{"id":32643,"date":"2025-10-24T06:41:18","date_gmt":"2025-10-24T03:41:18","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=32643"},"modified":"2025-10-24T06:41:18","modified_gmt":"2025-10-24T03:41:18","slug":"ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/","title":{"rendered":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?"},"content":{"rendered":"

<\/p>\n

Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?<\/h2>\n

Giri\u015f: \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama Neden \u00d6nemli?<\/h3>\n

G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda siber g\u00fcvenlik tehditleri her ge\u00e7en g\u00fcn artmakta ve daha karma\u015f\u0131k hale gelmektedir. Sunucular, ki\u015fisel veriler ve kritik i\u015f s\u00fcre\u00e7leri i\u00e7in merkezi depolama alanlar\u0131 olarak hizmet verdi\u011finden, bu sistemlerin g\u00fcvenli\u011fi b\u00fcy\u00fck \u00f6nem ta\u015f\u0131r. Geleneksel olarak, bir sisteme eri\u015fim genellikle tek bir fakt\u00f6r olan kullan\u0131c\u0131 ad\u0131 ve parola kombinasyonu ile sa\u011flan\u0131r. Ancak, parolalar\u0131n \u00e7al\u0131nmas\u0131, tahmin edilmesi veya zay\u0131f parola politikalar\u0131 nedeniyle bu tek fakt\u00f6rl\u00fc kimlik do\u011frulama y\u00f6ntemi ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131 bar\u0131nd\u0131r\u0131r. \u0130\u015fte bu noktada \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) devreye girer.<\/p>\n

MFA, bir kullan\u0131c\u0131n\u0131n kimli\u011fini do\u011frulamak i\u00e7in iki veya daha fazla ba\u011f\u0131ms\u0131z kimlik do\u011frulama fakt\u00f6r\u00fcn\u00fcn kullan\u0131lmas\u0131n\u0131 gerektiren bir g\u00fcvenlik mekanizmas\u0131d\u0131r. Bu fakt\u00f6rler genellikle \u00fc\u00e7 kategoriye ayr\u0131l\u0131r:<\/p>\n

1. Bildikleriniz (Something you know):<\/strong> Parola, PIN kodu, g\u00fcvenlik sorusu yan\u0131t\u0131 gibi bilgiler.
\n2. Sahip Olduklar\u0131n\u0131z (Something you have):<\/strong> Ak\u0131ll\u0131 telefon, donan\u0131m token’\u0131, ak\u0131ll\u0131 kart gibi fiziksel cihazlar.
\n3. Oldu\u011funuz \u015eeyler (Something you are):<\/strong> Parmak izi, y\u00fcz tan\u0131ma, retina taramas\u0131 gibi biyometrik veriler.<\/p>\n

MFA uyguland\u0131\u011f\u0131nda, bir sald\u0131rgan\u0131n sadece parolay\u0131 ele ge\u00e7irmesi sisteme eri\u015fim i\u00e7in yeterli olmaz. Sald\u0131rgan\u0131n ayn\u0131 zamanda ikinci bir fakt\u00f6r\u00fc de (\u00f6rne\u011fin, kullan\u0131c\u0131n\u0131n telefonunu) ele ge\u00e7irmesi gerekir ki bu da sald\u0131r\u0131 y\u00fczeyini \u00f6nemli \u00f6l\u00e7\u00fcde daralt\u0131r ve yetkisiz eri\u015fim riskini minimize eder. \u00d6zellikle Ubuntu gibi sunucu i\u015fletim sistemlerinde, SSH (Secure Shell) eri\u015fiminin MFA ile g\u00fc\u00e7lendirilmesi, sunucunun g\u00fcvenli\u011fini kritik d\u00fczeyde art\u0131r\u0131r. Bu makalede, Ubuntu 18.04 LTS \u00fczerinde Google Authenticator PAM (Tak\u0131labilir Kimlik Do\u011frulama Mod\u00fclleri) mod\u00fcl\u00fc kullanarak SSH eri\u015fimi i\u00e7in MFA’y\u0131 nas\u0131l yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayaca\u011f\u0131z. Bu sayede, sunucular\u0131n\u0131za yetkisiz eri\u015fimi engellemek i\u00e7in g\u00fc\u00e7l\u00fc bir savunma katman\u0131 olu\u015fturmu\u015f olacaks\u0131n\u0131z.<\/p>\n

MFA \u0130\u00e7in \u00d6nko\u015fullar ve Haz\u0131rl\u0131klar<\/h3>\n

MFA yap\u0131land\u0131rmas\u0131na ba\u015flamadan \u00f6nce, sorunsuz bir kurulum s\u00fcreci i\u00e7in baz\u0131 \u00f6nko\u015fullar\u0131n ve haz\u0131rl\u0131klar\u0131n tamamland\u0131\u011f\u0131ndan emin olman\u0131z gerekmektedir.<\/p>\n

Ubuntu 18.04 Sunucusu<\/h4>\n

* \u00dczerinde \u00e7al\u0131\u015faca\u011f\u0131n\u0131z bir Ubuntu 18.04 LTS (Long Term Support) sunucusuna sahip olmal\u0131s\u0131n\u0131z. Bu rehber \u00f6zellikle 18.04 i\u00e7in yaz\u0131lm\u0131\u015f olsa da, ad\u0131mlar genellikle Ubuntu’nun daha yeni s\u00fcr\u00fcmleri (20.04, 22.04) i\u00e7in de benzerlik g\u00f6sterir.<\/p>\n

SSH Eri\u015fimi<\/h4>\n

* Sunucunuza SSH \u00fczerinden eri\u015fiminizin olmas\u0131 gerekmektedir. Bu, yap\u0131land\u0131rma ad\u0131mlar\u0131n\u0131 uzaktan uygulaman\u0131z\u0131 sa\u011flayacakt\u0131r.
\n* \u00d6nemli Not:<\/strong> MFA yap\u0131land\u0131rmas\u0131n\u0131 yaparken, mevcut SSH oturumunuzu asla kapatmay\u0131n. Herhangi bir yanl\u0131\u015f yap\u0131land\u0131rma durumunda, mevcut oturumunuz \u00fczerinden d\u00fczeltme yapma imkan\u0131n\u0131z olacakt\u0131r. Yeni bir terminal penceresi a\u00e7arak test etmeniz \u015fiddetle tavsiye edilir.<\/p>\n

Y\u00f6netici (sudo) Yetkileri<\/h4>\n

* Yap\u0131land\u0131rma ad\u0131mlar\u0131n\u0131 ger\u00e7ekle\u015ftirmek i\u00e7in sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 hesab\u0131n\u0131z\u0131n olmas\u0131 gerekmektedir. \u00c7o\u011fu sunucu kurulumunda bu varsay\u0131lan olarak mevcuttur.<\/p>\n

G\u00fcncel Sistem<\/h4>\n

* Sisteminizin g\u00fcncel oldu\u011fundan emin olun. Bu, herhangi bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 kapat\u0131r ve paket ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131n do\u011fru \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar.<\/p>\n

sudo apt update\n    sudo apt upgrade -y\n    sudo apt autoremove -y<\/code><\/pre>\n
Google Authenticator (PAM Mod\u00fcl\u00fc)<\/h4>\n
*   Bu rehberde, zaman tabanl\u0131 tek kullan\u0131ml\u0131k \u015fifreler (TOTP) olu\u015fturan Google Authenticator PAM mod\u00fcl\u00fcn\u00fc kullanaca\u011f\u0131z. Bu mod\u00fcl, Ubuntu’nun standart depolar\u0131nda mevcuttur.<\/p>\n
Zaman Senkronizasyonu<\/h4>\n
*   MFA’n\u0131n zaman tabanl\u0131 token’larla (TOTP) do\u011fru \u00e7al\u0131\u015fabilmesi i\u00e7in sunucunuzun ve mobil cihaz\u0131n\u0131z\u0131n zaman\u0131n\u0131n do\u011fru bir \u015fekilde senkronize edilmi\u015f olmas\u0131 kritik \u00f6neme sahiptir. K\u00fc\u00e7\u00fck zaman farkl\u0131l\u0131klar\u0131 bile kimlik do\u011frulama hatalar\u0131na yol a\u00e7abilir.
\n    *   Ubuntu’da zaman senkronizasyonu i\u00e7in ntp<\/code> veya systemd-timesyncd<\/code> kullan\u0131labilir. Ubuntu 18.04 varsay\u0131lan olarak systemd-timesyncd<\/code> kullan\u0131r. Do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in:<\/p>\n
timedatectl status<\/code><\/pre>\n
        E\u011fer NTP synchronized: yes<\/code> ve System clock synchronized: yes<\/code> g\u00f6r\u00fcyorsan\u0131z, zaman senkronizasyonunuz do\u011fru \u00e7al\u0131\u015f\u0131yor demektir. De\u011filse, sudo timedatectl set-ntp true<\/code> komutu ile etkinle\u015ftirebilirsiniz.<\/p>\n
Bu haz\u0131rl\u0131k ad\u0131mlar\u0131n\u0131 tamamlad\u0131ktan sonra, \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama yap\u0131land\u0131rmas\u0131na ge\u00e7meye haz\u0131r\u0131z.<\/p>\n
Google Authenticator PAM Mod\u00fcl\u00fcn\u00fcn Kurulumu<\/h3>\n
MFA’y\u0131 Ubuntu sunucumuzda etkinle\u015ftirmek i\u00e7in ilk ad\u0131m, gerekli PAM mod\u00fcl\u00fcn\u00fc kurmakt\u0131r. Google Authenticator, Linux sistemlerinde yayg\u0131n olarak kullan\u0131lan ve g\u00fcvenilir bir \u00e7\u00f6z\u00fcmd\u00fcr.<\/p>\n
Gerekli Paketlerin Y\u00fcklenmesi<\/h4>\n
Google Authenticator PAM mod\u00fcl\u00fc, libpam-google-authenticator<\/code> paketi i\u00e7inde yer al\u0131r. Bu paketi y\u00fcklemek i\u00e7in a\u015fa\u011f\u0131daki komutu kullan\u0131n:<\/p>\n
sudo apt install libpam-google-authenticator -y<\/code><\/pre>\n
Bu komut, paketi ve ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 sisteminize kuracakt\u0131r. Kurulum tamamland\u0131ktan sonra, mod\u00fcl art\u0131k PAM \u00e7er\u00e7evesi taraf\u0131ndan kullan\u0131labilir hale gelecektir.<\/p>\n
Kullan\u0131c\u0131 Baz\u0131nda MFA Yap\u0131land\u0131rmas\u0131<\/h3>\n
libpam-google-authenticator<\/code> mod\u00fcl\u00fc y\u00fcklendikten sonra, her bir kullan\u0131c\u0131 i\u00e7in ayr\u0131 ayr\u0131 MFA yap\u0131land\u0131rmas\u0131 yap\u0131lmas\u0131 gerekmektedir. Bu ad\u0131m\u0131, MFA ile korunmas\u0131n\u0131 istedi\u011finiz her kullan\u0131c\u0131 i\u00e7in kendi kullan\u0131c\u0131 hesab\u0131nda ger\u00e7ekle\u015ftirmeniz \u00f6nemlidir.<\/p>\n
\u00d6rnek olarak, kullaniciadi<\/code> isimli bir kullan\u0131c\u0131 i\u00e7in MFA yap\u0131land\u0131rmas\u0131 yapal\u0131m. \u00d6ncelikle, kullaniciadi<\/code> olarak sunucuya SSH ile ba\u011flan\u0131n veya mevcut oturumunuzda bu kullan\u0131c\u0131ya ge\u00e7i\u015f yap\u0131n (su - kullaniciadi<\/code>).<\/p>\n
google-authenticator<\/code><\/pre>\n
Bu komutu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda, size bir dizi soru sorulacak ve MFA yap\u0131land\u0131rma s\u00fcreci ba\u015flayacakt\u0131r. Sorular ve \u00f6nerilen yan\u0131tlar\u0131 a\u015fa\u011f\u0131da a\u00e7\u0131klanm\u0131\u015ft\u0131r:<\/p>\n
1.  Do you want authentication tokens to be time-based (y\/n)?<\/strong>
\n    *   Yan\u0131t: y<\/code> (Evet)<\/strong>
\n    *   A\u00e7\u0131klama:<\/strong> Bu, zaman tabanl\u0131 tek kullan\u0131ml\u0131k \u015fifreler (TOTP) kullanaca\u011f\u0131m\u0131z anlam\u0131na gelir. Mobil cihaz\u0131n\u0131zdaki Google Authenticator uygulamas\u0131 her 30 saniyede bir yeni bir kod \u00fcretecektir. Bu, en yayg\u0131n ve g\u00fcvenli MFA y\u00f6ntemidir.<\/p>\n
2.  Bu ad\u0131mdan sonra, terminalinizde bir QR kodu, “secret key” (gizli anahtar) ve be\u015f adet “emergency scratch codes” (acil durum kurtarma kodlar\u0131) g\u00f6r\u00fcnt\u00fclenecektir.
\n    *   QR Kod:<\/strong> Bu kodu, mobil cihaz\u0131n\u0131zdaki Google Authenticator, Authy veya Microsoft Authenticator gibi bir uygulama ile taraman\u0131z gerekecektir. Uygulama, bu gizli anahtar\u0131 kullanarak zaman tabanl\u0131 kodlar \u00fcretmeye ba\u015flayacakt\u0131r.
\n    *   Secret Key:<\/strong> QR kodunu tarayam\u0131yorsan\u0131z veya manuel ekleme yapman\u0131z gerekiyorsa bu anahtar\u0131 kullanabilirsiniz. Uygulamaya manuel olarak girerek de MFA’y\u0131 etkinle\u015ftirebilirsiniz.
\n    *   Emergency Scratch Codes:<\/strong> Bu kodlar, mobil cihaz\u0131n\u0131z\u0131 kaybetti\u011finizde veya MFA kodlar\u0131na eri\u015femedi\u011finizde sisteme giri\u015f yapman\u0131z\u0131 sa\u011flayan tek kullan\u0131ml\u0131k yedek kodlard\u0131r. Bu kodlar\u0131 \u00e7ok g\u00fcvenli bir yerde saklay\u0131n ve kimseyle payla\u015fmay\u0131n.<\/strong> Her kod bir kez kullan\u0131labilir.<\/p>\n
3.  Do you want to update the “\/home\/kullaniciadi\/.google_authenticator” file (y\/n)?<\/strong>
\n    *   Yan\u0131t: y<\/code> (Evet)<\/strong>
\n    *   A\u00e7\u0131klama:<\/strong> Bu, google-authenticator<\/code> komutunun olu\u015fturdu\u011fu gizli anahtar\u0131 ve di\u011fer yap\u0131land\u0131rma bilgilerini kullan\u0131c\u0131n\u0131n ev dizinindeki .google_authenticator<\/code> dosyas\u0131na kaydetmesini sa\u011flar. Bu dosya, PAM mod\u00fcl\u00fc taraf\u0131ndan kimlik do\u011frulama s\u0131ras\u0131nda kullan\u0131lacakt\u0131r. Dosyan\u0131n izinleri otomatik olarak 0400<\/code> olarak ayarlan\u0131r, yani sadece kullan\u0131c\u0131 taraf\u0131ndan okunabilir. Bu, g\u00fcvenli\u011fi sa\u011flamak i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n
4.  Do you want to disallow multiple uses of the same authentication token? This restricts a token to a single use. (y\/n)?<\/strong>
\n    *   Yan\u0131t: y<\/code> (Evet)<\/strong>
\n    *   A\u00e7\u0131klama:<\/strong> Bu se\u00e7enek, bir token’\u0131n (do\u011frulama kodunun) yaln\u0131zca bir kez kullan\u0131lmas\u0131n\u0131 sa\u011flar. Bu, “replay attack” ad\u0131 verilen sald\u0131r\u0131lar\u0131 \u00f6nlemeye yard\u0131mc\u0131 olur. Bir sald\u0131rgan ge\u00e7erli bir kodu ele ge\u00e7irse bile, o kod bir kez kullan\u0131ld\u0131ktan sonra tekrar kullan\u0131lamayaca\u011f\u0131 i\u00e7in eri\u015fim sa\u011flayamaz.<\/p>\n
5.  By default, tokens are good for 30 seconds. In order to compensate for possible time-sync problems between and the server, we allow an extra token before and after the current time. This allows for a total of 3 tokens (90 seconds) to be valid at any given time. Do you want to expand the window of time in which a token is accepted to approximately 4 minutes (y\/n)?<\/strong>
\n    *   Yan\u0131t: n<\/code> (Hay\u0131r)<\/strong>
\n    *   A\u00e7\u0131klama:<\/strong> Bu se\u00e7enek, token’\u0131n ge\u00e7erlilik s\u00fcresini art\u0131r\u0131r. Varsay\u0131lan olarak, bir token ge\u00e7erli zamandan 30 saniye \u00f6nce ve 30 saniye sonra da ge\u00e7erli kabul edilir (toplam 90 saniye). Bu pencereyi 4 dakikaya \u00e7\u0131karmak, zaman senkronizasyonu sorunlar\u0131n\u0131 telafi edebilir ancak g\u00fcvenlik seviyesini bir miktar d\u00fc\u015f\u00fcrebilir. Zaman senkronizasyonunuzun do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan eminseniz (timedatectl status<\/code> kontrol\u00fc), n<\/code> yan\u0131t\u0131n\u0131 vermek daha g\u00fcvenlidir.<\/p>\n
6.  Do you want to enable rate-limiting for the authentication module? By default, this limits attackers to 3 login attempts every 30s. (y\/n)?<\/strong>
\n    *   Yan\u0131t: y<\/code> (Evet)<\/strong>
\n    *   A\u00e7\u0131klama:<\/strong> Bu se\u00e7enek, bir kimlik do\u011frulama mod\u00fcl\u00fcne yap\u0131lan deneme say\u0131s\u0131n\u0131 s\u0131n\u0131rlar. Varsay\u0131lan olarak, 30 saniye i\u00e7inde en fazla 3 denemeye izin verilir. Bu, kaba kuvvet sald\u0131r\u0131lar\u0131na (brute-force attacks) kar\u015f\u0131 ek bir koruma sa\u011flar ve sald\u0131rgan\u0131n \u00e7ok say\u0131da kodu h\u0131zl\u0131 bir \u015fekilde denemesini engeller.<\/p>\n
Bu ad\u0131mlar\u0131 tamamlad\u0131ktan sonra, kullan\u0131c\u0131n\u0131n ev dizininde .google_authenticator<\/code> dosyas\u0131 olu\u015fturulacak ve mobil cihaz\u0131n\u0131zda bu kullan\u0131c\u0131 i\u00e7in MFA etkinle\u015ftirilmi\u015f olacakt\u0131r. Bu ad\u0131m\u0131, MFA ile korunmas\u0131n\u0131 istedi\u011finiz her kullan\u0131c\u0131 i\u00e7in tekrarlaman\u0131z gerekti\u011fini unutmay\u0131n.<\/p>\n
PAM Yap\u0131land\u0131rmas\u0131n\u0131n D\u00fczenlenmesi<\/h3>\n
Kullan\u0131c\u0131 baz\u0131nda MFA yap\u0131land\u0131rmas\u0131 tamamland\u0131ktan sonra, sistemin PAM (Tak\u0131labilir Kimlik Do\u011frulama Mod\u00fclleri) yap\u0131land\u0131rmas\u0131n\u0131 d\u00fczenlememiz gerekmektedir. Bu, SSH servisine ba\u011flanmaya \u00e7al\u0131\u015f\u0131ld\u0131\u011f\u0131nda Google Authenticator mod\u00fcl\u00fcn\u00fcn devreye girmesini sa\u011flayacakt\u0131r.<\/p>\n
PAM yap\u0131land\u0131rma dosyalar\u0131 \/etc\/pam.d\/<\/code> dizininde bulunur. SSH i\u00e7in yap\u0131land\u0131rma dosyas\u0131 \/etc\/pam.d\/sshd<\/code>‘dir.<\/p>\n
\/etc\/pam.d\/sshd<\/code> Dosyas\u0131n\u0131n D\u00fczenlenmesi<\/h4>\n
Bu dosyan\u0131n bir yede\u011fini alarak i\u015fe ba\u015flaman\u0131z \u015fiddetle tavsiye edilir.<\/p>\n
sudo cp \/etc\/pam.d\/sshd \/etc\/pam.d\/sshd.bak\nsudo nano \/etc\/pam.d\/sshd<\/code><\/pre>\n
Dosyay\u0131 a\u00e7t\u0131ktan sonra, a\u015fa\u011f\u0131daki sat\u0131r\u0131 dosyan\u0131n en \u00fcst\u00fcne veya auth required pam_unix.so<\/code> sat\u0131r\u0131ndan hemen \u00f6nce eklemeniz gerekmektedir:<\/p>\n
auth required pam_google_authenticator.so<\/code><\/pre>\n
Bu sat\u0131r\u0131n eklenmesiyle dosyan\u0131z\u0131n i\u00e7eri\u011fi yakla\u015f\u0131k olarak \u015f\u00f6yle g\u00f6r\u00fcnecektir (yorum sat\u0131rlar\u0131 ve di\u011fer mod\u00fcller farkl\u0131l\u0131k g\u00f6sterebilir):<\/p>\n
# \/etc\/pam.d\/sshd: The PAM configuration file for the OpenSSH daemon.\n
# This file is installed by the openssh-server package. Please<\/h2>\n
remember that this file is System V style, and you should avoid<\/h2>\n
adding any local stuff in it. For a more flexible approach,<\/h2>\n
please use pam.d\/sshd-wrapper or pam.d\/sshd-local.<\/h2>\n
@include common-auth<\/h2>\nauth required pam_google_authenticator.so   # Bu sat\u0131r\u0131 ekleyin\n@include common-account\n@include common-session\n@include common-password<\/code><\/pre>\n
A\u00e7\u0131klama:<\/strong><\/p>\n
*   auth<\/code>: Bu bir kimlik do\u011frulama mod\u00fcl\u00fcd\u00fcr.
\n*   required<\/code>: Bu mod\u00fcl\u00fcn ba\u015far\u0131l\u0131 bir \u015fekilde tamamlanmas\u0131 gerekti\u011fini belirtir. E\u011fer pam_google_authenticator.so<\/code> ba\u015far\u0131s\u0131z olursa (\u00f6rne\u011fin yanl\u0131\u015f kod girilmesi), kimlik do\u011frulama i\u015flemi hemen durdurulur ve ba\u015far\u0131s\u0131z kabul edilir.
\n*   pam_google_authenticator.so<\/code>: Y\u00fckledi\u011fimiz Google Authenticator PAM mod\u00fcl\u00fcd\u00fcr.<\/p>\n
Opsiyonel: nullok<\/code> Se\u00e7ene\u011fi<\/strong><\/p>\n
E\u011fer baz\u0131 kullan\u0131c\u0131lar\u0131n MFA kullanmas\u0131n\u0131 zorunlu k\u0131lmak istemiyor ve MFA yap\u0131land\u0131rmas\u0131 yapmam\u0131\u015f kullan\u0131c\u0131lar\u0131n yine de parola ile giri\u015f yapabilmesini istiyorsan\u0131z, nullok<\/code> se\u00e7ene\u011fini kullanabilirsiniz:<\/p>\n
auth required pam_google_authenticator.so nullok<\/code><\/pre>\n
*   nullok<\/code>: Bu se\u00e7enek, kullan\u0131c\u0131n\u0131n .google_authenticator<\/code> dosyas\u0131 yoksa veya bo\u015fsa, bu mod\u00fcl\u00fcn ba\u015far\u0131l\u0131 kabul edilmesini sa\u011flar. Yani, MFA yap\u0131land\u0131rmas\u0131 yapmam\u0131\u015f kullan\u0131c\u0131lar sadece parola ile giri\u015f yapabilir. Ancak, bu durum g\u00fcvenlik seviyesini d\u00fc\u015f\u00fcr\u00fcr ve genellikle t\u00fcm kullan\u0131c\u0131lar i\u00e7in MFA’n\u0131n zorunlu tutulmas\u0131 tavsiye edilir. E\u011fer t\u00fcm kullan\u0131c\u0131lar i\u00e7in MFA’y\u0131 zorunlu k\u0131lacaksan\u0131z, nullok<\/code> kullanmay\u0131n. Bu rehberde zorunlu MFA yakla\u015f\u0131m\u0131n\u0131 benimsiyoruz, bu y\u00fczden nullok<\/code> kullanm\u0131yoruz.<\/p>\n
De\u011fi\u015fiklikleri kaydedin ve dosyay\u0131 kapat\u0131n (Ctrl+O<\/code>, Enter<\/code>, Ctrl+X<\/code>).<\/p>\n
\/etc\/pam.d\/common-auth<\/code> Dosyas\u0131n\u0131n D\u00fczenlenmesi (Daha Genel Bir Yakla\u015f\u0131m)<\/h4>\n
Baz\u0131 durumlarda, sshd<\/code> yerine common-auth<\/code> dosyas\u0131n\u0131 d\u00fczenlemek daha genel bir yakla\u015f\u0131m olabilir. common-auth<\/code> dosyas\u0131, bir\u00e7ok servisin (SSH, su, login vb.) ortak kimlik do\u011frulama ayarlar\u0131n\u0131 i\u00e7erir. E\u011fer MFA’y\u0131 sadece SSH ile s\u0131n\u0131rlamak istiyorsan\u0131z \/etc\/pam.d\/sshd<\/code> dosyas\u0131n\u0131 d\u00fczenlemek yeterlidir. Ancak, MFA’y\u0131 t\u00fcm sistem genelinde (\u00f6rne\u011fin konsol giri\u015fi i\u00e7in de) uygulamak istiyorsan\u0131z common-auth<\/code> dosyas\u0131n\u0131 d\u00fczenleyebilirsiniz.<\/p>\n
sudo cp \/etc\/pam.d\/common-auth \/etc\/pam.d\/common-auth.bak\nsudo nano \/etc\/pam.d\/common-auth<\/code><\/pre>\n
Dosyan\u0131n en \u00fcst\u00fcne veya auth required pam_unix.so<\/code> sat\u0131r\u0131ndan hemen \u00f6nce a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n
auth required pam_google_authenticator.so<\/code><\/pre>\n
Ancak, common-auth<\/code> dosyas\u0131nda required<\/code> kullanmak, MFA yap\u0131land\u0131rmas\u0131 olmayan kullan\u0131c\u0131lar\u0131n hi\u00e7bir \u015fekilde giri\u015f yapamamas\u0131na neden olur. Bu nedenle, common-auth<\/code> dosyas\u0131nda genellikle MFA’y\u0131 iste\u011fe ba\u011fl\u0131 hale getirmek i\u00e7in [success=1 default=ignore]<\/code> se\u00e7ene\u011fi kullan\u0131l\u0131r:<\/p>\n
auth [success=1 default=ignore] pam_google_authenticator.so<\/code><\/pre>\n
*   [success=1 default=ignore]<\/code>: Bu, pam_google_authenticator.so<\/code> mod\u00fcl\u00fc ba\u015far\u0131l\u0131 olursa (do\u011fru kod girilirse) bir sonraki auth<\/code> mod\u00fcl\u00fcn\u00fc atla (success=1<\/code>) ve di\u011fer durumlarda (default<\/code>) bu mod\u00fcl\u00fc yoksay (ignore<\/code>) anlam\u0131na gelir. Bu, MFA’y\u0131 yap\u0131land\u0131rm\u0131\u015f kullan\u0131c\u0131lar\u0131n MFA ile giri\u015f yapmas\u0131n\u0131 sa\u011flarken, yap\u0131land\u0131rmam\u0131\u015f kullan\u0131c\u0131lar\u0131n parola ile giri\u015f yapmaya devam etmesini sa\u011flar. Ancak, bu durum MFA’n\u0131n zorunlu olmad\u0131\u011f\u0131 anlam\u0131na gelir ve g\u00fcvenlik seviyesini d\u00fc\u015f\u00fcrebilir.
\nBu rehberde SSH i\u00e7in zorunlu MFA hedefledi\u011fimizden, \/etc\/pam.d\/sshd<\/code> dosyas\u0131n\u0131 d\u00fczenlemeyi ve auth required pam_google_authenticator.so<\/code> sat\u0131r\u0131n\u0131 kullanmay\u0131 tercih ediyoruz.<\/strong><\/p>\n
SSH Servisinin Yeniden Yap\u0131land\u0131r\u0131lmas\u0131<\/h3>\n
PAM yap\u0131land\u0131rmas\u0131n\u0131 g\u00fcncelledikten sonra, SSH servisine bu de\u011fi\u015fiklikleri uygulamas\u0131 i\u00e7in bilgi vermemiz gerekmektedir. Bu, sshd_config<\/code> dosyas\u0131nda baz\u0131 ayarlar\u0131 d\u00fczenleyerek ve ard\u0131ndan SSH servisini yeniden ba\u015flatarak yap\u0131l\u0131r.<\/p>\n
\/etc\/ssh\/sshd_config<\/code> Dosyas\u0131n\u0131n D\u00fczenlenmesi<\/h4>\n
SSH daemon’\u0131n\u0131n yap\u0131land\u0131rma dosyas\u0131n\u0131 d\u00fczenlememiz gerekiyor. Yine, bir yedek alman\u0131z tavsiye edilir.<\/p>\n
sudo cp \/etc\/ssh\/sshd_config \/etc\/ssh\/sshd_config.bak\nsudo nano \/etc\/ssh\/sshd_config<\/code><\/pre>\n
Dosyay\u0131 a\u00e7t\u0131ktan sonra, a\u015fa\u011f\u0131daki ayarlar\u0131 bulup de\u011ferlerini de\u011fi\u015ftirmemiz veya yoksa eklememiz gerekmektedir:<\/p>\n
1.  ChallengeResponseAuthentication<\/code>:<\/strong> Bu se\u00e7ene\u011fi yes<\/code> olarak ayarlay\u0131n. Bu, SSH sunucusunun kimlik do\u011frulama s\u0131ras\u0131nda istemciden ek bilgiler (bizim durumumuzda MFA kodu) isteyebilmesini sa\u011flar.<\/p>\n
ChallengeResponseAuthentication yes<\/code><\/pre>\n
    Bu sat\u0131r\u0131n ba\u015f\u0131nda #<\/code> varsa, yorum sat\u0131r\u0131 olmaktan \u00e7\u0131kar\u0131n.<\/p>\n
2.  UsePAM<\/code>:<\/strong> Bu se\u00e7ene\u011fi yes<\/code> olarak ayarlay\u0131n. Bu, SSH daemon’\u0131n\u0131n kimlik do\u011frulama i\u00e7in PAM’i kullanmas\u0131n\u0131 sa\u011flar. Bu genellikle varsay\u0131lan olarak yes<\/code>‘tir, ancak kontrol etmekte fayda var.<\/p>\n
UsePAM yes<\/code><\/pre>\n
3.  AuthenticationMethods<\/code> (Opsiyonel ama \u00d6nerilir):<\/strong> Bu se\u00e7enek, hangi kimlik do\u011frulama y\u00f6ntemlerinin hangi s\u0131rayla kabul edilece\u011fini belirtmenizi sa\u011flar. MFA’y\u0131 zorunlu k\u0131lmak i\u00e7in bu ayar\u0131 kullanmak \u00f6nemlidir.<\/p>\n
    *   E\u011fer sadece parola ve MFA<\/strong> kullanmak istiyorsan\u0131z:<\/p>\n
AuthenticationMethods keyboard-interactive<\/code><\/pre>\n
        Veya daha a\u00e7\u0131k bir \u015fekilde:<\/p>\n
AuthenticationMethods password,keyboard-interactive<\/code><\/pre>\n
        Burada keyboard-interactive<\/code> PAM mod\u00fclleri arac\u0131l\u0131\u011f\u0131yla kimlik do\u011frulamay\u0131 ifade eder ki bizim durumumuzda hem parolay\u0131 hem de Google Authenticator kodunu i\u00e7erir.<\/p>\n
    *   E\u011fer SSH anahtarlar\u0131 ve MFA<\/strong> kullanmak istiyorsan\u0131z (daha g\u00fcvenli bir yakla\u015f\u0131m):<\/p>\n
AuthenticationMethods publickey,keyboard-interactive<\/code><\/pre>\n
        Bu, kullan\u0131c\u0131n\u0131n \u00f6nce SSH anahtar\u0131 ile kimlik do\u011frulamas\u0131 yapmas\u0131n\u0131, ard\u0131ndan ikinci bir ad\u0131m olarak MFA kodu girmesini gerektirecektir. Bu, parola kullan\u0131m\u0131n\u0131 tamamen ortadan kald\u0131rarak g\u00fcvenli\u011fi daha da art\u0131r\u0131r.<\/p>\n
    Bu rehberde, parola ve MFA kombinasyonunu kullanaca\u011f\u0131m\u0131z\u0131 varsayarak AuthenticationMethods keyboard-interactive<\/code> veya AuthenticationMethods password,keyboard-interactive<\/code> kullanaca\u011f\u0131z. E\u011fer SSH anahtar\u0131 ile giri\u015f yap\u0131yorsan\u0131z ve MFA’y\u0131 SSH anahtar\u0131n\u0131za eklemek istiyorsan\u0131z publickey,keyboard-interactive<\/code> kullanmal\u0131s\u0131n\u0131z.
\n    \u00d6rnek olarak, sshd_config<\/code> dosyan\u0131zda bu ayarlar\u0131n oldu\u011fu k\u0131s\u0131m \u015f\u00f6yle g\u00f6r\u00fcnebilir:<\/p>\n
# Change to yes to enable challenge-response authentication (beware of PAM)\n    ChallengeResponseAuthentication yes\n\n    # Set this to 'yes' to enable PAM authentication, account processing,\n    # and session processing. If this is disabled, PAM won't be used,\n    # and many other options will become ineffective.\n    UsePAM yes\n\n    # The default is to check if the user has a password in \/etc\/passwd\n    # and if so, require it. If not, the user is allowed to log in without\n    # a password. This can be overridden by the AuthenticationMethods option.\n    # AuthenticationMethods publickey,password\n    AuthenticationMethods password,keyboard-interactive<\/code><\/pre>\n
De\u011fi\u015fiklikleri kaydedin ve dosyay\u0131 kapat\u0131n (Ctrl+O<\/code>, Enter<\/code>, Ctrl+X<\/code>).<\/p>\n
SSH Servisini Yeniden Ba\u015flatma<\/h4>\n
sshd_config<\/code> dosyas\u0131ndaki de\u011fi\u015fikliklerin etkili olmas\u0131 i\u00e7in SSH servisini yeniden ba\u015flatman\u0131z gerekmektedir:<\/p>\n
sudo systemctl restart sshd<\/code><\/pre>\n
\u00c7OK \u00d6NEML\u0130 UYARI:<\/strong> Bu komutu \u00e7al\u0131\u015ft\u0131rmadan \u00f6nce, mevcut SSH oturumunuzu ASLA kapatmay\u0131n.<\/strong> E\u011fer yap\u0131land\u0131rmada bir hata yapt\u0131ysan\u0131z ve SSH servisi yeniden ba\u015flat\u0131ld\u0131ktan sonra yeni ba\u011flant\u0131lar kabul etmezse, mevcut oturumunuz a\u00e7\u0131k kalacakt\u0131r ve bu oturum \u00fczerinden d\u00fczeltmeleri yapma veya geri alma \u015fans\u0131n\u0131z olacakt\u0131r. Yeni bir terminal penceresi a\u00e7arak veya farkl\u0131 bir bilgisayardan ba\u011flant\u0131 kurmay\u0131 deneyerek MFA’y\u0131 test etmeniz \u015fiddetle tavsiye edilir.<\/p>\n
MFA’n\u0131n Test Edilmesi<\/h3>\n
SSH servisini yeniden ba\u015flatt\u0131ktan sonra, MFA’n\u0131n do\u011fru \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131 test etme zaman\u0131 gelmi\u015ftir.<\/p>\n
1.  Yeni Bir Terminal A\u00e7\u0131n:<\/strong> Mevcut SSH oturumunuzu a\u00e7\u0131k b\u0131rakarak, bilgisayar\u0131n\u0131zda yeni bir terminal penceresi a\u00e7\u0131n veya farkl\u0131 bir bilgisayardan sunucuya SSH ile ba\u011flanmay\u0131 deneyin.<\/p>\n
2.  SSH Ba\u011flant\u0131s\u0131 Denemesi:<\/strong> MFA’y\u0131 yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131z kullan\u0131c\u0131 ad\u0131 ile sunucuya ba\u011flanmaya \u00e7al\u0131\u015f\u0131n:<\/p>\n
ssh kullaniciadi@sunucu_ipadresi_veya_domain<\/code><\/pre>\n
3.  Kimlik Do\u011frulama Ad\u0131mlar\u0131:<\/strong>
\n    *   \u00d6ncelikle, SSH sizden parolan\u0131z\u0131 isteyecektir:<\/p>\n
kullaniciadi@sunucu_ipadresi_veya_domain's password:<\/code><\/pre>\n
        Parolan\u0131z\u0131 girin ve Enter<\/code> tu\u015funa bas\u0131n.
\n    *   Parolan\u0131z do\u011fruysa, SSH sizden “Verification code” (Do\u011frulama kodu) isteyecektir:<\/p>\n
Verification code:<\/code><\/pre>\n
        Bu noktada, mobil cihaz\u0131n\u0131zdaki Google Authenticator uygulamas\u0131n\u0131 a\u00e7\u0131n ve ilgili kullan\u0131c\u0131 i\u00e7in g\u00f6r\u00fcnt\u00fclenen 6 haneli kodu (TOTP) girin. Kod her 30 saniyede bir de\u011fi\u015fir, bu y\u00fczden g\u00fcncel kodu girdi\u011finizden emin olun.<\/p>\n
4.  Ba\u015far\u0131l\u0131 Ba\u011flant\u0131:<\/strong> E\u011fer hem parolan\u0131z\u0131 hem de do\u011frulama kodunu do\u011fru girerseniz, sunucuya ba\u015far\u0131l\u0131 bir \u015fekilde SSH ile ba\u011flanacaks\u0131n\u0131z. Bu, MFA’n\u0131n ba\u015far\u0131yla yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131 anlam\u0131na gelir.<\/p>\n
5.  Ba\u015far\u0131s\u0131z Ba\u011flant\u0131 Denemeleri:<\/strong>
\n    *   E\u011fer parolan\u0131z\u0131 do\u011fru girer ancak yanl\u0131\u015f do\u011frulama kodu girerseniz, ba\u011flant\u0131 ba\u015far\u0131s\u0131z olacakt\u0131r.
\n    *   E\u011fer mobil cihaz\u0131n\u0131zdaki kod ile sunucunun zaman\u0131 aras\u0131nda b\u00fcy\u00fck bir fark varsa, kod yanl\u0131\u015f kabul edilebilir. Bu durumda zaman senkronizasyonunu kontrol etmeniz gerekir (timedatectl status<\/code>).
\n    *   E\u011fer google-authenticator<\/code> komutunu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda rate-limiting<\/code> se\u00e7ene\u011fini y<\/code> olarak ayarlad\u0131ysan\u0131z, art arda yanl\u0131\u015f kod denemeleri belirli bir s\u00fcre boyunca yeni denemeleri engelleyebilir.<\/p>\n
Testleriniz ba\u015far\u0131l\u0131 olduktan sonra, art\u0131k sunucunuzun SSH eri\u015fimi MFA ile korunuyor demektir.<\/p>\n
Ek G\u00fcvenlik \u0130pu\u00e7lar\u0131 ve En \u0130yi Uygulamalar<\/h3>\n
MFA’y\u0131 yap\u0131land\u0131rmak \u00f6nemli bir ad\u0131m olsa da, g\u00fcvenli\u011fi daha da art\u0131rmak i\u00e7in baz\u0131 ek ipu\u00e7lar\u0131 ve en iyi uygulamalar\u0131 takip etmek \u00f6nemlidir.<\/p>\n
Kurtarma Kodlar\u0131n\u0131n G\u00fcvenli Saklanmas\u0131<\/h4>\n
google-authenticator<\/code> komutunu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda size verilen be\u015f adet tek kullan\u0131ml\u0131k kurtarma kodu (emergency scratch codes) hayati \u00f6neme sahiptir.
\n*   Fiziksel Kopyalama:<\/strong> Bu kodlar\u0131 yazd\u0131r\u0131p g\u00fcvenli bir yerde (\u00f6rne\u011fin kilitli bir \u00e7ekmece veya kasa) saklay\u0131n.
\n*   Dijital Kopyalama:<\/strong> Dijital olarak saklaman\u0131z gerekiyorsa, \u015fifrelenmi\u015f bir dosya veya parola y\u00f6neticisi i\u00e7inde tutun. Asla d\u00fcz metin olarak veya bulut depolama hizmetlerinde \u015fifresiz b\u0131rakmay\u0131n.
\n*   Tek Kullan\u0131ml\u0131k:<\/strong> Her kod sadece bir kez kullan\u0131labilir. Kulland\u0131\u011f\u0131n\u0131zda \u00fczerini \u00e7izin veya listeden \u00e7\u0131kar\u0131n.
\n*   Eri\u015filebilirlik:<\/strong> Telefonunuzu kaybetti\u011finizde veya MFA uygulamas\u0131na eri\u015femedi\u011finizde bu kodlara ula\u015fabilece\u011finizden emin olun.<\/p>\n
Zaman Senkronizasyonunun \u00d6nemi (NTP)<\/h4>\n
Zaman tabanl\u0131 tek kullan\u0131ml\u0131k \u015fifreler (TOTP), hem sunucunun hem de mobil cihaz\u0131n zaman\u0131n\u0131n birbirine yak\u0131n olmas\u0131n\u0131 gerektirir. K\u00fc\u00e7\u00fck bir zaman kaymas\u0131 bile kimlik do\u011frulama hatalar\u0131na yol a\u00e7abilir.
\n*   Sunucunuzda NTP (Network Time Protocol) istemcisinin d\u00fczg\u00fcn \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun. Ubuntu 18.04’te systemd-timesyncd<\/code> varsay\u0131lan olarak gelir.
\n*   Mobil cihaz\u0131n\u0131z\u0131n da otomatik zaman senkronizasyonunu kulland\u0131\u011f\u0131ndan emin olun.<\/p>\n
Root Kullan\u0131c\u0131s\u0131 \u0130\u00e7in MFA<\/h4>\n
Genel olarak, root<\/code> kullan\u0131c\u0131s\u0131 ile do\u011frudan SSH eri\u015fimi sa\u011flamak g\u00fcvenlik a\u00e7\u0131s\u0131ndan tavsiye edilmez. Bunun yerine, normal bir kullan\u0131c\u0131 hesab\u0131 ile giri\u015f yap\u0131p gerekti\u011finde sudo<\/code> komutunu kullanmak daha g\u00fcvenlidir.
\nAncak, root<\/code> kullan\u0131c\u0131s\u0131 i\u00e7in de MFA yap\u0131land\u0131rmak isterseniz, root<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7i\u015f yaparak (sudo su -<\/code>) google-authenticator<\/code> komutunu \u00e7al\u0131\u015ft\u0131rman\u0131z ve PAM yap\u0131land\u0131rmas\u0131n\u0131 (\u00f6rne\u011fin \/etc\/pam.d\/sshd<\/code>) buna g\u00f6re d\u00fczenlemeniz gerekir. Ancak bu, \u00e7ok dikkatli yap\u0131lmal\u0131d\u0131r ve genellikle \u00f6nerilmez.<\/p>\n
SSH Anahtarlar\u0131 ile MFA’n\u0131n Birlikte Kullan\u0131m\u0131<\/h4>\n
SSH anahtarlar\u0131, parola tabanl\u0131 kimlik do\u011frulamadan \u00e7ok daha g\u00fcvenlidir. MFA’y\u0131 SSH anahtarlar\u0131 ile birle\u015ftirmek, g\u00fcvenlik seviyesini en \u00fcst d\u00fczeye \u00e7\u0131kar\u0131r.
\n*   Yap\u0131land\u0131rma:<\/strong> \/etc\/ssh\/sshd_config<\/code> dosyas\u0131nda AuthenticationMethods publickey,keyboard-interactive<\/code> olarak ayarlay\u0131n.
\n*   Bu durumda, kullan\u0131c\u0131 \u00f6nce SSH anahtar\u0131 ile kimlik do\u011frulamas\u0131 yapar, ard\u0131ndan MFA kodu istenir. Bu, iki farkl\u0131 fakt\u00f6r (sahip oldu\u011funuz anahtar ve sahip oldu\u011funuz telefon) kullanarak \u00e7ok g\u00fc\u00e7l\u00fc bir koruma sa\u011flar.<\/p>\n
Fail2ban Entegrasyonu<\/h4>\n
Fail2ban, sunucu g\u00fcnl\u00fck dosyalar\u0131n\u0131 tarayan ve ba\u015far\u0131s\u0131z giri\u015f denemelerini tespit etti\u011finde IP adreslerini ge\u00e7ici olarak engelleyen bir intrusion prevention (izinsiz giri\u015f \u00f6nleme) \u00e7er\u00e7evesidir. MFA ile birlikte kullan\u0131ld\u0131\u011f\u0131nda, kaba kuvvet sald\u0131r\u0131lar\u0131na kar\u015f\u0131 ek bir savunma katman\u0131 sa\u011flar.
\n*   Fail2ban, yanl\u0131\u015f MFA kodu denemelerini de yakalayacak \u015fekilde yap\u0131land\u0131r\u0131labilir ve bu IP adreslerini engelleyebilir. Bu, sald\u0131rganlar\u0131n \u00e7ok say\u0131da MFA kodunu denemesini engeller.
\n*   Fail2ban’\u0131 kurup yap\u0131land\u0131rmak i\u00e7in:<\/p>\n
sudo apt install fail2ban -y\n    sudo systemctl enable fail2ban\n    sudo systemctl start fail2ban<\/code><\/pre>\n
    Ard\u0131ndan \/etc\/fail2ban\/jail.local<\/code> dosyas\u0131n\u0131 d\u00fczenleyerek SSH i\u00e7in ayarlar\u0131 optimize edebilirsiniz.<\/p>\n
MFA’y\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma (Acil Durumda)<\/h4>\n
MFA’y\u0131 yanl\u0131\u015f yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131zda veya telefonunuzu kaybetti\u011finizde ve kurtarma kodlar\u0131n\u0131z da yoksa, sisteme eri\u015fiminiz engellenebilir. Bu t\u00fcr bir acil durumda MFA’y\u0131 devre d\u0131\u015f\u0131 b\u0131rakman\u0131n yollar\u0131:
\n*   Konsol Eri\u015fimi:<\/strong> Sunucuya fiziksel eri\u015fiminiz varsa, do\u011frudan klavye ve monit\u00f6r ba\u011flayarak giri\u015f yapabilirsiniz. Bu durumda PAM mod\u00fclleri SSH’deki gibi i\u015flemeyece\u011fi i\u00e7in normal parola ile giri\u015f yapabilirsiniz.
\n*   PAM Dosyas\u0131n\u0131 D\u00fczenleme:<\/strong> Konsol eri\u015fimi ile giri\u015f yapt\u0131ktan sonra veya mevcut SSH oturumunuz hala a\u00e7\u0131ksa, \/etc\/pam.d\/sshd<\/code> dosyas\u0131n\u0131 d\u00fczenleyerek ekledi\u011finiz auth required pam_google_authenticator.so<\/code> sat\u0131r\u0131n\u0131 silin veya ba\u015f\u0131na #<\/code> koyarak yorum sat\u0131r\u0131 haline getirin. Ard\u0131ndan SSH servisini yeniden ba\u015flat\u0131n: sudo systemctl restart sshd<\/code>.
\n*   Kullan\u0131c\u0131 Dosyas\u0131n\u0131 Silme:<\/strong> Bir kullan\u0131c\u0131 i\u00e7in MFA’y\u0131 tamamen kald\u0131rmak isterseniz, o kullan\u0131c\u0131n\u0131n ev dizinindeki .google_authenticator<\/code> dosyas\u0131n\u0131 silebilirsiniz: rm ~\/.google_authenticator<\/code>. Ancak PAM yap\u0131land\u0131rmas\u0131 hala mod\u00fcl\u00fc gerektiriyorsa, bu kullan\u0131c\u0131 yine de giri\u015f yapamayabilir. En g\u00fcvenlisi \u00f6nce PAM yap\u0131land\u0131rmas\u0131n\u0131 d\u00fczeltmektir.<\/p>\n
Bu ek g\u00fcvenlik ipu\u00e7lar\u0131, MFA uygulaman\u0131z\u0131n sa\u011flaml\u0131\u011f\u0131n\u0131 ve genel sunucu g\u00fcvenli\u011finizi \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131racakt\u0131r.<\/p>\n
S\u0131k\u00e7a Sorulan Sorular (SSS)<\/h3>\n
MFA yap\u0131land\u0131rmas\u0131 hakk\u0131nda s\u0131k\u00e7a kar\u015f\u0131la\u015f\u0131lan baz\u0131 sorular ve yan\u0131tlar\u0131 a\u015fa\u011f\u0131dad\u0131r:<\/p>\n
MFA kodlar\u0131m\u0131 unuttum\/telefonumu kaybettim, ne yapmal\u0131y\u0131m?<\/h4>\n
Bu en yayg\u0131n ve kritik senaryolardan biridir.
\n*   Kurtarma Kodlar\u0131 (Emergency Scratch Codes):<\/strong> google-authenticator<\/code> komutunu \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131n\u0131zda size verilen be\u015f adet tek kullan\u0131ml\u0131k kurtarma kodunu kullan\u0131n. Her kod bir kez kullan\u0131labilir ve sisteme normal parola ile giri\u015f yapar gibi kullan\u0131c\u0131n\u0131z\u0131n parolas\u0131n\u0131 girdikten sonra “Verification code” istendi\u011finde bu kodlardan birini girerek eri\u015fim sa\u011flayabilirsiniz.
\n*   Konsol Eri\u015fimi:<\/strong> E\u011fer kurtarma kodlar\u0131n\u0131z yoksa ve sunucuya fiziksel eri\u015fiminiz varsa, do\u011frudan sunucu konsolundan (klavye ve monit\u00f6r ba\u011flayarak) giri\u015f yapabilirsiniz. Konsol giri\u015fi genellikle PAM yap\u0131land\u0131rmas\u0131ndan etkilenmez veya farkl\u0131 bir PAM profili kullan\u0131r. Giri\u015f yapt\u0131ktan sonra \/etc\/pam.d\/sshd<\/code> dosyas\u0131ndaki pam_google_authenticator.so<\/code> sat\u0131r\u0131n\u0131 yorum sat\u0131r\u0131 haline getirerek veya silerek MFA’y\u0131 devre d\u0131\u015f\u0131 b\u0131rakabilirsiniz.
\n*   Farkl\u0131 Bir Kullan\u0131c\u0131 Hesab\u0131:<\/strong> E\u011fer sunucuda ba\u015fka bir y\u00f6netici hesab\u0131n\u0131z varsa ve bu hesapta MFA etkin de\u011filse veya kurtarma kodlar\u0131 mevcutsa, o hesap \u00fczerinden giri\u015f yaparak sorunlu kullan\u0131c\u0131n\u0131n PAM yap\u0131land\u0131rmas\u0131n\u0131 d\u00fczeltebilirsiniz.<\/p>\n
T\u00fcm kullan\u0131c\u0131lara MFA’y\u0131 zorunlu mu yapmal\u0131y\u0131m?<\/h4>\n
G\u00fcvenlik a\u00e7\u0131s\u0131ndan, evet, t\u00fcm kullan\u0131c\u0131lar i\u00e7in MFA’n\u0131n zorunlu tutulmas\u0131 \u015fiddetle tavsiye edilir. Bir kullan\u0131c\u0131n\u0131n hesab\u0131 ele ge\u00e7irildi\u011finde, bu durum t\u00fcm sistemin g\u00fcvenli\u011fini tehlikeye atabilir. E\u011fer nullok<\/code> se\u00e7ene\u011fini kullan\u0131rsan\u0131z veya [success=1 default=ignore]<\/code> gibi se\u00e7eneklerle MFA’y\u0131 iste\u011fe ba\u011fl\u0131 yaparsan\u0131z, MFA kullanmayan kullan\u0131c\u0131lar hala tek fakt\u00f6rl\u00fc kimlik do\u011frulaman\u0131n risklerine maruz kalacakt\u0131r.<\/p>\n
Farkl\u0131 MFA uygulamalar\u0131 kullanabilir miyim?<\/h4>\n
Evet, Google Authenticator PAM mod\u00fcl\u00fc, zaman tabanl\u0131 tek kullan\u0131ml\u0131k \u015fifreler (TOTP) standard\u0131n\u0131 kulland\u0131\u011f\u0131 i\u00e7in, bu standard\u0131 destekleyen di\u011fer mobil uygulamalar\u0131 da kullanabilirsiniz. Pop\u00fcler se\u00e7enekler aras\u0131nda Authy, Microsoft Authenticator ve FreeOTP gibi uygulamalar bulunur. Bunlar\u0131n hepsi, google-authenticator<\/code> komutunun olu\u015fturdu\u011fu QR kodu veya gizli anahtar\u0131 tarayarak veya manuel girerek \u00e7al\u0131\u015f\u0131r.<\/p>\n
Ubuntu 20.04\/22.04 i\u00e7in de ge\u00e7erli mi?<\/h4>\n
Evet, bu rehberdeki ad\u0131mlar ve temel mant\u0131k Ubuntu’nun daha yeni s\u00fcr\u00fcmleri olan 20.04 LTS ve 22.04 LTS i\u00e7in de b\u00fcy\u00fck \u00f6l\u00e7\u00fcde ge\u00e7erlidir. libpam-google-authenticator<\/code> paketi ve PAM\/SSH yap\u0131land\u0131rma prensipleri bu s\u00fcr\u00fcmlerde de ayn\u0131d\u0131r. Ancak, baz\u0131 k\u00fc\u00e7\u00fck detaylar veya varsay\u0131lan yap\u0131land\u0131rmalar farkl\u0131l\u0131k g\u00f6sterebilir. Her zaman g\u00fcncel sisteminiz i\u00e7in en son dok\u00fcmantasyonu kontrol etmek iyi bir uygulamad\u0131r.<\/p>\n
SSH anahtarlar\u0131 ile MFA’y\u0131 nas\u0131l kullanabilirim?<\/h4>\n
Yukar\u0131da “Ek G\u00fcvenlik \u0130pu\u00e7lar\u0131” b\u00f6l\u00fcm\u00fcnde bahsedildi\u011fi gibi, SSH anahtarlar\u0131 ile MFA’y\u0131 birle\u015ftirmek en g\u00fcvenli yakla\u015f\u0131md\u0131r. \/etc\/ssh\/sshd_config<\/code> dosyas\u0131nda AuthenticationMethods publickey,keyboard-interactive<\/code> olarak ayarlaman\u0131z yeterlidir. Bu, kullan\u0131c\u0131lar\u0131n \u00f6nce SSH anahtarlar\u0131 ile kimlik do\u011frulamas\u0131 yapmas\u0131n\u0131, ard\u0131ndan ikinci bir ad\u0131m olarak Google Authenticator kodunu girmesini gerektirecektir.<\/p>\n
MFA’y\u0131 kald\u0131rmak istersem ne yapmal\u0131y\u0131m?<\/h4>\n
MFA’y\u0131 kald\u0131rmak i\u00e7in iki ana ad\u0131m vard\u0131r:
\n1.  PAM Yap\u0131land\u0131rmas\u0131n\u0131 Geri Al\u0131n:<\/strong> \/etc\/pam.d\/sshd<\/code> dosyas\u0131n\u0131 d\u00fczenleyerek ekledi\u011finiz auth required pam_google_authenticator.so<\/code> sat\u0131r\u0131n\u0131 silin veya yorum sat\u0131r\u0131 haline getirin.
\n2.  sshd_config<\/code> Dosyas\u0131n\u0131 Geri Al\u0131n:<\/strong> \/etc\/ssh\/sshd_config<\/code> dosyas\u0131nda yapt\u0131\u011f\u0131n\u0131z de\u011fi\u015fiklikleri (\u00f6zellikle ChallengeResponseAuthentication<\/code> ve AuthenticationMethods<\/code> ayarlar\u0131) eski haline getirin.
\n3.  SSH Servisini Yeniden Ba\u015flat\u0131n:<\/strong> sudo systemctl restart sshd<\/code> komutunu \u00e7al\u0131\u015ft\u0131r\u0131n.
\n4.  Kullan\u0131c\u0131 Dosyalar\u0131n\u0131 Silin (Opsiyonel):<\/strong> Her kullan\u0131c\u0131n\u0131n ev dizinindeki .google_authenticator<\/code> dosyas\u0131n\u0131 silerek o kullan\u0131c\u0131 i\u00e7in MFA yap\u0131land\u0131rmas\u0131n\u0131 tamamen kald\u0131rabilirsiniz.<\/p>\n
Bu ad\u0131mlar\u0131 dikkatlice uygulayarak MFA’y\u0131 g\u00fcvenli bir \u015fekilde devre d\u0131\u015f\u0131 b\u0131rakabilirsiniz.<\/p>\n
Sonu\u00e7<\/h3>\n
Ubuntu 18.04 sunucular\u0131n\u0131zda \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) yap\u0131land\u0131rmak, siber g\u00fcvenlik duru\u015funuzu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendiren kritik bir ad\u0131md\u0131r. Tek fakt\u00f6rl\u00fc parola tabanl\u0131 kimlik do\u011frulaman\u0131n yetersiz kald\u0131\u011f\u0131 g\u00fcn\u00fcm\u00fczde, MFA ek bir g\u00fcvenlik katman\u0131 sa\u011flayarak yetkisiz eri\u015fim riskini minimize eder. Bu makalede ad\u0131m ad\u0131m a\u00e7\u0131klad\u0131\u011f\u0131m\u0131z Google Authenticator PAM mod\u00fcl\u00fc kurulumu ve yap\u0131land\u0131rmas\u0131 ile SSH eri\u015fiminizi kolayca g\u00fcvence alt\u0131na alabilirsiniz.<\/p>\n
Unutulmamal\u0131d\u0131r ki, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve hi\u00e7bir \u00e7\u00f6z\u00fcm %100 kusursuz de\u011fildir. Ancak MFA gibi g\u00fc\u00e7l\u00fc \u00f6nlemler almak, sald\u0131rganlar\u0131n i\u015fini zorla\u015ft\u0131r\u0131r ve sistemlerinizi \u00e7ok daha diren\u00e7li hale getirir. Kurtarma kodlar\u0131n\u0131 g\u00fcvenli bir \u015fekilde saklamak, zaman senkronizasyonuna dikkat etmek ve SSH anahtarlar\u0131 ile MFA’y\u0131 birle\u015ftirmek gibi en iyi uygulamalar\u0131 takip etmek, g\u00fcvenli\u011finizi daha da art\u0131racakt\u0131r.<\/p>\n
Siber tehditler geli\u015ftik\u00e7e, savunma mekanizmalar\u0131m\u0131z\u0131 da s\u00fcrekli olarak g\u00fcncellememiz ve g\u00fc\u00e7lendirmemiz gerekmektedir. Ubuntu sunucular\u0131n\u0131zda MFA’y\u0131 etkinle\u015ftirerek, de\u011ferli verilerinizi ve altyap\u0131n\u0131z\u0131 koruma yolunda \u00f6nemli bir ad\u0131m atm\u0131\u015f olacaks\u0131n\u0131z.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\nGiri\u015f: \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama Neden \u00d6nemli?\nG","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-32643","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nUbuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\" \/>\n<meta property=\"og:description\" content=\"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? Giri\u015f: \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama Neden \u00d6nemli? G\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-24T03:41:18+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"25 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\",\"datePublished\":\"2025-10-24T03:41:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\"},\"wordCount\":4475,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\",\"name\":\"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-24T03:41:18+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/","og_locale":"tr_TR","og_type":"article","og_title":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?","og_description":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? Giri\u015f: \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama Neden \u00d6nemli? G","og_url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-24T03:41:18+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"25 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?","datePublished":"2025-10-24T03:41:18+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/"},"wordCount":4475,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/","url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/","name":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-24T03:41:18+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-18-04-uzerinde-cok-faktorlu-kimlik-dogrulama-mfa-nasil-yapilandirilir\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Ubuntu 18.04 \u00dczerinde \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA) Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r?"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/32643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=32643"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/32643\/revisions"}],"predecessor-version":[{"id":32644,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/32643\/revisions\/32644"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=32643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=32643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=32643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}