{"id":33426,"date":"2025-11-02T19:41:09","date_gmt":"2025-11-02T16:41:09","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=33426"},"modified":"2025-11-02T19:41:09","modified_gmt":"2025-11-02T16:41:09","slug":"opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/","title":{"rendered":"OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi"},"content":{"rendered":"

<\/p>\n

OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi<\/h2>\n

Sunuculara uzaktan eri\u015fim sa\u011flamak i\u00e7in kullan\u0131lan en yayg\u0131n protokollerden biri olan OpenSSH, sistem y\u00f6neticilerinin ve geli\u015ftiricilerin g\u00fcnl\u00fck i\u015f ak\u0131\u015f\u0131n\u0131n ayr\u0131lmaz bir par\u00e7as\u0131d\u0131r. Ancak, bu kolayl\u0131k beraberinde \u00f6nemli g\u00fcvenlik risklerini de getirir. Bir sunucuya yetkisiz eri\u015fim, veri ihlallerine, sistem kesintilerine ve ciddi itibar kay\u0131plar\u0131na yol a\u00e7abilir. Bu nedenle, OpenSSH yap\u0131land\u0131rmas\u0131n\u0131 sertle\u015ftirmek (hardening), herhangi bir Ubuntu 20.04 sunucusunun genel g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirmek i\u00e7in kritik bir ad\u0131md\u0131r.<\/p>\n

Bu kapsaml\u0131 teknik makale, OpenSSH’i Ubuntu 20.04 \u00fczerinde nas\u0131l g\u00fcvenli hale getirece\u011finize dair ad\u0131m ad\u0131m bir rehber sunmaktad\u0131r. Temel yap\u0131land\u0131rma de\u011fi\u015fikliklerinden ileri d\u00fczey g\u00fcvenlik \u00f6nlemlerine kadar \u00e7e\u015fitli konular\u0131 ele alarak, sunucular\u0131n\u0131z\u0131n siber tehditlere kar\u015f\u0131 daha diren\u00e7li olmas\u0131n\u0131 sa\u011flayacak y\u00f6ntemleri ayr\u0131nt\u0131l\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n

SSH G\u00fcvenli\u011fini Neden Sertle\u015ftirmeliyiz?<\/h3>\n

SSH (Secure Shell), \u015fifreli bir a\u011f protokol\u00fcd\u00fcr ve a\u011f hizmetleri \u00fczerinde g\u00fcvenli veri ileti\u015fimi sa\u011flar. En bilinen kullan\u0131m\u0131, uzaktaki bir bilgisayara g\u00fcvenli bir \u015fekilde ba\u011flanmakt\u0131r. Varsay\u0131lan OpenSSH yap\u0131land\u0131rmalar\u0131 genellikle “kullan\u0131labilir” olacak \u015fekilde ayarlanm\u0131\u015ft\u0131r, ancak “g\u00fcvenli” olacak \u015fekilde optimize edilmemi\u015ftir. Bir sald\u0131rgan\u0131n SSH hizmetinize eri\u015fim sa\u011flamas\u0131 durumunda, sunucunuzun tam kontrol\u00fcn\u00fc ele ge\u00e7irebilir veya hassas verilere ula\u015fabilir. Bu riskleri azaltmak i\u00e7in OpenSSH’i sertle\u015ftirmek elzemdir.<\/p>\n

Sertle\u015ftirme s\u00fcreci, zay\u0131f noktalar\u0131 ortadan kald\u0131rmay\u0131, yetkisiz eri\u015fim giri\u015fimlerini engellemeyi ve olas\u0131 sald\u0131r\u0131 y\u00fczeyini daraltmay\u0131 ama\u00e7lar. Bu, parolalar\u0131n kaba kuvvet sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korunmas\u0131ndan, yaln\u0131zca belirli kullan\u0131c\u0131lar\u0131n veya IP adreslerinin eri\u015fimine izin verilmesine kadar bir dizi ad\u0131m\u0131 i\u00e7erir.<\/p>\n

Ba\u015flamadan \u00d6nce<\/h3>\n

Herhangi bir kritik sistem yap\u0131land\u0131rmas\u0131nda de\u011fi\u015fiklik yapmadan \u00f6nce, a\u015fa\u011f\u0131daki \u00f6nlemleri alman\u0131z \u015fiddetle tavsiye edilir:<\/p>\n

1. Yedekleme:<\/strong> sshd_config<\/code> dosyas\u0131n\u0131n ve di\u011fer \u00f6nemli yap\u0131land\u0131rma dosyalar\u0131n\u0131n bir yede\u011fini al\u0131n.<\/p>\n

sudo cp \/etc\/ssh\/sshd_config \/etc\/ssh\/sshd_config.bak<\/code><\/pre>\n
2.  Test Ortam\u0131:<\/strong> M\u00fcmk\u00fcnse, bu de\u011fi\u015fiklikleri \u00f6nce bir test veya geli\u015ftirme ortam\u0131nda uygulay\u0131n.
\n3.  A\u00e7\u0131k Bir Oturum B\u0131rak\u0131n:<\/strong> Yap\u0131land\u0131rma de\u011fi\u015fikliklerini uygulad\u0131ktan sonra SSH oturumunuzu hemen kapatmay\u0131n. Yeni bir terminal penceresi a\u00e7arak veya farkl\u0131 bir makineden yeni ayarlar\u0131n\u0131zla ba\u011flant\u0131 kurmaya \u00e7al\u0131\u015f\u0131n. E\u011fer yeni ayarlar\u0131n\u0131zla ba\u011flanamazsan\u0131z, mevcut a\u00e7\u0131k oturumunuzdan geri alabilir veya sorunlar\u0131 giderebilirsiniz. Aksi takdirde, sunucunuzdan kilitlenebilirsiniz.
\n4.  Kullan\u0131c\u0131 Olu\u015fturma:<\/strong> K\u00f6k (root) kullan\u0131c\u0131s\u0131 yerine, y\u00f6netim g\u00f6revleri i\u00e7in sudo<\/code> yetkisine sahip standart bir kullan\u0131c\u0131 hesab\u0131 kullan\u0131n.<\/p>\n
sudo adduser [kullan\u0131c\u0131_ad\u0131]\n    sudo usermod -aG sudo [kullan\u0131c\u0131_ad\u0131]<\/code><\/pre>\n
OpenSSH Sunucu Yap\u0131land\u0131rma Dosyas\u0131: sshd_config<\/code><\/h3>\n
T\u00fcm OpenSSH sunucu ayarlar\u0131 \/etc\/ssh\/sshd_config<\/code> dosyas\u0131nda bulunur. Bu dosyay\u0131 d\u00fczenleyerek g\u00fcvenlik \u00f6nlemlerimizi uygulayaca\u011f\u0131z. D\u00fczenleme i\u00e7in nano<\/code> veya vim<\/code> gibi bir metin d\u00fczenleyici kullanabilirsiniz:<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/code><\/pre>\n
Her de\u011fi\u015fiklikten sonra, SSH hizmetini yeniden ba\u015flatman\u0131z ve yeni bir oturumla ba\u011flant\u0131y\u0131 test etmeniz gerekecektir.<\/p>\n
sudo systemctl restart sshd<\/code><\/pre>\n
Temel G\u00fcvenlik Ayarlar\u0131<\/h3>\n
sshd_config<\/code> dosyas\u0131nda yapaca\u011f\u0131m\u0131z ilk de\u011fi\u015fiklikler, en temel ve etkili g\u00fcvenlik iyile\u015ftirmelerini i\u00e7erir.<\/p>\n
Varsay\u0131lan SSH Portunu De\u011fi\u015ftirme<\/h4>\n
SSH’in varsay\u0131lan portu 22’dir. Bu port, sald\u0131rganlar taraf\u0131ndan en s\u0131k taranan portlardan biridir. Portu varsay\u0131lan olmayan y\u00fcksek bir port numaras\u0131na (\u00f6rne\u011fin, 1024-65535 aras\u0131) de\u011fi\u015ftirmek, otomatik botlar\u0131n ve kaba kuvvet sald\u0131r\u0131lar\u0131n\u0131n b\u00fcy\u00fck bir k\u0131sm\u0131n\u0131 eleyebilir.<\/p>\n
#Port 22\nPort 22222  # \u0130stedi\u011finiz ba\u015fka bir port numaras\u0131 ile de\u011fi\u015ftirin<\/code><\/pre>\n
De\u011fi\u015fikli\u011fi kaydettikten sonra, g\u00fcvenlik duvar\u0131n\u0131zda (UFW) yeni portu a\u00e7may\u0131 unutmay\u0131n. Aksi takdirde, yeni porttan ba\u011flanamazs\u0131n\u0131z.<\/p>\n
Root Kullan\u0131c\u0131s\u0131 ile Giri\u015fi Engelleme<\/h4>\n
K\u00f6k (root) kullan\u0131c\u0131s\u0131, bir Linux sistemindeki en y\u00fcksek ayr\u0131cal\u0131klara sahip kullan\u0131c\u0131d\u0131r. Root olarak do\u011frudan SSH \u00fczerinden giri\u015f yapmak, bir sald\u0131rgan\u0131n bu hesab\u0131 ele ge\u00e7irmesi durumunda sistem \u00fczerinde tam kontrol sa\u011flamas\u0131na olanak tan\u0131r. Root giri\u015fini devre d\u0131\u015f\u0131 b\u0131rakmak, yetkisiz eri\u015fim riskini \u00f6nemli \u00f6l\u00e7\u00fcde azalt\u0131r. Bunun yerine, standart bir kullan\u0131c\u0131 olarak giri\u015f yap\u0131p gerekti\u011finde sudo<\/code> komutunu kullanmal\u0131s\u0131n\u0131z.<\/p>\n
PermitRootLogin no<\/code><\/pre>\n
Parola ile Kimlik Do\u011frulamay\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma<\/h4>\n
Parola ile kimlik do\u011frulama, kaba kuvvet sald\u0131r\u0131lar\u0131na kar\u015f\u0131 savunmas\u0131zd\u0131r. SSH anahtar \u00e7ifti (public\/private key) tabanl\u0131 kimlik do\u011frulama, \u00e7ok daha g\u00fcvenli bir y\u00f6ntemdir. Anahtar tabanl\u0131 kimlik do\u011frulamay\u0131 yap\u0131land\u0131rd\u0131ktan sonra, parola ile kimlik do\u011frulamay\u0131 devre d\u0131\u015f\u0131 b\u0131rakmal\u0131s\u0131n\u0131z. Bu ad\u0131m\u0131, anahtar tabanl\u0131 kimlik do\u011frulamay\u0131 tamamen kurup test etmeden yapmay\u0131n!<\/strong><\/p>\n
PasswordAuthentication no<\/code><\/pre>\n
Di\u011fer parola tabanl\u0131 kimlik do\u011frulama y\u00f6ntemlerini de devre d\u0131\u015f\u0131 b\u0131rakmak iyi bir uygulamad\u0131r:<\/p>\n
ChallengeResponseAuthentication no\nUsePAM yes  # Bu ayar genellikle kalabilir, PAM di\u011fer kimlik do\u011frulama mekanizmalar\u0131 i\u00e7in kullan\u0131labilir.<\/code><\/pre>\n
Belirli Kullan\u0131c\u0131lar\u0131 veya Gruplar\u0131 K\u0131s\u0131tlama<\/h4>\n
Yaln\u0131zca belirli kullan\u0131c\u0131lar\u0131n veya kullan\u0131c\u0131 gruplar\u0131n\u0131n SSH \u00fczerinden ba\u011flanmas\u0131na izin vererek eri\u015fimi daha da k\u0131s\u0131tlayabilirsiniz. Bu, sunucunuza eri\u015fmesi gerekmeyen hesaplar\u0131n yetkisiz kullan\u0131m\u0131n\u0131 \u00f6nler.<\/p>\n
AllowUsers [kullan\u0131c\u0131_ad\u01311] [kullan\u0131c\u0131_ad\u01312]<\/code><\/pre>\n
veya<\/p>\n
AllowGroups [grup_ad\u01311] [grup_ad\u01312]<\/code><\/pre>\n
Yaln\u0131zca AllowUsers<\/code> veya AllowGroups<\/code>‘tan birini kullanmal\u0131s\u0131n\u0131z. Her ikisini de kullan\u0131rsan\u0131z, kullan\u0131c\u0131lar\u0131n her iki ko\u015fulu da kar\u015f\u0131lamas\u0131 gerekir.<\/p>\n
Giri\u015f S\u00fcresini ve Deneme Say\u0131s\u0131n\u0131 S\u0131n\u0131rland\u0131rma<\/h4>\n
Kaba kuvvet sald\u0131r\u0131lar\u0131n\u0131 yava\u015flatmak ve engellemek i\u00e7in, giri\u015f denemeleri i\u00e7in tan\u0131nan s\u00fcreyi ve izin verilen maksimum deneme say\u0131s\u0131n\u0131 s\u0131n\u0131rlamak \u00f6nemlidir.<\/p>\n
LoginGraceTime 30  # Saniye cinsinden\nMaxAuthTries 3     # Maksimum kimlik do\u011frulama denemesi\nMaxSessions 2      # Bir kullan\u0131c\u0131 i\u00e7in izin verilen maksimum a\u00e7\u0131k SSH oturumu<\/code><\/pre>\n
Kimlik Do\u011frulama Mekanizmalar\u0131n\u0131 G\u00fc\u00e7lendirme<\/h3>\n
Kimlik do\u011frulama, SSH g\u00fcvenli\u011finin kalbidir. Bu b\u00f6l\u00fcm, anahtar tabanl\u0131 kimlik do\u011frulama ve iki fakt\u00f6rl\u00fc kimlik do\u011frulama (2FA) gibi daha g\u00fc\u00e7l\u00fc y\u00f6ntemleri ele almaktad\u0131r.<\/p>\n
Anahtar Tabanl\u0131 Kimlik Do\u011frulama<\/h4>\n
SSH anahtar \u00e7ifti, bir genel (public) ve bir \u00f6zel (private) anahtardan olu\u015fur. Genel anahtar sunucuda saklan\u0131r, \u00f6zel anahtar ise istemcinizde (bilgisayar\u0131n\u0131zda) tutulur ve asla payla\u015f\u0131lmaz. Bu y\u00f6ntem, parolalardan \u00e7ok daha g\u00fcvenlidir \u00e7\u00fcnk\u00fc \u00f6zel anahtar\u0131n \u00e7al\u0131nmas\u0131 veya tahmin edilmesi \u00e7ok daha zordur.<\/p>\n
1. SSH Anahtar \u00c7ifti Olu\u015fturma (\u0130stemci Taraf\u0131nda):<\/strong>
\nTerminalinizde a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
ssh-keygen -t ed25519 -C \"your_email@example.com\"<\/code><\/pre>\n
veya daha eski sistemler i\u00e7in RSA:<\/p>\n
ssh-keygen -t rsa -b 4096 -C \"your_email@example.com\"<\/code><\/pre>\n
Komut, anahtar \u00e7iftinin kaydedilece\u011fi yeri soracakt\u0131r (~\/.ssh\/id_ed25519<\/code> veya ~\/.ssh\/id_rsa<\/code>). Anahtar\u0131n\u0131za bir parola (passphrase) eklemek ek bir g\u00fcvenlik katman\u0131 sa\u011flar. Bu parola, \u00f6zel anahtar\u0131n\u0131z\u0131 her kulland\u0131\u011f\u0131n\u0131zda girmeniz gereken bir parolad\u0131r.<\/p>\n
2. Genel Anahtar\u0131 Sunucuya Kopyalama:<\/strong>
\nGenel anahtar\u0131n\u0131z\u0131 sunucuya kopyalaman\u0131n en kolay yolu ssh-copy-id<\/code> kullanmakt\u0131r:<\/p>\n
ssh-copy-id -i ~\/.ssh\/id_ed25519.pub [kullan\u0131c\u0131_ad\u0131]@[sunucu_ip_adresi] -p [yeni_ssh_portu]<\/code><\/pre>\n
E\u011fer ssh-copy-id<\/code> mevcut de\u011filse veya \u00e7al\u0131\u015fm\u0131yorsa, manuel olarak kopyalayabilirsiniz:<\/p>\n
cat ~\/.ssh\/id_ed25519.pub | ssh [kullan\u0131c\u0131_ad\u0131]@[sunucu_ip_adresi] -p [yeni_ssh_portu] \"mkdir -p ~\/.ssh && chmod 700 ~\/.ssh && cat >> ~\/.ssh\/authorized_keys && chmod 600 ~\/.ssh\/authorized_keys\"<\/code><\/pre>\n
3. Parola ile Kimlik Do\u011frulamay\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma (Sunucu Taraf\u0131nda):<\/strong>
\nGenel anahtar\u0131n\u0131z\u0131 sunucuya kopyalad\u0131ktan ve anahtar ile ba\u015far\u0131yla giri\u015f yapabildi\u011finizden emin olduktan sonra, \/etc\/ssh\/sshd_config<\/code> dosyas\u0131n\u0131 d\u00fczenleyerek PasswordAuthentication no<\/code> ayar\u0131n\u0131 etkinle\u015ftirin.<\/p>\n
PubkeyAuthentication yes  # Varsay\u0131lan olarak etkin olmal\u0131, kontrol edin.\nPasswordAuthentication no<\/code><\/pre>\n
\u0130ki Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (2FA) Entegrasyonu<\/h4>\n
Anahtar tabanl\u0131 kimlik do\u011frulama g\u00fc\u00e7l\u00fc olsa da, \u00f6zel anahtar\u0131n\u0131z\u0131n \u00e7al\u0131nmas\u0131 veya tehlikeye at\u0131lmas\u0131 durumunda hala bir risk olu\u015fturur. \u0130ki fakt\u00f6rl\u00fc kimlik do\u011frulama (2FA), bu riski azaltarak ek bir g\u00fcvenlik katman\u0131 sa\u011flar. Bu b\u00f6l\u00fcmde Google Authenticator kullanarak 2FA’y\u0131 nas\u0131l kuraca\u011f\u0131m\u0131z\u0131 inceleyece\u011fiz.<\/p>\n
1. Gerekli Paketleri Kurma:<\/strong><\/p>\n
sudo apt update\nsudo apt install libpam-google-authenticator<\/code><\/pre>\n
2. Google Authenticator’\u0131 Yap\u0131land\u0131rma (Kullan\u0131c\u0131 Taraf\u0131nda):<\/strong>
\nSSH ile sunucuya ba\u011flan\u0131n ve 2FA’y\u0131 kurmak istedi\u011finiz kullan\u0131c\u0131 hesab\u0131yla a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
google-authenticator<\/code><\/pre>\n
Komut size birka\u00e7 soru soracakt\u0131r:
\n*   Do you want authentication tokens to be time-based (y\/n)<\/code>: y<\/code>
\n*   Bu, bir QR kodu, bir gizli anahtar ve kurtarma kodlar\u0131 \u00fcretecektir. QR kodunu Google Authenticator (veya Authy gibi) uygulaman\u0131zla taray\u0131n. Gizli anahtar\u0131 ve kurtarma kodlar\u0131n\u0131 g\u00fcvenli bir yerde saklay\u0131n.
\n*   Do you want to update the .google_authenticator file? (y\/n)<\/code>: y<\/code>
\n*   Do you want to disallow multiple uses of the same authentication token? (y\/n)<\/code>: y<\/code> (\u00d6nerilir)
\n*   By default, tokens are good for 30 seconds. In order to compensate for possible time-sync problems between and your authentication device, a three-minute window is allowed. Do you want to extend the window to 5 minutes instead? (y\/n)<\/code>: n<\/code> (Daha dar bir zaman penceresi daha g\u00fcvenlidir)
\n*   Do you want to enable rate-limiting of authentication attempts? (y\/n)<\/code>: y<\/code> (Kaba kuvvet sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar)<\/p>\n
3. PAM Mod\u00fcl\u00fcn\u00fc SSH’e Entegre Etme:<\/strong>
\n\/etc\/pam.d\/sshd<\/code> dosyas\u0131n\u0131 d\u00fczenleyin:<\/p>\n
sudo nano \/etc\/pam.d\/sshd<\/code><\/pre>\n
Dosyan\u0131n en alt\u0131na a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin:<\/p>\n
auth required pam_google_authenticator.so<\/code><\/pre>\n
4. SSH Daemon Yap\u0131land\u0131rmas\u0131n\u0131 De\u011fi\u015ftirme:<\/strong>
\n\/etc\/ssh\/sshd_config<\/code> dosyas\u0131n\u0131 tekrar a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/code><\/pre>\n
A\u015fa\u011f\u0131daki sat\u0131rlar\u0131n yorum i\u015faretlerini kald\u0131r\u0131n veya ekleyin\/de\u011fi\u015ftirin:<\/p>\n
#ChallengeResponseAuthentication no  # Bu sat\u0131r\u0131 yorumdan kald\u0131r\u0131n ve 'yes' yap\u0131n.\nChallengeResponseAuthentication yes\n\n#UsePAM yes  # Bu sat\u0131r\u0131n yorumdan kald\u0131r\u0131ld\u0131\u011f\u0131ndan ve 'yes' oldu\u011fundan emin olun.\nUsePAM yes\n\n
E\u011fer sadece anahtar tabanl\u0131 kimlik do\u011frulama ve 2FA kullanmak istiyorsan\u0131z:<\/h2>\nAuthenticationMethods publickey,keyboard-interactive\n
Bu ayar, kullan\u0131c\u0131lar\u0131n \u00f6nce anahtar ile kimlik do\u011frulamas\u0131 yapmas\u0131n\u0131, ard\u0131ndan 2FA kodunu girmesini gerektirir.<\/h2>\n
E\u011fer parola ve 2FA kullanmak istiyorsan\u0131z:<\/h2>\n
AuthenticationMethods password,keyboard-interactive<\/code><\/pre>\n<\/h2>\n
De\u011fi\u015fiklikleri kaydedin ve SSH hizmetini yeniden ba\u015flat\u0131n:<\/p>\n
sudo systemctl restart sshd<\/code><\/pre>\n
\u015eimdi yeni bir SSH oturumu ba\u015flatt\u0131\u011f\u0131n\u0131zda, \u00f6nce \u00f6zel anahtar\u0131n\u0131z\u0131n parolas\u0131n\u0131 (e\u011fer ayarlad\u0131ysan\u0131z), ard\u0131ndan Google Authenticator uygulaman\u0131zdan gelen kodu girmeniz istenecektir.<\/p>\n
Protokol ve \u015eifreleme Ayarlar\u0131<\/h3>\n
SSH ileti\u015fimi i\u00e7in kullan\u0131lan protokol s\u00fcr\u00fcm\u00fcn\u00fc, \u015fifreleme algoritmalar\u0131n\u0131 (Ciphers), mesaj do\u011frulama kodlar\u0131n\u0131 (MACs) ve anahtar de\u011fi\u015fimi algoritmalar\u0131n\u0131 (KexAlgorithms) s\u0131n\u0131rlamak, eski ve zay\u0131f algoritmalar\u0131n kullan\u0131m\u0131n\u0131 engelleyerek g\u00fcvenli\u011fi art\u0131r\u0131r.<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/code><\/pre>\n
Protokol S\u00fcr\u00fcm\u00fc<\/h4>\n
Yaln\u0131zca Protokol 2’yi kullan\u0131n. Protokol 1, bilinen g\u00fcvenlik a\u00e7\u0131klar\u0131na sahiptir ve art\u0131k kullan\u0131lmamal\u0131d\u0131r. Ubuntu 20.04’te varsay\u0131lan olarak Protokol 2 kullan\u0131l\u0131r, ancak yine de kontrol etmek iyi bir uygulamad\u0131r.<\/p>\n
Protocol 2<\/code><\/pre>\n
\u015eifreleme Algoritmalar\u0131 (Ciphers)<\/h4>\n
Yaln\u0131zca modern ve g\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131n\u0131 kullan\u0131n. Eski veya zay\u0131f algoritmalar\u0131 devre d\u0131\u015f\u0131 b\u0131rak\u0131n. A\u015fa\u011f\u0131daki liste, yayg\u0131n olarak kabul g\u00f6rm\u00fc\u015f g\u00fc\u00e7l\u00fc algoritmalar\u0131 i\u00e7erir:<\/p>\n
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr<\/code><\/pre>\n
Mesaj Do\u011frulama Kodlar\u0131 (MACs)<\/h4>\n
MAC’ler, verilerin iletim s\u0131ras\u0131nda de\u011fi\u015ftirilmedi\u011finden emin olmak i\u00e7in kullan\u0131l\u0131r. G\u00fc\u00e7l\u00fc ve modern MAC’leri tercih edin:<\/p>\n
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com<\/code><\/pre>\n
Anahtar De\u011fi\u015fimi Algoritmalar\u0131 (KexAlgorithms)<\/h4>\n
Anahtar de\u011fi\u015fimi, g\u00fcvenli bir ileti\u015fim oturumu i\u00e7in \u015fifreleme anahtarlar\u0131n\u0131n nas\u0131l olu\u015fturuldu\u011funu belirler. G\u00fc\u00e7l\u00fc anahtar de\u011fi\u015fimi algoritmalar\u0131n\u0131 kullan\u0131n:<\/p>\n
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256<\/code><\/pre>\n
Bu de\u011fi\u015fiklikleri yapt\u0131ktan sonra SSH hizmetini yeniden ba\u015flatmay\u0131 unutmay\u0131n:<\/p>\n
sudo systemctl restart sshd<\/code><\/pre>\n
Ek G\u00fcvenlik \u00d6nlemleri<\/h3>\n
OpenSSH yap\u0131land\u0131rmas\u0131n\u0131n \u00f6tesinde, sunucunuzun genel g\u00fcvenli\u011fini art\u0131racak ek \u00f6nlemler de bulunmaktad\u0131r.<\/p>\n
Firewall Kurulumu ve Yap\u0131land\u0131rmas\u0131 (UFW)<\/h4>\n
Uncomplicated Firewall (UFW), Ubuntu’da g\u00fcvenlik duvar\u0131n\u0131 y\u00f6netmek i\u00e7in kullan\u0131c\u0131 dostu bir aray\u00fczd\u00fcr. Yaln\u0131zca belirli portlardan gelen ba\u011flant\u0131lara izin vererek sunucunuzu korumak i\u00e7in hayati \u00f6neme sahiptir.<\/p>\n
1. UFW’yi Kurma (E\u011fer kurulu de\u011filse):<\/strong><\/p>\n
sudo apt update\nsudo apt install ufw<\/code><\/pre>\n
2. Varsay\u0131lan Kurallar\u0131 Ayarlama:<\/strong><\/p>\n
sudo ufw default deny incoming\nsudo ufw default allow outgoing<\/code><\/pre>\n
3. Yeni SSH Portunuza \u0130zin Verme:<\/strong>
\nsshd_config<\/code> dosyas\u0131nda belirledi\u011finiz yeni SSH portunuza izin verin. \u00d6rne\u011fin, 22222 portunu kulland\u0131ysan\u0131z:<\/p>\n
sudo ufw allow 22222\/tcp<\/code><\/pre>\n
Di\u011fer gerekli portlara da izin vermeyi unutmay\u0131n (\u00f6rn. HTTP\/HTTPS i\u00e7in 80\/tcp, 443\/tcp).<\/p>\n
4. UFW’yi Etkinle\u015ftirme:<\/strong><\/p>\n
sudo ufw enable<\/code><\/pre>\n
Bu komut, mevcut SSH ba\u011flant\u0131n\u0131z\u0131 kesebilir, bu y\u00fczden dikkatli olun. UFW etkinle\u015ftirmeden \u00f6nce yeni SSH portunuza izin verdi\u011finizden emin olun.<\/p>\n
5. UFW Durumunu Kontrol Etme:<\/strong><\/p>\n
sudo ufw status verbose<\/code><\/pre>\n
Fail2Ban Entegrasyonu<\/h4>\n
Fail2Ban, sunucu g\u00fcnl\u00fck dosyalar\u0131n\u0131 (log files) izleyen ve tekrar eden ba\u015far\u0131s\u0131z giri\u015f denemeleri yapan IP adreslerini otomatik olarak engelleyen bir intrusion prevention (sald\u0131r\u0131 \u00f6nleme) yaz\u0131l\u0131m\u0131d\u0131r. \u00d6zellikle kaba kuvvet sald\u0131r\u0131lar\u0131na kar\u015f\u0131 \u00e7ok etkilidir.<\/p>\n
1. Fail2Ban Kurulumu:<\/strong><\/p>\n
sudo apt update\nsudo apt install fail2ban<\/code><\/pre>\n
2. Fail2Ban Yap\u0131land\u0131rmas\u0131:<\/strong>
\nFail2Ban’\u0131n varsay\u0131lan yap\u0131land\u0131rma dosyas\u0131 \/etc\/fail2ban\/jail.conf<\/code>‘tur. Bu dosyay\u0131 do\u011frudan d\u00fczenlemek yerine, de\u011fi\u015fiklikleri \/etc\/fail2ban\/jail.local<\/code> dosyas\u0131na yapmal\u0131s\u0131n\u0131z. Bu, yaz\u0131l\u0131m g\u00fcncellemeleri s\u0131ras\u0131nda yap\u0131land\u0131rman\u0131z\u0131n \u00fczerine yaz\u0131lmas\u0131n\u0131 \u00f6nler.<\/p>\n
sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local\nsudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre>\n
jail.local<\/code> dosyas\u0131nda, SSH b\u00f6l\u00fcm\u00fcn\u00fc bulun ve a\u015fa\u011f\u0131daki gibi ayarlamalar yap\u0131n:<\/p>\n
[sshd]\nenabled = true\nport = 22222  # SSH i\u00e7in belirledi\u011finiz yeni portu buraya yaz\u0131n\nfilter = sshd\nlogpath = \/var\/log\/auth.log\nmaxretry = 3  # Bir IP adresinin engellenmeden \u00f6nceki ba\u015far\u0131s\u0131z deneme say\u0131s\u0131\nbantime = 1h  # Engelleme s\u00fcresi (1 saat)\nfindtime = 10m # Belirtilen 'maxretry' say\u0131s\u0131n\u0131n 'findtime' s\u00fcresi i\u00e7inde ger\u00e7ekle\u015fmesi gerekir<\/code><\/pre>\n
maxretry<\/code>, bantime<\/code> ve findtime<\/code> de\u011ferlerini kendi g\u00fcvenlik politikan\u0131za g\u00f6re ayarlayabilirsiniz.<\/p>\n
3. Fail2Ban Hizmetini Yeniden Ba\u015flatma:<\/strong><\/p>\n
sudo systemctl restart fail2ban<\/code><\/pre>\n
4. Fail2Ban Durumunu Kontrol Etme:<\/strong><\/p>\n
sudo fail2ban-client status sshd<\/code><\/pre>\n
SSH Banner Kullan\u0131m\u0131<\/h4>\n
SSH banner, kullan\u0131c\u0131lar giri\u015f yapmadan \u00f6nce onlara g\u00f6sterilen bir mesajd\u0131r. Bu mesaj, yasal uyar\u0131lar, kullan\u0131m politikalar\u0131 veya sunucunun \u00f6zel bir amaca hizmet etti\u011fini belirten bilgiler i\u00e7erebilir.<\/p>\n
1. Banner Dosyas\u0131n\u0131 Olu\u015fturma:<\/strong><\/p>\n
sudo nano \/etc\/issue.net<\/code><\/pre>\n
Dosyaya istedi\u011finiz mesaj\u0131 yaz\u0131n. \u00d6rne\u011fin:<\/p>\n
UYARI: Bu sunucuya yetkisiz eri\u015fim kesinlikle yasakt\u0131r. T\u00fcm ba\u011flant\u0131lar izlenmektedir.<\/code><\/pre>\n
2. sshd_config Dosyas\u0131n\u0131 G\u00fcncelleme:<\/strong>
\n\/etc\/ssh\/sshd_config<\/code> dosyas\u0131n\u0131 d\u00fczenleyin ve Banner<\/code> direktifini ekleyin veya yorumdan kald\u0131r\u0131n:<\/p>\n
Banner \/etc\/issue.net<\/code><\/pre>\n
SSH hizmetini yeniden ba\u015flat\u0131n:<\/p>\n
sudo systemctl restart sshd<\/code><\/pre>\n
Dosya \u0130zinlerini Kontrol Etme<\/h4>\n
SSH ile ilgili dosyalar\u0131n do\u011fru dosya izinlerine sahip olmas\u0131, yetkisiz kullan\u0131c\u0131lar\u0131n hassas bilgilere eri\u015fmesini veya yap\u0131land\u0131rmay\u0131 de\u011fi\u015ftirmesini engellemek i\u00e7in kritik \u00f6neme sahiptir.<\/p>\n
*   \/etc\/ssh\/sshd_config<\/code>:<\/strong> Yaln\u0131zca root taraf\u0131ndan okunabilir olmal\u0131d\u0131r.<\/p>\n
sudo chmod 600 \/etc\/ssh\/sshd_config<\/code><\/pre>\n
*   ~\/.ssh<\/code> dizini:<\/strong> Yaln\u0131zca kullan\u0131c\u0131n\u0131n kendisi taraf\u0131ndan eri\u015filebilir olmal\u0131d\u0131r.<\/p>\n
chmod 700 ~\/.ssh<\/code><\/pre>\n
*   ~\/.ssh\/authorized_keys<\/code>:<\/strong> Yaln\u0131zca kullan\u0131c\u0131n\u0131n kendisi taraf\u0131ndan okunabilir olmal\u0131d\u0131r.<\/p>\n
chmod 600 ~\/.ssh\/authorized_keys<\/code><\/pre>\n
*   Kullan\u0131c\u0131 Ana Dizini (~<\/code>):<\/strong> Kullan\u0131c\u0131n\u0131n ana dizini ba\u015fkalar\u0131 taraf\u0131ndan yaz\u0131labilir olmamal\u0131d\u0131r.<\/p>\n
chmod go-w ~<\/code><\/pre>\n
Loglama ve \u0130zleme<\/h4>\n
SSH etkinliklerinin do\u011fru \u015fekilde g\u00fcnl\u00fc\u011fe kaydedilmesi, g\u00fcvenlik olaylar\u0131n\u0131 tespit etmek ve sorunlar\u0131 gidermek i\u00e7in \u00f6nemlidir.<\/p>\n
sshd_config<\/code> dosyas\u0131nda LogLevel<\/code> ayar\u0131n\u0131 VERBOSE<\/code> olarak ayarlayarak daha ayr\u0131nt\u0131l\u0131 g\u00fcnl\u00fck kayd\u0131 sa\u011flayabilirsiniz:<\/p>\n
LogLevel VERBOSE<\/code><\/pre>\n
Bu, \/var\/log\/auth.log<\/code> (veya sisteminizin yap\u0131land\u0131rmas\u0131na ba\u011fl\u0131 olarak di\u011fer g\u00fcnl\u00fck dosyalar\u0131nda) daha fazla bilgi g\u00f6rmenizi sa\u011flar. Bu g\u00fcnl\u00fckleri d\u00fczenli olarak kontrol etmek veya bir SIEM (Security Information and Event Management) sistemi ile entegre etmek, anormallikleri h\u0131zla tespit etmenize yard\u0131mc\u0131 olabilir.<\/p>\n
SSH \u0130stemci Taraf\u0131 G\u00fcvenli\u011fi<\/h3>\n
Sunucu taraf\u0131 g\u00fcvenli\u011finin yan\u0131 s\u0131ra, SSH istemcinizin de g\u00fcvenli oldu\u011fundan emin olmak \u00f6nemlidir. Bu, ~\/.ssh\/config<\/code> dosyas\u0131n\u0131 kullanarak belirli sunuculara ba\u011flan\u0131rken daha s\u0131k\u0131 kurallar uygulayarak yap\u0131labilir.<\/p>\n
nano ~\/.ssh\/config<\/code><\/pre>\n
\u00d6rnek bir yap\u0131land\u0131rma:<\/p>\n
Host my_secure_server\n    Hostname [sunucu_ip_adresi]\n    User [kullan\u0131c\u0131_ad\u0131]\n    Port 22222\n    IdentityFile ~\/.ssh\/id_ed25519\n    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com\n    MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openspe.com\n    KexAlgorithms curve25519-sha256\n    ServerAliveInterval 60\n    ServerAliveCountMax 3<\/code><\/pre>\n
Bu, ssh my_secure_server<\/code> komutunu kullanarak sunucunuza ba\u011flan\u0131rken belirli, g\u00fc\u00e7l\u00fc algoritmalar\u0131n kullan\u0131lmas\u0131n\u0131 zorlar.<\/p>\n
De\u011fi\u015fiklikleri Uygulama ve Test Etme<\/h3>\n
T\u00fcm yap\u0131land\u0131rma de\u011fi\u015fikliklerini yapt\u0131ktan sonra, SSH hizmetini yeniden ba\u015flatmadan \u00f6nce syntax hatas\u0131 olup olmad\u0131\u011f\u0131n\u0131 kontrol etmek \u00e7ok \u00f6nemlidir.<\/p>\n
sudo sshd -t<\/code><\/pre>\n
E\u011fer komut herhangi bir \u00e7\u0131kt\u0131 vermezse, yap\u0131land\u0131rma dosyan\u0131zda bir syntax hatas\u0131 yoktur. E\u011fer hata varsa, hata mesaj\u0131n\u0131 d\u00fczelterek tekrar deneyin.<\/p>\n
Ard\u0131ndan, SSH hizmetini yeniden ba\u015flat\u0131n:<\/p>\n
sudo systemctl restart sshd<\/code><\/pre>\n
\u00c7ok \u00d6nemli:<\/strong> Mevcut SSH oturumunuzu kapatmadan \u00f6nce, yeni bir terminal penceresi a\u00e7\u0131n veya farkl\u0131 bir makineden yeni ayarlar\u0131n\u0131zla ba\u011flant\u0131 kurmaya \u00e7al\u0131\u015f\u0131n. Ba\u011flant\u0131 ba\u015far\u0131l\u0131 olursa, mevcut oturumunuzu g\u00fcvenle kapatabilirsiniz. E\u011fer ba\u011flanamazsan\u0131z, mevcut oturumunuzdan sshd_config<\/code> dosyas\u0131n\u0131 eski haline getirebilir veya sorunlar\u0131 giderebilirsiniz.<\/p>\n
Periyodik Bak\u0131m ve G\u00fcncellemeler<\/h3>\n
G\u00fcvenlik, tek seferlik bir i\u015flem de\u011fildir. S\u00fcrekli dikkat ve bak\u0131m gerektirir.<\/p>\n
*   Sistem G\u00fcncellemeleri:<\/strong> Ubuntu sisteminizi ve y\u00fckl\u00fc paketleri d\u00fczenli olarak g\u00fcncelleyin. Bu, OpenSSH’in ve di\u011fer sistem bile\u015fenlerinin en son g\u00fcvenlik yamalar\u0131na sahip olmas\u0131n\u0131 sa\u011flar.<\/p>\n
sudo apt update && sudo apt upgrade -y\n    sudo apt dist-upgrade -y\n    sudo apt autoremove -y<\/code><\/pre>\n
*   Yap\u0131land\u0131rma \u0130ncelemesi:<\/strong> sshd_config<\/code> dosyan\u0131z\u0131 ve di\u011fer g\u00fcvenlik ayarlar\u0131n\u0131z\u0131 periyodik olarak g\u00f6zden ge\u00e7irin. Yeni g\u00fcvenlik a\u00e7\u0131klar\u0131 veya en iyi uygulamalar ortaya \u00e7\u0131kt\u0131k\u00e7a ayarlar\u0131n\u0131z\u0131 g\u00fcncelleyin.
\n*   G\u00fcnl\u00fckleri \u0130zleme:<\/strong> auth.log<\/code> dosyas\u0131n\u0131 ve Fail2Ban g\u00fcnl\u00fcklerini d\u00fczenli olarak kontrol edin. Anormal giri\u015f denemeleri veya di\u011fer \u015f\u00fcpheli etkinlikler i\u00e7in dikkatli olun.<\/p>\n
Sonu\u00e7<\/h3>\n
OpenSSH’i Ubuntu 20.04 \u00fczerinde sertle\u015ftirmek, sunucu g\u00fcvenli\u011finiz i\u00e7in atabilece\u011finiz en \u00f6nemli ad\u0131mlardan biridir. Varsay\u0131lan portu de\u011fi\u015ftirme, root giri\u015fini devre d\u0131\u015f\u0131 b\u0131rakma, parola ile kimlik do\u011frulamay\u0131 b\u0131rak\u0131p anahtar tabanl\u0131 kimlik do\u011frulamay\u0131 kullanma, iki fakt\u00f6rl\u00fc kimlik do\u011frulamay\u0131 etkinle\u015ftirme, g\u00fc\u00e7l\u00fc \u015fifreleme algoritmalar\u0131n\u0131 zorlama ve Fail2Ban gibi ek g\u00fcvenlik ara\u00e7lar\u0131n\u0131 kullanma gibi ad\u0131mlar, sunucunuzu siber tehditlere kar\u015f\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirecektir.<\/p>\n
Unutmay\u0131n ki g\u00fcvenlik, katmanl\u0131 bir yakla\u015f\u0131md\u0131r. Bu rehberdeki ad\u0131mlar\u0131 uygulayarak OpenSSH’inizi b\u00fcy\u00fck \u00f6l\u00e7\u00fcde g\u00fcvenli hale getirmi\u015f olsan\u0131z da, genel sistem g\u00fcvenli\u011finiz i\u00e7in di\u011fer alanlarda da (uygulama g\u00fcvenli\u011fi, a\u011f g\u00fcvenli\u011fi, d\u00fczenli yedeklemeler vb.) dikkatli olmaya devam etmelisiniz. D\u00fczenli bak\u0131m ve g\u00fcncellemelerle birlikte, bu sertle\u015ftirme teknikleri sunucular\u0131n\u0131z\u0131n uzun vadede g\u00fcvende kalmas\u0131na yard\u0131mc\u0131 olacakt\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi\nSunuculara uzaktan eri\u015fim sa\u011flamak i\u00e7in kullan\u0131lan en yayg\u0131n pro","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-33426","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nOpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi\" \/>\n<meta property=\"og:description\" content=\"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi Sunuculara uzaktan eri\u015fim sa\u011flamak i\u00e7in kullan\u0131lan en yayg\u0131n pro\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-02T16:41:09+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi\",\"datePublished\":\"2025-11-02T16:41:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\"},\"wordCount\":2663,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\",\"name\":\"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-02T16:41:09+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi","og_description":"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi Sunuculara uzaktan eri\u015fim sa\u011flamak i\u00e7in kullan\u0131lan en yayg\u0131n pro","og_url":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-02T16:41:09+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"17 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi","datePublished":"2025-11-02T16:41:09+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/"},"wordCount":2663,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/","name":"OpenSSH'i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-02T16:41:09+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/opensshi-ubuntu-20-04-uzerinde-sertlestirme-kapsamli-bir-guvenlik-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"OpenSSH’i Ubuntu 20.04 \u00dczerinde Sertle\u015ftirme: Kapsaml\u0131 Bir G\u00fcvenlik Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=33426"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33426\/revisions"}],"predecessor-version":[{"id":33427,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33426\/revisions\/33427"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=33426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=33426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=33426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}