth]\n    enabled = true\n    port    = http,https\n    filter  = nginx-http-auth\n    logpath = \/var\/log\/nginx\/error.log\n    maxretry = 5\n    bantime = 3600<\/code><\/pre>\n
    *   enabled = true<\/code>: Bu jail’i etkinle\u015ftirir.
\n    *   port = http,https<\/code>: Bu jail’in uyguland\u0131\u011f\u0131 portlar\u0131 belirtir.
\n    *   filter = nginx-http-auth<\/code>: Kullan\u0131lacak filtrenin ad\u0131n\u0131 belirtir.
\n    *   logpath = \/var\/log\/nginx\/error.log<\/code>: \u0130zlenecek log dosyas\u0131n\u0131n yolunu belirtir. HTTP kimlik do\u011frulama hatalar\u0131 error.log<\/code>‘a yaz\u0131l\u0131r.
\n    *   maxretry<\/code> ve bantime<\/code> de\u011ferlerini isterseniz [DEFAULT]<\/code> b\u00f6l\u00fcm\u00fcndekilerden farkl\u0131 olarak burada da belirleyebilirsiniz.<\/p>\n
Nginx DoS\/DDoS ve Zafiyet Tarama Korumas\u0131<\/h3>\n
Nginx’e y\u00f6nelik DoS denemeleri, zafiyet taramalar\u0131 veya s\u00fcrekli olarak bulunmayan sayfalara eri\u015fim denemeleri gibi k\u00f6t\u00fc niyetli aktiviteler genellikle access.log<\/code> veya error.log<\/code> dosyalar\u0131nda 4xx (Client Error) hata kodlar\u0131 \u00fcretir. Bu t\u00fcr aktiviteleri yakalamak i\u00e7in \u00f6zel bir filtre olu\u015fturabiliriz.<\/p>\n
1.  \u00d6zel nginx-dos<\/code> Filtresi Olu\u015fturma:<\/strong>
\n    Yeni bir filtre dosyas\u0131 olu\u015fturun:<\/p>\n
sudo nano \/etc\/fail2ban\/filter.d\/nginx-dos.conf<\/code><\/pre>\n
    Dosyan\u0131n i\u00e7ine a\u015fa\u011f\u0131daki i\u00e7eri\u011fi yap\u0131\u015ft\u0131r\u0131n:<\/p>\n
[Definition]\n    # Catches various Nginx bad requests, 4xx errors indicating attacks or bad bots.\n    # This filter monitors both access.log and error.log for suspicious patterns.\n\n    failregex = ^ -.\"(GET|POST|HEAD|PUT|DELETE|OPTIONS|PATCH) \\S<\/em> HTTP\/\\d\\.\\d\" (400|401|403|404|405|408|413|414|429|444|499) .*$\n                ^\\[error\\].client: .<\/em>(400|401|403|404|405|408|413|414|429|444|499).*$\n                ^\\[error\\].client: .<\/em>(request body no buffer|request line too large|client prematurely closed connection).*$\n                ^\\[error\\].client: .<\/em>(access forbidden by rule|directory index of \"\\S+\" is forbidden).*$\n    ignoreregex =<\/code><\/pre>\n
    *   \u0130lk failregex<\/code> sat\u0131r\u0131: access.log<\/code>‘da belirli HTTP metodlar\u0131 ile gelen ve 4xx hata kodu (400 Bad Request, 401 Unauthorized, 403 Forbidden, 404 Not Found, 405 Method Not Allowed, 408 Request Timeout, 413 Request Entity Too Large, 414 URI Too Long, 429 Too Many Requests, 444 No Response, 499 Client Closed Request) d\u00f6nd\u00fcren istekleri yakalar. \u00d6zellikle 404 taramalar\u0131 ve 429 (oran s\u0131n\u0131rlamas\u0131) bu regex ile yakalanabilir.
\n    *   \u0130kinci failregex<\/code> sat\u0131r\u0131: error.log<\/code>‘da 4xx hata kodlar\u0131n\u0131 i\u00e7eren genel hatalar\u0131 yakalar.
\n    *   \u00dc\u00e7\u00fcnc\u00fc failregex<\/code> sat\u0131r\u0131: error.log<\/code>‘da “request body no buffer”, “request line too large” veya “client prematurely closed connection” gibi Nginx’in k\u00f6t\u00fc bi\u00e7imlendirilmi\u015f veya a\u015f\u0131r\u0131 b\u00fcy\u00fck isteklerle kar\u015f\u0131la\u015ft\u0131\u011f\u0131n\u0131 g\u00f6steren hatalar\u0131 yakalar. Bunlar genellikle DoS veya zafiyet taramalar\u0131n\u0131n belirtisidir.
\n    *   D\u00f6rd\u00fcnc\u00fc failregex<\/code> sat\u0131r\u0131: error.log<\/code>‘da dizin listeleme veya \u00f6zel kurallarla eri\u015fimin yasakland\u0131\u011f\u0131 durumlar\u0131 yakalar, bu da zafiyet taramas\u0131 veya yetkisiz eri\u015fim denemesi olabilir.<\/p>\n
    Dosyay\u0131 kaydedip kapat\u0131n.<\/p>\n
2.  jail.local<\/code>‘a nginx-dos<\/code> Jail’i Ekleme:<\/strong>
\n    jail.local<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n ve dosyan\u0131n sonuna a\u015fa\u011f\u0131daki b\u00f6l\u00fcm\u00fc ekleyin:<\/p>\n
[nginx-dos]\n    enabled = true\n    port    = http,https\n    filter  = nginx-dos\n    logpath = \/var\/log\/nginx\/access.log \/var\/log\/nginx\/error.log\n    maxretry = 10\n    findtime = 120\n    bantime = 86400 # 24 saat engelleme<\/code><\/pre>\n
    *   logpath<\/code>: Bu jail, hem access.log<\/code> hem de error.log<\/code> dosyalar\u0131n\u0131 izleyecektir.
\n    *   maxretry = 10<\/code>: 120 saniye (2 dakika) i\u00e7inde 10 ba\u015far\u0131s\u0131z deneme.
\n    *   bantime = 86400<\/code>: Bu t\u00fcr sald\u0131r\u0131lar genellikle daha ciddi oldu\u011fundan, engelleme s\u00fcresini 24 saate \u00e7\u0131karabiliriz.<\/p>\n
Nginx Rate Limiting ve Fail2Ban Entegrasyonu<\/h3>\n
Nginx’in yerle\u015fik oran s\u0131n\u0131rlama (limit_req_zone<\/code>) \u00f6zelli\u011fi, sunucunuzu DoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korumak i\u00e7in \u00e7ok g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. Bu \u00f6zellik, belirli bir IP adresinden gelen istek say\u0131s\u0131n\u0131 s\u0131n\u0131rlar ve e\u015fik a\u015f\u0131ld\u0131\u011f\u0131nda 429 (Too Many Requests) hata kodu d\u00f6nd\u00fcr\u00fcr. Fail2Ban’\u0131, Nginx’in bu 429 hatalar\u0131n\u0131 yakalamas\u0131 ve bu istekleri g\u00f6nderen IP adreslerini engellemesi i\u00e7in yap\u0131land\u0131rabiliriz.<\/p>\n
1.  Nginx’te Oran S\u0131n\u0131rlama Yap\u0131land\u0131rmas\u0131:<\/strong>
\n    Nginx yap\u0131land\u0131rma dosyan\u0131zda (\/etc\/nginx\/nginx.conf<\/code> veya sitenizin yap\u0131land\u0131rma dosyas\u0131nda \/etc\/nginx\/sites-available\/default<\/code> gibi) http<\/code> blo\u011funun i\u00e7ine a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin:<\/p>\n
http {\n        # ... di\u011fer ayarlar ...\n\n        limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r\/s; # 10MB bellek, IP ba\u015f\u0131na saniyede 5 istek\n\n        server {\n            # ... di\u011fer ayarlar ...\n\n            location \/ {\n                limit_req zone=mylimit burst=10 nodelay; # 10 iste\u011fe kadar patlamaya izin ver, gecikme yapma\n                # ...\n            }\n        }\n    }<\/code><\/pre>\n
    Bu yap\u0131land\u0131rma, her benzersiz IP adresinden saniyede 5 iste\u011fe izin verir. E\u011fer bir IP adresi bu oran\u0131 a\u015farsa, Nginx 429 hatas\u0131 d\u00f6nd\u00fcr\u00fcr. Nginx yap\u0131land\u0131rmas\u0131n\u0131 yeniden y\u00fcklemeyi unutmay\u0131n:<\/p>\n
sudo nginx -t\n    sudo systemctl reload nginx<\/code><\/pre>\n
2.  \u00d6zel nginx-limit-req<\/code> Filtresi Olu\u015fturma:<\/strong>
\n    Bu 429 hatalar\u0131n\u0131 yakalamak i\u00e7in yeni bir Fail2Ban filtresi olu\u015fturun:<\/p>\n
sudo nano \/etc\/fail2ban\/filter.d\/nginx-limit-req.conf<\/code><\/pre>\n
    Dosyan\u0131n i\u00e7ine a\u015fa\u011f\u0131daki i\u00e7eri\u011fi yap\u0131\u015ft\u0131r\u0131n:<\/p>\n
[Definition]\n    # Fail2Ban filter for Nginx 429 (Too Many Requests) errors\n    failregex = ^ -.\"(GET|POST|HEAD|PUT|DELETE|OPTIONS|PATCH) \\S<\/em> HTTP\/\\d\\.\\d\" 429 .*$\n    ignoreregex =<\/code><\/pre>\n
    Bu filtre, access.log<\/code> dosyas\u0131nda 429 hata kodu ile biten t\u00fcm Nginx isteklerini yakalar.<\/p>\n
3.  jail.local<\/code>‘a nginx-limit-req<\/code> Jail’i Ekleme:<\/strong>
\n    jail.local<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n ve dosyan\u0131n sonuna a\u015fa\u011f\u0131daki b\u00f6l\u00fcm\u00fc ekleyin:<\/p>\n
[nginx-limit-req]\n    enabled = true\n    port    = http,https\n    filter  = nginx-limit-req\n    logpath = \/var\/log\/nginx\/access.log\n    maxretry = 5\n    findtime = 60\n    bantime = 1800 # 30 dakika engelleme<\/code><\/pre>\n
    Bu jail, Nginx’in oran s\u0131n\u0131rlamas\u0131n\u0131 tetikleyen IP’leri yakalayarak, Nginx’in kendisi taraf\u0131ndan ge\u00e7ici olarak engellenmelerine ek olarak Fail2Ban taraf\u0131ndan da engellenmelerini sa\u011flar.<\/p>\n
T\u00fcm bu de\u011fi\u015fiklikleri yapt\u0131ktan sonra, Fail2Ban servisini yeniden ba\u015flatman\u0131z gerekir:<\/p>\n
sudo systemctl restart fail2ban<\/code><\/pre>\n
Fail2Ban Filtre ve Jail Testi<\/h2>\n
Yapt\u0131\u011f\u0131n\u0131z filtrelerin ve jail’lerin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in fail2ban-regex<\/code> arac\u0131n\u0131 kullanabilirsiniz. Bu ara\u00e7, belirli bir log dosyas\u0131nda filtrenizin regex desenini test etmenizi sa\u011flar.<\/p>\n
\u00d6rne\u011fin, nginx-dos<\/code> filtrenizi test etmek i\u00e7in:<\/p>\n
sudo fail2ban-regex \/var\/log\/nginx\/access.log \/etc\/fail2ban\/filter.d\/nginx-dos.conf<\/code><\/pre>\n
Veya nginx-limit-req<\/code> filtresini test etmek i\u00e7in:<\/p>\n
sudo fail2ban-regex \/var\/log\/nginx\/access.log \/etc\/fail2ban\/filter.d\/nginx-limit-req.conf<\/code><\/pre>\n
Bu komutlar, belirtilen log dosyas\u0131nda filtrenizin ka\u00e7 tane e\u015fle\u015fme buldu\u011funu g\u00f6sterir. Test i\u00e7in ger\u00e7ek log dosyalar\u0131 yerine, sahte log giri\u015fleri i\u00e7eren bir metin dosyas\u0131 da olu\u015fturabilirsiniz:<\/p>\n
echo '192.168.1.100 - - [10\/Oct\/2023:12:00:00 +0000] \"GET \/nonexistent HTTP\/1.1\" 404 153 \"-\" \"Mozilla\/5.0\"' | sudo tee -a \/tmp\/test_nginx.log\necho '192.168.1.101 - - [10\/Oct\/2023:12:00:01 +0000] \"GET \/admin\/login HTTP\/1.1\" 401 153 \"-\" \"Mozilla\/5.0\"' | sudo tee -a \/tmp\/test_nginx.log\necho '192.168.1.102 - - [10\/Oct\/2023:12:00:02 +0000] \"GET \/api\/data HTTP\/1.1\" 429 153 \"-\" \"Mozilla\/5.0\"' | sudo tee -a \/tmp\/test_nginx.log<\/code><\/pre>\n
Ard\u0131ndan bu sahte log dosyas\u0131n\u0131 test edebilirsiniz:<\/p>\n
sudo fail2ban-regex \/tmp\/test_nginx.log \/etc\/fail2ban\/filter.d\/nginx-dos.conf\nsudo fail2ban-regex \/tmp\/test_nginx.log \/etc\/fail2ban\/filter.d\/nginx-limit-req.conf<\/code><\/pre>\n
\u00c7\u0131kt\u0131, filtrenizin ka\u00e7 IP adresini ve ka\u00e7 ba\u015far\u0131s\u0131z denemeyi yakalad\u0131\u011f\u0131n\u0131 g\u00f6stermelidir.<\/p>\n
Fail2Ban Y\u00f6netimi<\/h2>\n
Fail2Ban servisini y\u00f6netmek i\u00e7in systemctl<\/code> ve fail2ban-client<\/code> komutlar\u0131n\u0131 kullanabilirsiniz.<\/p>\n
*   Fail2Ban Servisini Yeniden Ba\u015flatma:<\/strong>
\n    Yap\u0131land\u0131rma de\u011fi\u015fikliklerinden sonra servisi yeniden ba\u015flatmak zorunludur.<\/p>\n
sudo systemctl restart fail2ban<\/code><\/pre>\n
*   Fail2Ban Servisinin Durumunu Kontrol Etme:<\/strong><\/p>\n
sudo systemctl status fail2ban<\/code><\/pre>\n
*   T\u00fcm Aktif Jail’lerin Durumunu G\u00f6r\u00fcnt\u00fcleme:<\/strong><\/p>\n
sudo fail2ban-client status<\/code><\/pre>\n
    Bu komut, hangi jail’lerin etkin oldu\u011funu ve her bir jail taraf\u0131ndan ka\u00e7 IP adresinin engellendi\u011fini g\u00f6sterir.<\/p>\n
*   Belirli Bir Jail’in Durumunu G\u00f6r\u00fcnt\u00fcleme:<\/strong>
\n    \u00d6rne\u011fin, nginx-dos<\/code> jail’inin durumunu g\u00f6rmek i\u00e7in:<\/p>\n
sudo fail2ban-client status nginx-dos<\/code><\/pre>\n
    Bu komut, o jail taraf\u0131ndan engellenen IP adreslerinin listesini g\u00f6sterir.<\/p>\n
*   Bir IP Adresinin Engelini Kald\u0131rma:<\/strong>
\n    Yanl\u0131\u015fl\u0131kla engellenen bir IP adresinin engelini kald\u0131rmak i\u00e7in:<\/p>\n
sudo fail2ban-client unban <\/code><\/pre>\n
    \u00d6rne\u011fin:<\/p>\n
sudo fail2ban-client unban 203.0.113.42<\/code><\/pre>\n
    Bu komut, IP adresini t\u00fcm jail’lerden kald\u0131r\u0131r. Belirli bir jail’den kald\u0131rmak i\u00e7in:<\/p>\n
sudo fail2ban-client set  unbanip <\/code><\/pre>\n
    \u00d6rne\u011fin:<\/p>\n
sudo fail2ban-client set nginx-dos unbanip 203.0.113.42<\/code><\/pre>\n
*   Bir IP Adresini Manuel Olarak Engelleme:<\/strong>
\n    Belirli bir IP adresini manuel olarak engellemek i\u00e7in:<\/p>\n
sudo fail2ban-client set  banip <\/code><\/pre>\n
Nginx ve Genel Sunucu G\u00fcvenli\u011fi \u0130\u00e7in Ek \u0130pu\u00e7lar\u0131<\/h2>\n
Fail2Ban, Nginx sunucunuzu otomatik sald\u0131r\u0131lara kar\u015f\u0131 korumak i\u00e7in m\u00fckemmel bir ara\u00e7 olsa da, kapsaml\u0131 bir g\u00fcvenlik stratejisinin yaln\u0131zca bir par\u00e7as\u0131d\u0131r. Ek g\u00fcvenlik \u00f6nlemleri alarak sunucunuzun genel g\u00fcvenli\u011fini daha da art\u0131rabilirsiniz:<\/p>\n
*   Nginx Yap\u0131land\u0131rma G\u00fcvenli\u011fi:<\/strong>
\n    *   TLS\/SSL Kullan\u0131m\u0131:<\/strong> T\u00fcm hassas ileti\u015fimleri \u015fifrelemek i\u00e7in HTTPS kullan\u0131n. Let’s Encrypt gibi hizmetlerle \u00fccretsiz sertifikalar alabilirsiniz.
\n    *   G\u00fcvenlik Ba\u015fl\u0131klar\u0131:<\/strong> HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), X-Content-Type-Options, X-Frame-Options gibi g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 uygulay\u0131n.
\n    *   Gereksiz Mod\u00fclleri Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> Kullanmad\u0131\u011f\u0131n\u0131z Nginx mod\u00fcllerini devre d\u0131\u015f\u0131 b\u0131rak\u0131n.
\n    *   Sunucu Bilgisini Gizleme:<\/strong> Nginx s\u00fcr\u00fcm numaras\u0131n\u0131 HTTP yan\u0131t ba\u015fl\u0131klar\u0131ndan (server_tokens off;<\/code>) gizleyin.
\n    *   Dizin Listelemeyi Kapatma:<\/strong> autoindex off;<\/code> direktifi ile dizin listelemeyi engelleyin.
\n    *   En D\u00fc\u015f\u00fck Ayr\u0131cal\u0131k Prensibi:<\/strong> Nginx’i www-data<\/code> gibi ayr\u0131cal\u0131ks\u0131z bir kullan\u0131c\u0131 ile \u00e7al\u0131\u015ft\u0131r\u0131n.<\/p>\n
*   G\u00fcvenlik Duvar\u0131 (UFW) Kullan\u0131m\u0131:<\/strong>
\n    Ubuntu’nun yerle\u015fik g\u00fcvenlik duvar\u0131 olan UFW (Uncomplicated Firewall) ile sunucunuza gelen ve giden trafi\u011fi kontrol edin. Yaln\u0131zca gerekli portlar\u0131 (\u00f6rne\u011fin, 22 SSH, 80 HTTP, 443 HTTPS) a\u00e7\u0131n.<\/p>\n
sudo ufw allow OpenSSH\n    sudo ufw allow 'Nginx Full' # 80 ve 443 portlar\u0131n\u0131 a\u00e7ar\n    sudo ufw enable<\/code><\/pre>\n
*   SSH G\u00fcvenli\u011fi:<\/strong>
\n    *   Anahtar Tabanl\u0131 Kimlik Do\u011frulama:<\/strong> \u015eifre yerine SSH anahtarlar\u0131 kullanarak g\u00fcvenli\u011fi art\u0131r\u0131n.
\n    *   Varsay\u0131lan Portu De\u011fi\u015ftirme:<\/strong> SSH varsay\u0131lan portu olan 22’yi ba\u015fka bir porta de\u011fi\u015ftirin.
\n    *   Root Giri\u015fini Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> PermitRootLogin no<\/code> ayar\u0131 ile root kullan\u0131c\u0131s\u0131n\u0131n do\u011frudan SSH ile giri\u015f yapmas\u0131n\u0131 engelleyin.
\n    *   Fail2Ban SSH Jail:<\/strong> Fail2Ban’\u0131n varsay\u0131lan sshd<\/code> jail’ini etkinle\u015ftirerek SSH brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flay\u0131n. jail.local<\/code> dosyas\u0131nda [sshd]<\/code> b\u00f6l\u00fcm\u00fcn\u00fc enabled = true<\/code> olarak ayarlay\u0131n.<\/p>\n
*   D\u00fczenli G\u00fcncellemeler:<\/strong>
\n    \u0130\u015fletim sistemi ve t\u00fcm yaz\u0131l\u0131mlar\u0131 (Nginx, Fail2Ban vb.) d\u00fczenli olarak g\u00fcncelleyerek bilinen zafiyetlere kar\u015f\u0131 korunun.<\/p>\n
sudo apt update && sudo apt upgrade -y<\/code><\/pre>\n
*   Log \u0130zleme ve SIEM \u00c7\u00f6z\u00fcmleri:<\/strong>
\n    Fail2Ban loglar\u0131n\u0131 (\/var\/log\/fail2ban.log<\/code>) ve Nginx loglar\u0131n\u0131 d\u00fczenli olarak inceleyin. Daha b\u00fcy\u00fck altyap\u0131lar i\u00e7in, loglar\u0131 merkezi bir SIEM (Security Information and Event Management) \u00e7\u00f6z\u00fcm\u00fcne g\u00f6ndermek, g\u00fcvenlik olaylar\u0131n\u0131 daha etkin bir \u015fekilde izlemenizi ve analiz etmenizi sa\u011flar.<\/p>\n
*   Web Uygulama G\u00fcvenlik Duvar\u0131 (WAF):<\/strong>
\n    ModSecurity gibi bir WAF \u00e7\u00f6z\u00fcm\u00fc, Nginx’in \u00f6n\u00fcne ge\u00e7erek web uygulamas\u0131 katman\u0131ndaki SQL enjeksiyonu, XSS gibi sald\u0131r\u0131lar\u0131 tespit edip engelleyebilir. Fail2Ban, a\u011f katman\u0131ndaki sald\u0131r\u0131lar\u0131 engellerken, WAF uygulama katman\u0131ndaki tehditlere odaklan\u0131r.<\/p>\n
Sorun Giderme<\/h2>\n
Fail2Ban’\u0131n d\u00fczg\u00fcn \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 d\u00fc\u015f\u00fcn\u00fcyorsan\u0131z, a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyebilirsiniz:<\/p>\n
*   Fail2Ban Loglar\u0131n\u0131 Kontrol Etme:<\/strong>
\n    Fail2Ban’\u0131n kendi log dosyas\u0131 \/var\/log\/fail2ban.log<\/code>‘u inceleyerek hatalar\u0131 veya engelleme olaylar\u0131n\u0131 kontrol edin.<\/p>\n
sudo tail -f \/var\/log\/fail2ban.log<\/code><\/pre>\n
*   Filtrelerin Do\u011fru \u00c7al\u0131\u015ft\u0131\u011f\u0131n\u0131 Do\u011frulama:<\/strong>
\n    fail2ban-regex<\/code> arac\u0131n\u0131 kullanarak filtrelerinizin log dosyalar\u0131n\u0131zdaki desenleri do\u011fru bir \u015fekilde e\u015fle\u015ftirdi\u011finden emin olun.
\n*   Jail’lerin Etkin Olup Olmad\u0131\u011f\u0131n\u0131 Kontrol Etme:<\/strong>
\n    sudo fail2ban-client status<\/code> komutu ile t\u00fcm jail’lerin etkin oldu\u011funu ve do\u011fru log dosyalar\u0131n\u0131 izledi\u011fini do\u011frulay\u0131n.
\n*   Nginx Log Dosyalar\u0131n\u0131 Kontrol Etme:<\/strong>
\n    Nginx’in log dosyalar\u0131n\u0131n (\/var\/log\/nginx\/access.log<\/code>, \/var\/log\/nginx\/error.log<\/code>) do\u011fru izinlere sahip oldu\u011fundan ve Fail2Ban kullan\u0131c\u0131s\u0131n\u0131n bu dosyalara eri\u015febildi\u011finden emin olun.
\n*   IPTables Kurallar\u0131n\u0131 Kontrol Etme:<\/strong>
\n    Engellenen IP’lerin g\u00fcvenlik duvar\u0131 kurallar\u0131na do\u011fru bir \u015fekilde eklendi\u011fini kontrol edin:<\/p>\n
sudo iptables -L -n<\/code><\/pre>\n
    Fail2Ban, f2b-<\/code> \u00f6nekine sahip zincirler olu\u015fturur.<\/p>\n
Sonu\u00e7<\/h2>\n
Nginx sunucunuzu Fail2Ban ile korumak, siber sald\u0131r\u0131lara kar\u015f\u0131 ilk ve en \u00f6nemli savunma hatlar\u0131ndan birini olu\u015fturur. Bu makalede, Fail2Ban’\u0131 Ubuntu 22.04 \u00fczerine kurmay\u0131, temel ayarlar\u0131n\u0131 yap\u0131land\u0131rmay\u0131 ve Nginx’in HTTP kimlik do\u011frulama, DoS\/DDoS denemeleri ve oran s\u0131n\u0131rlama hatalar\u0131 gibi \u00e7e\u015fitli sald\u0131r\u0131 t\u00fcrlerine kar\u015f\u0131 nas\u0131l koruma sa\u011flayaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m \u00f6\u011frendiniz. \u00d6zel filtreler olu\u015fturarak ve Nginx’in log dosyalar\u0131n\u0131 etkin bir \u015fekilde kullanarak, sunucunuzun g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rabilirsiniz.<\/p>\n
Ancak, unutulmamal\u0131d\u0131r ki g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir. Fail2Ban g\u00fc\u00e7l\u00fc bir ara\u00e7 olsa da, tek ba\u015f\u0131na yeterli de\u011fildir. Nginx yap\u0131land\u0131rma g\u00fcvenli\u011fi, UFW gibi bir g\u00fcvenlik duvar\u0131, SSH g\u00fcvenli\u011fi, d\u00fczenli g\u00fcncellemeler ve log izleme gibi ek \u00f6nlemlerle birle\u015ftirildi\u011finde, sunucunuz \u00e7ok daha sa\u011flam bir g\u00fcvenlik duru\u015funa sahip olacakt\u0131r. Bu ad\u0131mlar\u0131 uygulayarak, Nginx tabanl\u0131 web hizmetlerinizin kesintisiz ve g\u00fcvenli bir \u015fekilde \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flayabilirsiniz.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?\nNginx, g\u00fcn\u00fcm\u00fcz\u00fcn en pop\u00fcler ve g\u00fc\u00e7l\u00fc a\u00e7\u0131k kaynakl\u0131 web sunucular\u0131","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-32228","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nNginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?\" \/>\n<meta property=\"og:description\" content=\"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz? Nginx, g\u00fcn\u00fcm\u00fcz\u00fcn en pop\u00fcler ve g\u00fc\u00e7l\u00fc a\u00e7\u0131k kaynakl\u0131 web sunucular\u0131\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-19T04:41:05+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?\",\"datePublished\":\"2025-10-19T04:41:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\"},\"wordCount\":3087,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\",\"name\":\"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-19T04:41:05+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/","og_locale":"tr_TR","og_type":"article","og_title":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?","og_description":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz? Nginx, g\u00fcn\u00fcm\u00fcz\u00fcn en pop\u00fcler ve g\u00fc\u00e7l\u00fc a\u00e7\u0131k kaynakl\u0131 web sunucular\u0131","og_url":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-19T04:41:05+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"19 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?","datePublished":"2025-10-19T04:41:05+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/"},"wordCount":3087,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/","url":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/","name":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-19T04:41:05+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/nginx-sunucunuzu-fail2ban-ile-ubuntu-22-04-uzerinde-nasil-korursunuz\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Nginx Sunucunuzu Fail2Ban ile Ubuntu 22.04 \u00dczerinde Nas\u0131l Korursunuz?"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/32228","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=32228"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/32228\/revisions"}],"predecessor-version":[{"id":32229,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/32228\/revisions\/32229"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=32228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=32228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=32228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}