{"id":35312,"date":"2025-11-28T05:40:49","date_gmt":"2025-11-28T02:40:49","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=35312"},"modified":"2025-11-28T05:40:49","modified_gmt":"2025-11-28T02:40:49","slug":"ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/","title":{"rendered":"Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak"},"content":{"rendered":"

<\/p>\n

Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak<\/h2>\n

Giri\u015f: Ayr\u0131cal\u0131k Y\u00fckseltme ve Ansible’\u0131n Rol\u00fc<\/h3>\n

Modern IT altyap\u0131lar\u0131n\u0131n karma\u015f\u0131kl\u0131\u011f\u0131, sistem y\u00f6netimi ve yap\u0131land\u0131rma s\u00fcre\u00e7lerini otomatikle\u015ftirmeyi ka\u00e7\u0131n\u0131lmaz hale getirmi\u015ftir. Bu otomasyon ara\u00e7lar\u0131n\u0131n ba\u015f\u0131nda gelen Ansible, basit ve ajans\u0131z yap\u0131s\u0131yla \u00f6ne \u00e7\u0131kmaktad\u0131r. Ancak, otomasyonun getirdi\u011fi kolayl\u0131klar\u0131n yan\u0131 s\u0131ra, sistemler \u00fczerinde yap\u0131lan i\u015flemlerin \u00e7o\u011fu zaman y\u00f6netici (root) ayr\u0131cal\u0131klar\u0131 gerektirmesi, “ayr\u0131cal\u0131k y\u00fckseltme” (privilege escalation) kavram\u0131n\u0131 merkezi bir konuma ta\u015f\u0131r. Ayr\u0131cal\u0131k y\u00fckseltme, bir kullan\u0131c\u0131n\u0131n veya s\u00fcrecin, normalde sahip oldu\u011fundan daha y\u00fcksek bir g\u00fcvenlik seviyesinde i\u015flemler ger\u00e7ekle\u015ftirmesine olanak tan\u0131yan bir mekanizmad\u0131r. Bu, sistem g\u00fcvenli\u011fi i\u00e7in kritik bir konu olup, do\u011fru y\u00f6netilmedi\u011finde ciddi g\u00fcvenlik riskleri olu\u015fturabilir.<\/p>\n

Ansible, sistemlerde dosya kurulumu, servis ba\u015flatma\/durdurma, kullan\u0131c\u0131 y\u00f6netimi, a\u011f yap\u0131land\u0131rmas\u0131 gibi bir\u00e7ok g\u00f6revi yerine getirirken genellikle y\u00f6netici ayr\u0131cal\u0131klar\u0131na ihtiya\u00e7 duyar. \u00d6rne\u011fin, bir paketi kurmak veya bir sistem servisini yeniden ba\u015flatmak i\u00e7in hedef makinede root yetkisine sahip olmak gerekir. Ansible, bu t\u00fcr i\u015flemleri g\u00fcvenli ve verimli bir \u015fekilde ger\u00e7ekle\u015ftirebilmek i\u00e7in g\u00fc\u00e7l\u00fc ve esnek ayr\u0131cal\u0131k y\u00fckseltme mekanizmalar\u0131 sunar. Bu makalede, Ansible playbook’lar\u0131nda ayr\u0131cal\u0131k y\u00fckseltmenin ne oldu\u011funu, nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, neden gerekli oldu\u011funu, en iyi uygulamalar\u0131n\u0131, g\u00fcvenlik \u00e7\u0131kar\u0131mlar\u0131n\u0131 ve s\u0131k kar\u015f\u0131la\u015f\u0131lan sorunlar\u0131 detayl\u0131 bir \u015fekilde inceleyece\u011fiz. Amac\u0131m\u0131z, Ansible kullan\u0131c\u0131lar\u0131n\u0131n ayr\u0131cal\u0131k y\u00fckseltme \u00f6zelli\u011fini hem etkin hem de g\u00fcvenli bir \u015fekilde kullanmalar\u0131n\u0131 sa\u011flamakt\u0131r.<\/p>\n

Ansible’da Ayr\u0131cal\u0131k Y\u00fckseltme Mekanizmalar\u0131<\/h3>\n

Ansible, hedef makinelerde ayr\u0131cal\u0131k y\u00fckseltme i\u015flemlerini y\u00f6netmek i\u00e7in bir dizi anahtar kelime ve mekanizma sunar. Bu mekanizmalar, playbook’lar\u0131n veya belirli g\u00f6revlerin (tasks) hangi yetki seviyesiyle \u00e7al\u0131\u015faca\u011f\u0131n\u0131 belirlememizi sa\u011flar.<\/p>\n

become<\/code> Anahtar Kelimesi<\/h4>\n

Ansible’da ayr\u0131cal\u0131k y\u00fckseltmenin temelini become<\/code> anahtar kelimesi olu\u015fturur. Bu anahtar kelime, bir playbook’un tamam\u0131n\u0131n veya belirli bir g\u00f6revin y\u00f6netici ayr\u0131cal\u0131klar\u0131yla \u00e7al\u0131\u015fmas\u0131n\u0131 istedi\u011fimizi belirtir. Varsay\u0131lan olarak false<\/code> olan become<\/code>, true<\/code> olarak ayarland\u0131\u011f\u0131nda Ansible’a hedef makinede ayr\u0131cal\u0131k y\u00fckseltme yapmas\u0131 talimat\u0131n\u0131 verir.<\/p>\n

\u00d6rnek:<\/strong><\/p>\n

---\n- name: Web sunucusunu yap\u0131land\u0131r\n  hosts: webservers\n  become: true # Bu playbook'taki t\u00fcm g\u00f6revler ayr\u0131cal\u0131k y\u00fckseltme ile \u00e7al\u0131\u015facak\n  tasks:\n    - name: Apache paketini kur\n      ansible.builtin.package:\n        name: apache2\n        state: present\n    - name: Apache servisini ba\u015flat\n      ansible.builtin.service:\n        name: apache2\n        state: started\n        enabled: true<\/code><\/pre>\n
Yukar\u0131daki \u00f6rnekte, become: true<\/code> ifadesi, webservers<\/code> grubundaki t\u00fcm ana makinelerde Apache paketinin kurulmas\u0131 ve servisinin ba\u015flat\u0131lmas\u0131 g\u00f6revlerinin y\u00f6netici yetkileriyle ger\u00e7ekle\u015ftirilece\u011fini belirtir.<\/p>\n
become<\/code> anahtar kelimesi, playbook seviyesinde kullan\u0131labilece\u011fi gibi, belirli bir g\u00f6reve \u00f6zg\u00fc olarak da ayarlanabilir. Bu, “en az ayr\u0131cal\u0131k” prensibini uygulamak i\u00e7in olduk\u00e7a \u00f6nemlidir.<\/p>\n
\u00d6rnek (G\u00f6rev seviyesinde become<\/code>):<\/strong><\/p>\n
---\n- name: Kullan\u0131c\u0131 ve dizin olu\u015fturma\n  hosts: all\n  tasks:\n    - name: Yeni bir kullan\u0131c\u0131 olu\u015ftur\n      ansible.builtin.user:\n        name: devops_user\n        state: present\n        shell: \/bin\/bash\n      become: true # Sadece bu g\u00f6rev ayr\u0131cal\u0131k y\u00fckseltme ile \u00e7al\u0131\u015f\u0131r\n\n    - name: Kullan\u0131c\u0131n\u0131n ev dizininde bir dosya olu\u015ftur\n      ansible.builtin.file:\n        path: \/home\/devops_user\/README.md\n        state: touch\n        owner: devops_user\n        group: devops_user\n        mode: '0644'\n      # Bu g\u00f6rev varsay\u0131lan (d\u00fc\u015f\u00fck) ayr\u0131cal\u0131kla \u00e7al\u0131\u015f\u0131r<\/code><\/pre>\n
Bu senaryoda, devops_user<\/code> kullan\u0131c\u0131s\u0131n\u0131 olu\u015fturmak i\u00e7in y\u00f6netici yetkileri gerekirken, kullan\u0131c\u0131n\u0131n kendi ev dizininde bir dosya olu\u015fturmak i\u00e7in bu yetkilere ihtiya\u00e7 duyulmaz. Bu, gereksiz ayr\u0131cal\u0131k kullan\u0131m\u0131n\u0131 \u00f6nler.<\/p>\n
become_method<\/code> Anahtar Kelimesi<\/h4>\n
become<\/code> anahtar kelimesi, ayr\u0131cal\u0131k y\u00fckseltme yap\u0131laca\u011f\u0131n\u0131 belirtirken, become_method<\/code> anahtar kelimesi bu y\u00fckseltmenin hangi y\u00f6ntemle ger\u00e7ekle\u015ftirilece\u011fini tan\u0131mlar. Ansible, \u00e7e\u015fitli ayr\u0131cal\u0131k y\u00fckseltme y\u00f6ntemlerini destekler:<\/p>\n
*   sudo<\/code> (Varsay\u0131lan):<\/strong> En yayg\u0131n kullan\u0131lan y\u00f6ntemdir. Bir kullan\u0131c\u0131n\u0131n ba\u015fka bir kullan\u0131c\u0131 olarak (genellikle root) komut \u00e7al\u0131\u015ft\u0131rmas\u0131na izin verir. sudoers<\/code> dosyas\u0131 arac\u0131l\u0131\u011f\u0131yla yap\u0131land\u0131r\u0131l\u0131r.
\n*   su<\/code>:<\/strong> Mevcut kullan\u0131c\u0131n\u0131n kimli\u011fini ba\u015fka bir kullan\u0131c\u0131ya (genellikle root) ge\u00e7ici olarak de\u011fi\u015ftirmek i\u00e7in kullan\u0131l\u0131r. sudo<\/code>‘dan farkl\u0131 olarak, su<\/code> genellikle hedef kullan\u0131c\u0131n\u0131n parolas\u0131n\u0131 gerektirir.
\n*   pbrun<\/code>:<\/strong> PowerBroker (BeyondTrust) taraf\u0131ndan sa\u011flanan bir ayr\u0131cal\u0131k y\u00fckseltme arac\u0131d\u0131r.
\n*   doas<\/code>:<\/strong> OpenBSD’de sudo<\/code>‘ya alternatif olarak geli\u015ftirilmi\u015f basit bir ayr\u0131cal\u0131k y\u00fckseltme arac\u0131d\u0131r.
\n*   dzdo<\/code>:<\/strong> Dell EMC’nin Delinea (eski ad\u0131yla Quest ActiveRoles Server) \u00e7\u00f6z\u00fcm\u00fcn\u00fcn bir par\u00e7as\u0131d\u0131r.
\n*   ksu<\/code>:<\/strong> Kerberos kimlik do\u011frulamas\u0131 kullanan sistemlerde ayr\u0131cal\u0131k y\u00fckseltme i\u00e7in kullan\u0131l\u0131r.
\n*   runas<\/code>:<\/strong> Windows sistemlerinde belirli bir kullan\u0131c\u0131 ba\u011flam\u0131nda komut \u00e7al\u0131\u015ft\u0131rmak i\u00e7in kullan\u0131l\u0131r.
\n*   sesu<\/code>:<\/strong> Hitachi’nin JP1\/Cm2 Privilege Escalation Manager \u00fcr\u00fcn\u00fcyle entegrasyon sa\u011flar.<\/p>\n
En yayg\u0131n kullan\u0131lan y\u00f6ntemler sudo<\/code> ve su<\/code>‘dur. sudo<\/code>, genellikle daha esnek ve g\u00fcvenli kabul edilir \u00e7\u00fcnk\u00fc sudoers<\/code> dosyas\u0131 arac\u0131l\u0131\u011f\u0131yla hangi kullan\u0131c\u0131lar\u0131n hangi komutlar\u0131 hangi ayr\u0131cal\u0131klarla \u00e7al\u0131\u015ft\u0131rabilece\u011fi \u00fczerinde ayr\u0131nt\u0131l\u0131 kontrol sa\u011flar.<\/p>\n
\u00d6rnek (become_method<\/code> kullan\u0131m\u0131):<\/strong><\/p>\n
---\n- name: Belirli bir kullan\u0131c\u0131ya ge\u00e7i\u015f yaparak i\u015flem yap\n  hosts: database_servers\n  become: true\n  become_method: su # su komutu ile ayr\u0131cal\u0131k y\u00fckselt\n  become_user: postgres # postgres kullan\u0131c\u0131s\u0131na ge\u00e7\n  tasks:\n    - name: PostgreSQL veritaban\u0131 yede\u011fi al\n      ansible.builtin.command: pg_dumpall > \/var\/lib\/postgresql\/backup\/all_databases.sql\n      # Bu komut postgres kullan\u0131c\u0131s\u0131 olarak \u00e7al\u0131\u015facak<\/code><\/pre>\n
Bu \u00f6rnekte, database_servers<\/code> grubundaki makinelerde su<\/code> y\u00f6ntemi kullan\u0131larak postgres<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7i\u015f yap\u0131l\u0131r ve veritaban\u0131 yedekleme i\u015flemi bu kullan\u0131c\u0131n\u0131n yetkileriyle ger\u00e7ekle\u015ftirilir.<\/p>\n
become_user<\/code> Anahtar Kelimesi<\/h4>\n
become_user<\/code> anahtar kelimesi, ayr\u0131cal\u0131k y\u00fckseltme i\u015flemi s\u0131ras\u0131nda hangi kullan\u0131c\u0131ya ge\u00e7ilece\u011fini belirtir. Varsay\u0131lan olarak, bu kullan\u0131c\u0131 root<\/code>‘tur. Ancak, \u00e7o\u011fu zaman root<\/code> kullan\u0131c\u0131s\u0131 yerine daha az ayr\u0131cal\u0131kl\u0131, belirli bir servise veya uygulamaya ait bir kullan\u0131c\u0131ya ge\u00e7mek daha g\u00fcvenlidir.<\/p>\n
\u00d6rnek:<\/strong><\/p>\n
---\n- name: Nginx yap\u0131land\u0131rmas\u0131n\u0131 g\u00fcncelle\n  hosts: webservers\n  become: true\n  become_user: nginx # Nginx kullan\u0131c\u0131s\u0131 olarak \u00e7al\u0131\u015f\n  tasks:\n    - name: Nginx yap\u0131land\u0131rma dosyas\u0131n\u0131 kopyala\n      ansible.builtin.copy:\n        src: files\/nginx.conf\n        dest: \/etc\/nginx\/nginx.conf\n      # Bu g\u00f6rev nginx kullan\u0131c\u0131s\u0131 olarak \u00e7al\u0131\u015f\u0131r\n      # Ancak \/etc\/nginx\/nginx.conf dosyas\u0131n\u0131n yazma izni genellikle root'a aittir.\n      # Bu durumda, become_user: nginx i\u015fe yaramaz, \u00e7\u00fcnk\u00fc nginx kullan\u0131c\u0131s\u0131n\u0131n\n      # o dizine yazma izni yoktur. become: true (root olarak) kullan\u0131lmal\u0131d\u0131r.\n      # Bu \u00f6rnek, become_user'\u0131n sadece root'a ge\u00e7mek yerine ba\u015fka bir kullan\u0131c\u0131ya\n      # ge\u00e7mek i\u00e7in kullan\u0131ld\u0131\u011f\u0131n\u0131 g\u00f6stermektedir.<\/code><\/pre>\n
Yukar\u0131daki \u00f6rnek, become_user<\/code>‘\u0131n belirli bir uygulama kullan\u0131c\u0131s\u0131 ba\u011flam\u0131nda \u00e7al\u0131\u015fmak i\u00e7in nas\u0131l kullan\u0131labilece\u011fini g\u00f6stermektedir. Ancak, belirtilen kullan\u0131c\u0131n\u0131n hedeflenen i\u015flemi ger\u00e7ekle\u015ftirmek i\u00e7in yeterli izinlere sahip olmas\u0131 gerekti\u011fini unutmamak \u00f6nemlidir. \/etc\/nginx\/nginx.conf<\/code> gibi sistem dosyalar\u0131 genellikle root<\/code> taraf\u0131ndan y\u00f6netildi\u011finden, bu t\u00fcr i\u015flemler i\u00e7in become_user: root<\/code> (veya varsay\u0131lan root<\/code> b\u0131rakmak) daha uygun olacakt\u0131r. become_user: nginx<\/code> daha \u00e7ok, Nginx’in kendi log dizinleri gibi Nginx kullan\u0131c\u0131s\u0131n\u0131n zaten yetkili oldu\u011fu yerlerde i\u015flem yapmak i\u00e7in anlaml\u0131d\u0131r.<\/p>\n
become_flags<\/code> Anahtar Kelimesi<\/h4>\n
become_flags<\/code>, become_method<\/code> taraf\u0131ndan kullan\u0131lan komuta ek arg\u00fcmanlar veya bayraklar iletmek i\u00e7in kullan\u0131l\u0131r. \u00d6rne\u011fin, sudo<\/code> ile bir terminal oturumu ba\u015flatmak i\u00e7in -i<\/code> (interactive) bayra\u011f\u0131n\u0131 kullanmak isteyebilirsiniz.<\/p>\n
\u00d6rnek:<\/strong><\/p>\n
---\n- name: Sudo ile interaktif kabuk ba\u015flat\n  hosts: target_host\n  become: true\n  become_method: sudo\n  become_flags: '-i'\n  tasks:\n    - name: Komut \u00e7al\u0131\u015ft\u0131r\n      ansible.builtin.command: ls -l \/root<\/code><\/pre>\n
Bu, nadiren kullan\u0131lan bir \u00f6zelliktir ve genellikle belirli senaryolar i\u00e7in gereklidir.<\/p>\n
become_password<\/code> (veya ansible_become_pass<\/code>)<\/h4>\n
Ayr\u0131cal\u0131k y\u00fckseltme y\u00f6ntemi (\u00f6rne\u011fin sudo<\/code> veya su<\/code>) bir parola gerektiriyorsa, bu parola Ansible’a sa\u011flanmal\u0131d\u0131r. Ansible, parolalar\u0131 do\u011frudan playbook’lara yazmay\u0131 kesinlikle \u00f6nermez. Bunun yerine, Ansible Vault gibi g\u00fcvenli y\u00f6ntemler kullan\u0131lmal\u0131d\u0131r.<\/p>\n
*   Komut Sat\u0131r\u0131ndan:<\/strong> ansible-playbook --ask-become-pass<\/code> (veya -K<\/code>) komutu \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131nda, Ansible y\u00fckseltme parolas\u0131n\u0131 sorar.
\n*   Ansible Vault:<\/strong> Parolalar ve di\u011fer hassas veriler Ansible Vault kullan\u0131larak \u015fifrelenmi\u015f bir dosyada saklanabilir. Bu, en g\u00fcvenli yakla\u015f\u0131md\u0131r.
\n*   Ortam De\u011fi\u015fkeni:<\/strong> ANSIBLE_BECOME_PASS<\/code> ortam de\u011fi\u015fkeni kullan\u0131larak da parola sa\u011flanabilir, ancak bu y\u00f6ntem Vault kadar g\u00fcvenli de\u011fildir.
\n*   vars<\/code> veya host_vars<\/code>\/group_vars<\/code>:<\/strong> \u015eifrelenmi\u015f Vault dosyalar\u0131 i\u00e7inde ansible_become_pass<\/code> de\u011fi\u015fkeni tan\u0131mlanabilir.<\/p>\n
\u00d6rnek (Vault ile group_vars\/all\/vault.yml<\/code> i\u00e7inde):<\/strong><\/p>\n
# vault.yml (\u015fifrelenmi\u015f dosya)\nansible_become_pass: 'SuperSecureRootPass123!'<\/code><\/pre>\n
Playbook \u00e7al\u0131\u015ft\u0131r\u0131l\u0131rken ansible-playbook --ask-vault-pass ...<\/code> komutu ile Vault parolas\u0131 girilir ve Ansible, ansible_become_pass<\/code> de\u011fi\u015fkenini otomatik olarak kullan\u0131r.<\/p>\n
Neden Ayr\u0131cal\u0131k Y\u00fckseltmeye \u0130htiya\u00e7 Duyulur?<\/h3>\n
Ansible’\u0131n otomatikle\u015ftirdi\u011fi bir\u00e7ok sistem y\u00f6netimi g\u00f6revi, standart kullan\u0131c\u0131 ayr\u0131cal\u0131klar\u0131yla ger\u00e7ekle\u015ftirilemez. \u0130\u015fte ayr\u0131cal\u0131k y\u00fckseltmeye ihtiya\u00e7 duyulan baz\u0131 yayg\u0131n senaryolar:<\/p>\n
*   Paket Y\u00f6netimi:<\/strong> apt<\/code>, yum<\/code>, dnf<\/code>, zypper<\/code> gibi paket y\u00f6neticileri arac\u0131l\u0131\u011f\u0131yla yaz\u0131l\u0131m paketlerini kurmak, g\u00fcncellemek veya kald\u0131rmak genellikle root<\/code> yetkisi gerektirir.
\n*   Servis Y\u00f6netimi:<\/strong> systemd<\/code>, sysvinit<\/code> veya upstart<\/code> gibi sistem servislerini ba\u015flatmak, durdurmak, yeniden ba\u015flatmak veya etkinle\u015ftirmek\/devre d\u0131\u015f\u0131 b\u0131rakmak i\u00e7in root<\/code> yetkisi gereklidir.
\n*   Dosya ve Dizin \u0130zinleri:<\/strong> \/etc<\/code>, \/var<\/code>, \/usr<\/code> gibi sistem dizinlerinde dosya olu\u015fturmak, de\u011fi\u015ftirmek, silmek veya dosya\/dizin izinlerini ve sahipliklerini ayarlamak root<\/code> yetkisi gerektirebilir.
\n*   Kullan\u0131c\u0131 ve Grup Y\u00f6netimi:<\/strong> Yeni sistem kullan\u0131c\u0131lar\u0131 veya gruplar\u0131 olu\u015fturmak, mevcutlar\u0131 silmek veya bunlar\u0131n \u00f6zelliklerini de\u011fi\u015ftirmek root<\/code> yetkisiyle yap\u0131l\u0131r.
\n*   A\u011f Yap\u0131land\u0131rmas\u0131:<\/strong> A\u011f aray\u00fczlerini yap\u0131land\u0131rmak, g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 (iptables<\/code>, firewalld<\/code>) y\u00f6netmek veya statik IP adresleri atamak gibi i\u015flemler root<\/code> yetkisi gerektirir.
\n*   Sistem G\u00fcncellemeleri:<\/strong> \u0130\u015fletim sistemi \u00e7ekirde\u011fi veya temel sistem bile\u015fenlerini g\u00fcncellemek root<\/code> yetkisi olmadan m\u00fcmk\u00fcn de\u011fildir.<\/p>\n
Bu t\u00fcr g\u00f6revler, sistemin \u00e7ekirdek i\u015flevselli\u011fini do\u011frudan etkiledi\u011fi i\u00e7in y\u00fcksek ayr\u0131cal\u0131klar gerektirir. Ancak, bu ayr\u0131cal\u0131klar\u0131n her zaman ve her yerde kullan\u0131lmas\u0131 g\u00fcvenlik risklerini art\u0131r\u0131r. Bu nedenle, “en az ayr\u0131cal\u0131k prensibi” (least privilege principle) burada devreye girer. Bu prensibe g\u00f6re, bir kullan\u0131c\u0131 veya s\u00fcre\u00e7, g\u00f6revini yerine getirmek i\u00e7in ihtiya\u00e7 duydu\u011fu minimum ayr\u0131cal\u0131klara sahip olmal\u0131d\u0131r. Ansible’\u0131n ayr\u0131cal\u0131k y\u00fckseltme mekanizmalar\u0131, bu prensibi uygulayarak, playbook’lar\u0131n\u0131z\u0131 varsay\u0131lan olarak d\u00fc\u015f\u00fck ayr\u0131cal\u0131klarla \u00e7al\u0131\u015ft\u0131rman\u0131za ve yaln\u0131zca belirli g\u00f6revler i\u00e7in ayr\u0131cal\u0131k y\u00fckseltme yapman\u0131za olanak tan\u0131r.<\/p>\n
Yap\u0131land\u0131rma ve Kullan\u0131m \u00d6rnekleri<\/h3>\n
Ansible’da ayr\u0131cal\u0131k y\u00fckseltme, \u00e7e\u015fitli seviyelerde ve farkl\u0131 y\u00f6ntemlerle yap\u0131land\u0131r\u0131labilir.<\/p>\n
Playbook Seviyesinde Ayr\u0131cal\u0131k Y\u00fckseltme<\/h4>\n
Bir playbook’taki t\u00fcm g\u00f6revlerin y\u00f6netici ayr\u0131cal\u0131klar\u0131yla \u00e7al\u0131\u015fmas\u0131n\u0131 istiyorsan\u0131z, become: true<\/code> ifadesini playbook’un ba\u015f\u0131nda, hosts<\/code> tan\u0131m\u0131ndan sonra kullanabilirsiniz.<\/p>\n
---\n- name: T\u00fcm sistem g\u00fcncellemelerini uygula\n  hosts: all\n  become: true # Bu playbook'taki t\u00fcm g\u00f6revler root olarak \u00e7al\u0131\u015facak\n  tasks:\n    - name: Paket indeksini g\u00fcncelle (Ubuntu\/Debian)\n      ansible.builtin.apt:\n        update_cache: yes\n      when: ansible_os_family == \"Debian\"\n\n    - name: T\u00fcm paketleri g\u00fcncelle (Ubuntu\/Debian)\n      ansible.builtin.apt:\n        upgrade: dist\n      when: ansible_os_family == \"Debian\"\n\n    - name: Paket indeksini g\u00fcncelle (CentOS\/RHEL)\n      ansible.builtin.yum:\n        name: '*'\n        state: latest\n      when: ansible_os_family == \"RedHat\"<\/code><\/pre>\n
G\u00f6rev (Task) Seviyesinde Ayr\u0131cal\u0131k Y\u00fckseltme<\/h4>\n
Yaln\u0131zca belirli g\u00f6revlerin ayr\u0131cal\u0131k y\u00fckseltme ile \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flamak, en iyi g\u00fcvenlik uygulamalar\u0131ndan biridir. Bu, become: true<\/code> ifadesini sadece ilgili g\u00f6revin alt\u0131na ekleyerek yap\u0131l\u0131r.<\/p>\n
---\n- name: Web sunucusu ve kullan\u0131c\u0131 yap\u0131land\u0131rmas\u0131\n  hosts: webservers\n  tasks:\n    - name: Web sunucusu kullan\u0131c\u0131s\u0131 olu\u015ftur\n      ansible.builtin.user:\n        name: webapp_user\n        state: present\n        shell: \/bin\/bash\n      become: true # Sadece bu g\u00f6rev root yetkisi gerektirir\n\n    - name: Web uygulama dizini olu\u015ftur\n      ansible.builtin.file:\n        path: \/var\/www\/html\/myapp\n        state: directory\n        owner: webapp_user\n        group: webapp_user\n        mode: '0755'\n      # Bu g\u00f6rev, webapp_user olu\u015fturulduktan sonra,\n      # e\u011fer Ansible'\u0131n varsay\u0131lan ba\u011flant\u0131 kullan\u0131c\u0131s\u0131 (genellikle SSH kullan\u0131c\u0131s\u0131)\n      # \/var\/www\/html dizininde yazma iznine sahipse, ayr\u0131cal\u0131k y\u00fckseltme olmadan \u00e7al\u0131\u015fabilir.\n      # Ancak \/var\/www\/html genellikle root'a ait oldu\u011fundan, bu g\u00f6rev de b\u00fcy\u00fck olas\u0131l\u0131kla\n      # 'become: true' gerektirecektir. \u00d6rnek, sadece 'user' mod\u00fcl\u00fcn\u00fcn neden 'become' istedi\u011fini vurgular.\n      become: true # Genellikle \/var\/www\/html'e yazmak i\u00e7in root yetkisi gerekir.\n\n    - name: Web uygulama dizinine test dosyas\u0131 kopyala\n      ansible.builtin.copy:\n        content: \"Merhaba, bu bir test dosyas\u0131d\u0131r.\"\n        dest: \/var\/www\/html\/myapp\/index.html\n        owner: webapp_user\n        group: webapp_user\n        mode: '0644'\n      # Bu g\u00f6rev, e\u011fer \/var\/www\/html\/myapp dizini zaten webapp_user'a aitse,\n      # 'become: true' olmadan da \u00e7al\u0131\u015fabilir.\n      become: false # \u00d6nceki g\u00f6revde dizin olu\u015fturuldu\u011fu i\u00e7in bu g\u00f6rev root yetkisi gerektirmez.<\/code><\/pre>\n
become_user<\/code> ile Belirli Kullan\u0131c\u0131ya Ge\u00e7i\u015f<\/h4>\n
Baz\u0131 durumlarda root<\/code> yerine belirli bir sistem kullan\u0131c\u0131s\u0131 olarak i\u015flem yapmak isteyebilirsiniz.<\/p>\n
---\n- name: Tomcat servisini y\u00f6net\n  hosts: app_servers\n  tasks:\n    - name: Tomcat servisini yeniden ba\u015flat\n      ansible.builtin.service:\n        name: tomcat\n        state: restarted\n      become: true\n      become_user: tomcat # tomcat kullan\u0131c\u0131s\u0131 olarak yeniden ba\u015flat\n      # Bu, tomcat kullan\u0131c\u0131s\u0131n\u0131n servisi y\u00f6netme iznine sahip oldu\u011fu varsay\u0131m\u0131yla \u00e7al\u0131\u015f\u0131r.\n      # Genellikle systemd servisleri root taraf\u0131ndan y\u00f6netilir, bu y\u00fczden bu \u00f6rnek\n      # tomcat kullan\u0131c\u0131s\u0131n\u0131n systemctl komutunu sudo ile \u00e7al\u0131\u015ft\u0131rabilmesi i\u00e7in\n      # sudoers dosyas\u0131nda \u00f6zel bir yap\u0131land\u0131rma gerektirebilir.\n      # Alternatif olarak, e\u011fer tomcat kendi script'leriyle y\u00f6netiliyorsa ve\n      # bu script'ler tomcat kullan\u0131c\u0131s\u0131 taraf\u0131ndan \u00e7al\u0131\u015ft\u0131r\u0131labiliyorsa bu ge\u00e7erlidir.<\/code><\/pre>\n
ansible-playbook<\/code> Komut Sat\u0131r\u0131 Se\u00e7enekleri<\/h4>\n
Playbook’lar\u0131 \u00e7al\u0131\u015ft\u0131r\u0131rken ayr\u0131cal\u0131k y\u00fckseltme ayarlar\u0131n\u0131 komut sat\u0131r\u0131ndan da ge\u00e7irebilirsiniz:<\/p>\n
*   --become<\/code> veya -b<\/code>: Ayr\u0131cal\u0131k y\u00fckseltmeyi etkinle\u015ftirir (playbook’taki become: false<\/code> ayar\u0131n\u0131 ge\u00e7ersiz k\u0131lar).
\n*   --become-user<\/code> veya -U<\/code>: Hangi kullan\u0131c\u0131ya ge\u00e7ilece\u011fini belirtir (varsay\u0131lan root<\/code> yerine).
\n*   --ask-become-pass<\/code> veya -K<\/code>: Ayr\u0131cal\u0131k y\u00fckseltme parolas\u0131n\u0131 sorar.<\/p>\n
\u00d6rnek:<\/strong><\/p>\n
ansible-playbook my_playbook.yml --become --ask-become-pass -U myadmin<\/code><\/pre>\n
Bu komut, my_playbook.yml<\/code> dosyas\u0131n\u0131 \u00e7al\u0131\u015ft\u0131r\u0131rken ayr\u0131cal\u0131k y\u00fckseltmeyi etkinle\u015ftirir, y\u00fckseltme parolas\u0131n\u0131 sorar ve myadmin<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7i\u015f yapar.<\/p>\n
ansible.cfg<\/code> Dosyas\u0131nda Genel Ayarlar<\/h4>\n
ansible.cfg<\/code> dosyas\u0131nda [privilege_escalation]<\/code> b\u00f6l\u00fcm\u00fc alt\u0131nda genel ayr\u0131cal\u0131k y\u00fckseltme ayarlar\u0131n\u0131 tan\u0131mlayabilirsiniz. Bu ayarlar, komut sat\u0131r\u0131 veya playbook’taki ayarlar taraf\u0131ndan ge\u00e7ersiz k\u0131l\u0131nabilir.<\/p>\n
# ansible.cfg\n[privilege_escalation]\nbecome=True\nbecome_method=sudo\nbecome_user=root\nbecome_ask_pass=False<\/code><\/pre>\n
Bu yap\u0131land\u0131rma, t\u00fcm playbook’lar\u0131n varsay\u0131lan olarak sudo<\/code> kullanarak root<\/code> olarak \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar ve parola sormaz (bu, sudoers<\/code> dosyas\u0131nda NOPASSWD<\/code> ayar\u0131 varsa i\u015fe yarar). Ancak, bu global ayarlar genellikle sadece geli\u015ftirme ortamlar\u0131nda veya \u00e7ok kontroll\u00fc ortamlarda kullan\u0131l\u0131r. \u00dcretim ortamlar\u0131nda, playbook veya g\u00f6rev baz\u0131nda become<\/code> kullanmak daha g\u00fcvenlidir.<\/p>\n
G\u00fcvenlik \u00c7\u0131kar\u0131mlar\u0131 ve En \u0130yi Uygulamalar<\/h3>\n
Ayr\u0131cal\u0131k y\u00fckseltme, g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r ancak yanl\u0131\u015f kullan\u0131ld\u0131\u011f\u0131nda ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131 yaratabilir. Bu nedenle, Ansible’da ayr\u0131cal\u0131k y\u00fckseltme kullan\u0131rken belirli g\u00fcvenlik prensiplerine ve en iyi uygulamalara uymak hayati \u00f6nem ta\u015f\u0131r.<\/p>\n
En Az Ayr\u0131cal\u0131k Prensibi (Least Privilege Principle)<\/h4>\n
Bu, g\u00fcvenlik mimarisinin temel ta\u015flar\u0131ndan biridir. Bir kullan\u0131c\u0131 veya s\u00fcre\u00e7, g\u00f6revini yerine getirmek i\u00e7in kesinlikle ihtiya\u00e7 duydu\u011fu minimum ayr\u0131cal\u0131klara sahip olmal\u0131d\u0131r. Ansible ba\u011flam\u0131nda bu \u015fu anlama gelir:<\/p>\n
*   Varsay\u0131lan olarak become: false<\/code>:<\/strong> Playbook’lar\u0131n\u0131zda ayr\u0131cal\u0131k y\u00fckseltmeyi varsay\u0131lan olarak devre d\u0131\u015f\u0131 b\u0131rak\u0131n ve yaln\u0131zca ger\u00e7ekten ihtiya\u00e7 duyulan g\u00f6revlerde become: true<\/code> kullan\u0131n.
\n*   G\u00f6rev baz\u0131nda become<\/code>:<\/strong> Playbook seviyesinde become: true<\/code> kullanmak yerine, her bir g\u00f6revin ayr\u0131cal\u0131k ihtiyac\u0131n\u0131 de\u011ferlendirin ve sadece gerekli g\u00f6revlere become: true<\/code> ekleyin.
\n*   become_user<\/code> kullan\u0131m\u0131:<\/strong> M\u00fcmk\u00fcn oldu\u011funda root<\/code> yerine, g\u00f6revi ger\u00e7ekle\u015ftirebilecek daha az ayr\u0131cal\u0131kl\u0131 bir kullan\u0131c\u0131ya (nginx<\/code>, postgres<\/code>, tomcat<\/code> vb.) ge\u00e7in.<\/p>\n
become_user<\/code> ve root<\/code> Kullan\u0131m\u0131<\/h4>\n
Her zaman root<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7mek yerine, belirli bir uygulama veya servis i\u00e7in \u00f6zelle\u015ftirilmi\u015f kullan\u0131c\u0131lar olu\u015fturmak ve become_user<\/code> ile bu kullan\u0131c\u0131lara ge\u00e7i\u015f yapmak, g\u00fcvenlik a\u00e7\u0131s\u0131ndan daha iyidir. \u00d6rne\u011fin, bir veritaban\u0131 yede\u011fi al\u0131rken postgres<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7mek, t\u00fcm sistem \u00fczerinde root<\/code> yetkisiyle i\u015flem yapmaktan daha az risklidir. Ancak, bu kullan\u0131c\u0131n\u0131n hedef i\u015flemi ger\u00e7ekle\u015ftirmek i\u00e7in yeterli sudo<\/code> yetkisine sahip oldu\u011fundan emin olunmal\u0131d\u0131r.<\/p>\n
Parola Y\u00f6netimi ve Ansible Vault<\/h4>\n
Ayr\u0131cal\u0131k y\u00fckseltme i\u00e7in parola gerekiyorsa (\u00f6rne\u011fin sudo<\/code> parolas\u0131), bu parolalar\u0131n g\u00fcvenli bir \u015fekilde y\u00f6netilmesi zorunludur.<\/p>\n
*   Asla Parolalar\u0131 Hardcode Etmeyin:<\/strong> Parolalar\u0131 asla do\u011frudan playbook’lara, vars<\/code> dosyalar\u0131na veya envanter dosyalar\u0131na a\u00e7\u0131k metin olarak yazmay\u0131n.
\n*   Ansible Vault Kullan\u0131n:<\/strong> Ansible Vault, hassas verileri (parolalar, API anahtarlar\u0131 vb.) \u015fifrelemek i\u00e7in tasarlanm\u0131\u015ft\u0131r. ansible_become_pass<\/code> de\u011fi\u015fkenini Vault ile \u015fifrelenmi\u015f bir dosyada saklay\u0131n.
\n*   SSH Anahtarlar\u0131:<\/strong> M\u00fcmk\u00fcnse, parola yerine SSH anahtarlar\u0131 ve sudo<\/code> i\u00e7in NOPASSWD<\/code> ayar\u0131 kullan\u0131n. Bu, otomasyonu daha sorunsuz ve g\u00fcvenli hale getirir.<\/p>\n
sudoers<\/code> Yap\u0131land\u0131rmas\u0131<\/h4>\n
sudo<\/code> en yayg\u0131n ayr\u0131cal\u0131k y\u00fckseltme y\u00f6ntemi oldu\u011fundan, hedef makinelerdeki sudoers<\/code> dosyas\u0131n\u0131n do\u011fru ve g\u00fcvenli bir \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131 kritik \u00f6neme sahiptir.<\/p>\n
*   NOPASSWD<\/code> Kullan\u0131m\u0131:<\/strong> Otomasyonu kesintisiz hale getirmek i\u00e7in NOPASSWD<\/code> etiketini kullanabilirsiniz, b\u00f6ylece Ansible’\u0131n sudo<\/code> parolas\u0131n\u0131 sormas\u0131na gerek kalmaz. Ancak, bu yaln\u0131zca belirli komutlar veya kullan\u0131c\u0131lar i\u00e7in yap\u0131lmal\u0131d\u0131r. T\u00fcm komutlar i\u00e7in NOPASSWD<\/code> kullanmak b\u00fcy\u00fck bir g\u00fcvenlik riski olu\u015fturur.<\/p>\n
# \/etc\/sudoers.d\/ansible_user\n    ansible_user ALL=(ALL) NOPASSWD: \/usr\/bin\/apt update, \/usr\/bin\/apt upgrade, \/usr\/sbin\/service apache2 *<\/code><\/pre>\n
    Bu \u00f6rnekte, ansible_user<\/code> kullan\u0131c\u0131s\u0131 sadece apt update<\/code>, apt upgrade<\/code> ve Apache servis y\u00f6netimi komutlar\u0131n\u0131 parola sormadan \u00e7al\u0131\u015ft\u0131rabilir.<\/p>\n
*   Belirli Komutlara K\u0131s\u0131tlama:<\/strong> sudoers<\/code> dosyas\u0131nda, Ansible’\u0131n kullanaca\u011f\u0131 kullan\u0131c\u0131n\u0131n yaln\u0131zca belirli komutlar\u0131 veya belirli yollardaki komutlar\u0131 sudo<\/code> ile \u00e7al\u0131\u015ft\u0131rmas\u0131na izin verin. Bu, bir sald\u0131rgan\u0131n ele ge\u00e7irdi\u011fi bir Ansible kullan\u0131c\u0131s\u0131n\u0131n sistem \u00fczerinde tam kontrol sa\u011flamas\u0131n\u0131 zorla\u015ft\u0131r\u0131r.
\n*   Alias’lar Kullan\u0131n:<\/strong> Cmnd_Alias<\/code> kullanarak birden fazla komutu grupland\u0131rabilir ve y\u00f6netimi kolayla\u015ft\u0131rabilirsiniz.
\n*   sudoers<\/code> Dosyas\u0131n\u0131n G\u00fcvenli\u011fi:<\/strong> sudoers<\/code> dosyas\u0131n\u0131 (\/etc\/sudoers<\/code> veya \/etc\/sudoers.d\/<\/code> alt\u0131ndaki dosyalar) yaln\u0131zca root<\/code> kullan\u0131c\u0131s\u0131n\u0131n yazma iznine sahip oldu\u011fundan emin olun. Ansible playbook’lar\u0131 ile bu dosyalar\u0131 y\u00f6netirken dikkatli olun.<\/p>\n
Denetim ve G\u00fcnl\u00fckleme (Auditing and Logging)<\/h4>\n
Ayr\u0131cal\u0131k y\u00fckseltme i\u015flemleri her zaman denetlenmeli ve g\u00fcnl\u00fc\u011fe kaydedilmelidir.<\/p>\n
*   sudo<\/code> G\u00fcnl\u00fckleri:<\/strong> sudo<\/code> komutu, t\u00fcm ayr\u0131cal\u0131k y\u00fckseltme denemelerini ve ba\u015far\u0131l\u0131 i\u015flemleri sistem g\u00fcnl\u00fcklerine (\/var\/log\/auth.log<\/code> veya \/var\/log\/secure<\/code>) kaydeder. Bu g\u00fcnl\u00fckleri d\u00fczenli olarak izleyin ve anormal aktiviteleri tespit etmek i\u00e7in merkezi bir g\u00fcnl\u00fckleme sistemine entegre edin.
\n*   Ansible G\u00fcnl\u00fckleri:<\/strong> Ansible’\u0131n kendi \u00e7al\u0131\u015fma g\u00fcnl\u00fcklerini de (varsa) ayr\u0131cal\u0131k y\u00fckseltme ad\u0131mlar\u0131 a\u00e7\u0131s\u0131ndan inceleyin.<\/p>\n
Kapsam\u0131 S\u0131n\u0131rlama<\/h4>\n
become<\/code> \u00f6zelli\u011fini yaln\u0131zca gerekli g\u00f6revlere veya rollere uygulamak, yetkisiz eri\u015fim riskini azalt\u0131r. Bir rol\u00fcn tamam\u0131n\u0131n veya bir playbook’un tamam\u0131n\u0131n become: true<\/code> ile \u00e7al\u0131\u015fmas\u0131 yerine, sadece kritik ad\u0131mlar\u0131n ayr\u0131cal\u0131k y\u00fckseltme ile \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flay\u0131n.<\/p>\n
Hassas Veri Y\u00f6netimi<\/h4>\n
Ayr\u0131cal\u0131k y\u00fckseltme ile \u00e7al\u0131\u015f\u0131rken, hassas verileri (parolalar, \u00f6zel anahtarlar vb.) i\u00e7eren dosyalar\u0131n veya dizinlerin g\u00fcvenli\u011fine dikkat edin. Bu dosyalar\u0131n do\u011fru izinlere sahip oldu\u011fundan ve gereksiz yere eri\u015filebilir olmad\u0131\u011f\u0131ndan emin olun.<\/p>\n
Test Etme<\/h4>\n
Ayr\u0131cal\u0131k y\u00fckseltme i\u00e7eren playbook’lar\u0131 titizlikle test edin. Farkl\u0131 become_method<\/code> ve become_user<\/code> kombinasyonlar\u0131n\u0131 deneyerek, beklendi\u011fi gibi \u00e7al\u0131\u015ft\u0131klar\u0131ndan ve herhangi bir beklenmedik g\u00fcvenlik a\u00e7\u0131\u011f\u0131 yaratmad\u0131klar\u0131ndan emin olun. Testler s\u0131ras\u0131nda sudo<\/code> g\u00fcnl\u00fcklerini kontrol ederek, i\u015flemlerin do\u011fru yetkilerle yap\u0131ld\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/p>\n
S\u0131k Kar\u015f\u0131la\u015f\u0131lan Sorunlar ve \u00c7\u00f6z\u00fcmleri<\/h3>\n
Ansible’da ayr\u0131cal\u0131k y\u00fckseltme kullan\u0131rken kar\u015f\u0131la\u015f\u0131labilecek baz\u0131 yayg\u0131n sorunlar ve bunlar\u0131n \u00e7\u00f6z\u00fcmleri \u015funlard\u0131r:<\/p>\n
*   Beklenmedik sudo<\/code> Parola \u0130stemleri:<\/strong>
\n    *   Sorun:<\/strong> Playbook \u00e7al\u0131\u015f\u0131rken Ansible sudo<\/code> parolas\u0131 istiyor ancak siz bunu beklemiyorsunuz veya otomasyonunuz kesintiye u\u011fruyor.
\n    *   \u00c7\u00f6z\u00fcm:<\/strong>
\n        *   --ask-become-pass<\/code> (-K<\/code>) komut sat\u0131r\u0131 arg\u00fcman\u0131n\u0131 kullan\u0131p kullanmad\u0131\u011f\u0131n\u0131z\u0131 kontrol edin.
\n        *   sudoers<\/code> dosyas\u0131nda NOPASSWD<\/code> ayar\u0131n\u0131n do\u011fru yap\u0131ld\u0131\u011f\u0131ndan emin olun.
\n        *   Parolay\u0131 Ansible Vault arac\u0131l\u0131\u011f\u0131yla ansible_become_pass<\/code> olarak sa\u011flad\u0131\u011f\u0131n\u0131zdan emin olun.
\n        *   ansible.cfg<\/code> dosyas\u0131nda become_ask_pass=False<\/code> ayar\u0131n\u0131n oldu\u011funu kontrol edin (e\u011fer NOPASSWD<\/code> kullan\u0131l\u0131yorsa).
\n        *   become: true<\/code> veya become_method: sudo<\/code> gibi ayarlar\u0131n do\u011fru yerle\u015ftirildi\u011finden emin olun.<\/p>\n
*   Yanl\u0131\u015f sudoers<\/code> Yap\u0131land\u0131rmas\u0131:<\/strong>
\n    *   Sorun:<\/strong> sudo<\/code> komutu “user is not in the sudoers file” veya “user is not allowed to run sudo on this host” gibi hatalar veriyor.
\n    *   \u00c7\u00f6z\u00fcm:<\/strong>
\n        *   Hedef makinede sudoers<\/code> dosyas\u0131n\u0131 (\/etc\/sudoers<\/code> veya \/etc\/sudoers.d\/<\/code> alt\u0131ndaki dosyalar) kontrol edin.
\n        *   Ansible’\u0131n ba\u011fland\u0131\u011f\u0131 kullan\u0131c\u0131n\u0131n (ansible_user<\/code> veya varsay\u0131lan SSH kullan\u0131c\u0131s\u0131) sudo<\/code> yetkisine sahip oldu\u011fundan emin olun.
\n        *   sudoers<\/code> dosyas\u0131ndaki kullan\u0131c\u0131 ad\u0131n\u0131n veya grubun do\u011fru yaz\u0131ld\u0131\u011f\u0131ndan emin olun.
\n        *   visudo<\/code> komutu ile sudoers<\/code> dosyas\u0131n\u0131 d\u00fczenleyin. Bu, s\u00f6zdizimi hatalar\u0131n\u0131 \u00f6nler.<\/p>\n
*   Y\u00fckseltme Sonras\u0131 \u0130zin Sorunlar\u0131:<\/strong>
\n    *   Sorun:<\/strong> Bir g\u00f6revi become: true<\/code> ile \u00e7al\u0131\u015ft\u0131rd\u0131ktan sonra, olu\u015fturulan dosyalar\u0131n veya dizinlerin sahipli\u011fi\/izinleri yanl\u0131\u015f oluyor.
\n    *   \u00c7\u00f6z\u00fcm:<\/strong>
\n        *   ansible.builtin.file<\/code> veya ansible.builtin.copy<\/code> gibi mod\u00fcllerle dosya\/dizin olu\u015ftururken owner<\/code>, group<\/code> ve mode<\/code> parametrelerini a\u00e7\u0131k\u00e7a belirtin.
\n        *   become_user<\/code> kullan\u0131yorsan\u0131z, o kullan\u0131c\u0131n\u0131n ger\u00e7ekten o dosya\/dizin \u00fczerinde i\u015flem yapma yetkisine sahip oldu\u011fundan emin olun. root<\/code> olarak i\u015flem yap\u0131p, daha sonra owner<\/code> ve group<\/code> ayarlamak genellikle daha g\u00fcvenli bir yakla\u015f\u0131md\u0131r.<\/p>\n
*   become_user<\/code> Kullan\u0131c\u0131s\u0131n\u0131n Yetersiz \u0130zinleri:<\/strong>
\n    *   Sorun:<\/strong> become_user: myuser<\/code> ile bir g\u00f6revi \u00e7al\u0131\u015ft\u0131r\u0131yorsunuz, ancak myuser<\/code>‘\u0131n o i\u015flemi yapmak i\u00e7in yeterli yetkisi yok.
\n    *   \u00c7\u00f6z\u00fcm:<\/strong>
\n        *   myuser<\/code>‘\u0131n ger\u00e7ekle\u015ftirmeye \u00e7al\u0131\u015ft\u0131\u011f\u0131 i\u015flem i\u00e7in gerekli dosya veya dizin izinlerine sahip oldu\u011fundan emin olun.
\n        *   E\u011fer i\u015flem sistem genelinde bir de\u011fi\u015fiklik gerektiriyorsa (\u00f6rne\u011fin \/etc<\/code> dizinine yazma), root<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7mek daha uygun olabilir.
\n        *   Alternatif olarak, myuser<\/code> i\u00e7in sudoers<\/code> dosyas\u0131nda belirli komutlara sudo<\/code> yetkisi tan\u0131mlayabilirsiniz.<\/p>\n
*   SELinux\/AppArmor \u00c7ak\u0131\u015fmalar\u0131:<\/strong>
\n    *   Sorun:<\/strong> Ayr\u0131cal\u0131k y\u00fckseltme ile bir g\u00f6revi \u00e7al\u0131\u015ft\u0131r\u0131yorsunuz ancak SELinux veya AppArmor gibi g\u00fcvenlik mekanizmalar\u0131 i\u015flemi engelliyor.
\n    *   \u00c7\u00f6z\u00fcm:<\/strong>
\n        *   Sistem g\u00fcnl\u00fcklerini (\u00f6rne\u011fin \/var\/log\/audit\/audit.log<\/code> veya dmesg<\/code>) kontrol ederek SELinux\/AppArmor hatalar\u0131n\u0131 aray\u0131n.
\n        *   Gerekirse, SELinux ba\u011flamlar\u0131n\u0131 (semanage fcontext<\/code>, restorecon<\/code>) veya AppArmor profillerini uygun \u015fekilde yap\u0131land\u0131r\u0131n.
\n        *   Ge\u00e7ici olarak SELinux’u Permissive<\/code> moda alarak sorunun kayna\u011f\u0131n\u0131 teyit edebilirsiniz (ancak \u00fcretimde devre d\u0131\u015f\u0131 b\u0131rakmaktan ka\u00e7\u0131n\u0131n).<\/p>\n
Sonu\u00e7<\/h3>\n
Ansible playbook’lar\u0131nda ayr\u0131cal\u0131k y\u00fckseltme, modern IT otomasyonunun vazge\u00e7ilmez bir bile\u015fenidir. Sistem y\u00f6netimi g\u00f6revlerinin b\u00fcy\u00fck bir \u00e7o\u011funlu\u011fu y\u00f6netici ayr\u0131cal\u0131klar\u0131 gerektirdi\u011finden, Ansible’\u0131n become<\/code> mekanizmas\u0131, bu i\u015flemleri g\u00fcvenli ve verimli bir \u015fekilde ger\u00e7ekle\u015ftirmek i\u00e7in kritik bir rol oynar. become<\/code>, become_method<\/code>, become_user<\/code> gibi anahtar kelimeler ve sudoers<\/code> dosyas\u0131n\u0131n do\u011fru yap\u0131land\u0131r\u0131lmas\u0131yla, Ansible kullan\u0131c\u0131lar\u0131 otomasyon s\u00fcre\u00e7leri \u00fczerinde detayl\u0131 kontrol sa\u011flayabilirler.<\/p>\n
Ancak, ayr\u0131cal\u0131k y\u00fckseltmenin g\u00fcc\u00fc, beraberinde b\u00fcy\u00fck sorumluluklar da getirir. “En az ayr\u0131cal\u0131k prensibi”ni benimsemek, parolalar\u0131 Ansible Vault ile g\u00fcvenli bir \u015fekilde y\u00f6netmek, sudoers<\/code> yap\u0131land\u0131rmas\u0131n\u0131 titizlikle yapmak ve ayr\u0131cal\u0131k y\u00fckseltme i\u015flemlerini d\u00fczenli olarak denetlemek, g\u00fcvenli bir otomasyon ortam\u0131 i\u00e7in temel gerekliliklerdir. Bu uygulamalara uyarak, Ansible kullan\u0131c\u0131lar\u0131 hem operasyonel verimlili\u011fi art\u0131rabilir hem de sistemlerinin g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirebilirler. Ansible’\u0131n esnek yap\u0131s\u0131, bu prensipleri uygulamak i\u00e7in gerekli t\u00fcm ara\u00e7lar\u0131 sunar; \u00f6nemli olan, bu ara\u00e7lar\u0131 bilin\u00e7li ve sorumlu bir \u015fekilde kullanmakt\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak\nGiri\u015f: Ayr\u0131cal\u0131k Y\u00fckseltme ve Ansible’\u0131n Rol\u00fc\nModern IT altyap\u0131lar\u0131n\u0131n karma\u015f\u0131","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-35312","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-genel","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nAnsible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak\" \/>\n<meta property=\"og:description\" content=\"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak Giri\u015f: Ayr\u0131cal\u0131k Y\u00fckseltme ve Ansible'\u0131n Rol\u00fc Modern IT altyap\u0131lar\u0131n\u0131n karma\u015f\u0131\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-28T02:40:49+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"22 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak\",\"datePublished\":\"2025-11-28T02:40:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\"},\"wordCount\":3290,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\",\"name\":\"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-28T02:40:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/","og_locale":"tr_TR","og_type":"article","og_title":"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak","og_description":"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak Giri\u015f: Ayr\u0131cal\u0131k Y\u00fckseltme ve Ansible'\u0131n Rol\u00fc Modern IT altyap\u0131lar\u0131n\u0131n karma\u015f\u0131","og_url":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-28T02:40:49+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"22 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak","datePublished":"2025-11-28T02:40:49+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/"},"wordCount":3290,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/","url":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/","name":"Ansible Playbook'lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-28T02:40:49+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/ansible-playbooklarinda-ayricalik-yukseltmeyi-anlamak\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Ansible Playbook’lar\u0131nda Ayr\u0131cal\u0131k Y\u00fckseltmeyi Anlamak"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=35312"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35312\/revisions"}],"predecessor-version":[{"id":35313,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35312\/revisions\/35313"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=35312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=35312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=35312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}