{"id":37436,"date":"2026-01-04T19:40:49","date_gmt":"2026-01-04T16:40:49","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=37436"},"modified":"2026-01-04T19:40:49","modified_gmt":"2026-01-04T16:40:49","slug":"debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/","title":{"rendered":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?"},"content":{"rendered":"

<\/p>\n

Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?<\/h2>\n

G\u00fcn\u00fcm\u00fcz\u00fcn s\u00fcrekli geli\u015fen siber tehdit ortam\u0131nda, sistem g\u00fcvenli\u011fini sa\u011flamak her zamankinden daha kritik hale gelmi\u015ftir. Bir sistemin g\u00fcvenli\u011fini sa\u011flaman\u0131n temel ta\u015flar\u0131ndan biri, i\u00e7eriden ve d\u0131\u015far\u0131dan gelebilecek sald\u0131r\u0131lar\u0131 tespit etmek ve bunlara kar\u015f\u0131 proaktif \u00f6nlemler almakt\u0131r. \u0130\u015fte bu noktada, Host-based Intrusion Detection Systems (HIDS) olarak bilinen ana bilgisayar tabanl\u0131 sald\u0131r\u0131 tespit sistemleri devreye girer. Bu makale, pop\u00fcler bir a\u00e7\u0131k kaynak HIDS \u00e7\u00f6z\u00fcm\u00fc olan OSSEC’in Debian 8 (Jessie) i\u015fletim sistemi \u00fczerine yerel bir kurulumunun nas\u0131l yap\u0131laca\u011f\u0131n\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klamaktad\u0131r. Debian 8 her ne kadar eski bir s\u00fcr\u00fcm olsa da, bir\u00e7ok eski sistemde hala kullan\u0131lmakta olup, OSSEC’in temel kurulum ve konfig\u00fcrasyon prensiplerini anlamak i\u00e7in iyi bir ba\u015flang\u0131\u00e7 noktas\u0131 sunar.<\/p>\n

OSSEC Nedir ve Neden \u00d6nemlidir?<\/h3>\n

OSSEC (Open Source Security) HIDS, sunucular, i\u015f istasyonlar\u0131 ve a\u011f cihazlar\u0131 gibi sistemlerde g\u00fcvenlik olaylar\u0131n\u0131 izlemek, analiz etmek ve raporlamak i\u00e7in tasarlanm\u0131\u015f kapsaml\u0131 bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fcd\u00fcr. Temel i\u015flevleri \u015funlard\u0131r:<\/p>\n

* Log Analizi:<\/strong> Sistem loglar\u0131n\u0131 (syslog, auth.log, Apache loglar\u0131 vb.) ger\u00e7ek zamanl\u0131 olarak izler ve \u00f6nceden tan\u0131mlanm\u0131\u015f kurallar veya anormallikler temelinde g\u00fcvenlik olaylar\u0131n\u0131 tespit eder.
\n* Dosya B\u00fct\u00fcnl\u00fc\u011f\u00fc Kontrol\u00fc (File Integrity Monitoring – FIM):<\/strong> \u0130\u015fletim sisteminin kritik dosyalar\u0131nda, konfig\u00fcrasyon dosyalar\u0131nda ve kullan\u0131c\u0131 dizinlerinde yap\u0131lan yetkisiz de\u011fi\u015fiklikleri izler. Bir dosyan\u0131n hash de\u011feri de\u011fi\u015fti\u011finde (\u00f6rne\u011fin, bir rootkit y\u00fcklendi\u011finde veya bir sald\u0131rgan bir konfig\u00fcrasyon dosyas\u0131n\u0131 de\u011fi\u015ftirdi\u011finde) uyar\u0131 verir.
\n* Rootkit Tespiti:<\/strong> Sistemde gizlenmi\u015f rootkit’leri ve di\u011fer k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 tespit etmek i\u00e7in \u00e7e\u015fitli teknikler kullan\u0131r.
\n* Aktif Yan\u0131t (Active Response):<\/strong> Belirli g\u00fcvenlik olaylar\u0131na otomatik olarak yan\u0131t verebilir. \u00d6rne\u011fin, ba\u015far\u0131s\u0131z oturum a\u00e7ma giri\u015fimlerinin belirli bir say\u0131s\u0131na ula\u015f\u0131ld\u0131\u011f\u0131nda IP adresini g\u00fcvenlik duvar\u0131nda engelleyebilir.
\n* Sistem Zay\u0131fl\u0131k Tespiti:<\/strong> Zay\u0131f konfig\u00fcrasyonlar\u0131, a\u00e7\u0131k portlar\u0131 ve di\u011fer potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tarar.<\/p>\n

OSSEC’in yerel bir kurulumu, \u00f6zellikle tek bir sunucunun veya kritik bir i\u015f istasyonunun derinlemesine izlenmesi gerekti\u011finde son derece faydal\u0131d\u0131r. Bu kurulum, sistemin kendi i\u00e7indeki g\u00fcvenlik olaylar\u0131n\u0131, d\u0131\u015far\u0131dan gelebilecek bir sald\u0131r\u0131dan ziyade, sistemin kendisinin davran\u0131\u015flar\u0131n\u0131 ve konfig\u00fcrasyonlar\u0131n\u0131 hedef alarak izler.<\/p>\n

\u00d6n Gereksinimler<\/h3>\n

Bu rehbere ba\u015flamadan \u00f6nce, a\u015fa\u011f\u0131daki \u00f6n ko\u015fullar\u0131n kar\u015f\u0131land\u0131\u011f\u0131ndan emin olun:<\/p>\n

* Debian 8 (Jessie) \u0130\u015fletim Sistemi:<\/strong> Temiz bir Debian 8 kurulumu. Makine g\u00fcncel ve internet eri\u015fimine sahip olmal\u0131d\u0131r.
\n* Root veya Sudo Yetkileri:<\/strong> Kurulum ve konfig\u00fcrasyon i\u015flemleri i\u00e7in y\u00f6netici yetkilerine sahip bir kullan\u0131c\u0131.
\n* Temel Linux Komut Sat\u0131r\u0131 Bilgisi:<\/strong> Dosya navigasyonu, paket y\u00f6netimi ve temel komutlar\u0131 kullanma becerisi.
\n* \u0130nternet Ba\u011flant\u0131s\u0131:<\/strong> OSSEC kaynak kodunu ve gerekli ba\u011f\u0131ml\u0131l\u0131klar\u0131 indirmek i\u00e7in internet ba\u011flant\u0131s\u0131 gereklidir.<\/p>\n

Not:<\/strong> Debian 8, 2020 y\u0131l\u0131nda ya\u015fam d\u00f6ng\u00fcs\u00fcn\u00fcn sonuna (End-of-Life – EOL) ula\u015fm\u0131\u015f eski bir i\u015fletim sistemidir. G\u00fcvenlik ve g\u00fcncel \u00f6zellikler a\u00e7\u0131s\u0131ndan, yeni projelerde Debian’\u0131n daha g\u00fcncel s\u00fcr\u00fcmlerini (\u00f6rne\u011fin, Debian 11 veya 12) kullanman\u0131z \u015fiddetle tavsiye edilir. Ancak, bu rehber, eski sistemlerde OSSEC kurulum prensiplerini anlamak i\u00e7in hala ge\u00e7erli bir \u00f6rnektir.<\/p>\n

OSSEC Mimarisi ve Bile\u015fenleri<\/h3>\n

OSSEC, \u00fc\u00e7 ana bile\u015fen etraf\u0131nda d\u00f6ner:<\/p>\n

* OSSEC Manager (Sunucu):<\/strong> Merkezi bir sunucu olarak \u00e7al\u0131\u015f\u0131r ve a\u011fdaki di\u011fer makinelerden (ajanlardan) gelen loglar\u0131 ve g\u00fcvenlik olaylar\u0131n\u0131 toplar, analiz eder ve depolar. Kurallar\u0131 ve dekoderleri bar\u0131nd\u0131r\u0131r.
\n* OSSEC Agent (Ajan):<\/strong> \u0130zlenecek her bir makineye (i\u015f istasyonu, sunucu) kurulur. Kendi sistem loglar\u0131n\u0131, dosya b\u00fct\u00fcnl\u00fc\u011f\u00fc de\u011fi\u015fikliklerini ve di\u011fer g\u00fcvenlik olaylar\u0131n\u0131 toplar ve bunlar\u0131 Manager’a iletir.
\n* OSSEC HIDS (Yerel Kurulum):<\/strong> Bu rehberde odakland\u0131\u011f\u0131m\u0131z kurulum tipidir. Bu senaryoda, OSSEC Manager ve Agent i\u015flevleri tek bir makine \u00fczerinde birle\u015fir. Makine, kendi loglar\u0131n\u0131 ve g\u00fcvenlik olaylar\u0131n\u0131 kendisi izler ve analiz eder. Harici bir Manager’a veri g\u00f6ndermez veya ondan veri almaz. Bu, \u00f6zellikle tek bir sunucunun izlenmesi gerekti\u011finde veya da\u011f\u0131t\u0131k bir yap\u0131ya ihtiya\u00e7 duyulmad\u0131\u011f\u0131nda idealdir.<\/p>\n

Bu makalede, OSSEC HIDS’in yerel kurulumuna odaklanaca\u011f\u0131z, yani Debian 8 makinemizin hem OSSEC Manager hem de OSSEC Agent i\u015flevlerini tek ba\u015f\u0131na yerine getirmesini sa\u011flayaca\u011f\u0131z.<\/p>\n

OSSEC Kurulumu Ad\u0131mlar\u0131<\/h3>\n

OSSEC’i Debian 8 \u00fczerine kurmak i\u00e7in kaynak koddan derleme y\u00f6ntemini kullanaca\u011f\u0131z, zira Debian 8’in varsay\u0131lan depolar\u0131nda OSSEC’in g\u00fcncel bir s\u00fcr\u00fcm\u00fc bulunmayabilir veya hi\u00e7 bulunmayabilir.<\/p>\n

1. Sistem G\u00fcncellemesi ve Ba\u011f\u0131ml\u0131l\u0131klar\u0131n Kurulmas\u0131<\/h4>\n

Kuruluma ba\u015flamadan \u00f6nce, sisteminizin g\u00fcncel oldu\u011fundan ve OSSEC’i derlemek i\u00e7in gerekli t\u00fcm ba\u011f\u0131ml\u0131l\u0131klara sahip oldu\u011fundan emin olun.<\/p>\n

sudo apt-get update\nsudo apt-get upgrade -y<\/code><\/pre>\n
Ard\u0131ndan, OSSEC’i derlemek i\u00e7in gerekli olan paketleri kural\u0131m. Bu paketler genellikle build-essential<\/code> (derleyici ara\u00e7lar\u0131), libssl-dev<\/code> (SSL\/TLS k\u00fct\u00fcphaneleri), libpcre3-dev<\/code> (d\u00fczenli ifade k\u00fct\u00fcphanesi) ve libsqlite3-dev<\/code> (SQLite veritaban\u0131 k\u00fct\u00fcphanesi) i\u00e7erir.<\/p>\n
sudo apt-get install -y build-essential libssl-dev libpcre3-dev libsqlite3-dev<\/code><\/pre>\n
2. OSSEC Kaynak Kodunun \u0130ndirilmesi<\/h4>\n
\u015eimdi OSSEC’in kaynak kodunu indirelim. OSSEC’in resmi GitHub deposundan en son kararl\u0131 s\u00fcr\u00fcm\u00fc alabilirsiniz. Bu rehber i\u00e7in, Debian 8 d\u00f6neminde yayg\u0131n olan veya hala stabil kabul edilen bir s\u00fcr\u00fcm\u00fc (\u00f6rne\u011fin, 2.9.3) kullanaca\u011f\u0131z. \/opt<\/code> veya \/usr\/src<\/code> gibi bir dizine ge\u00e7mek iyi bir uygulamad\u0131r.<\/p>\n
cd \/opt\nsudo wget https:\/\/github.com\/ossec\/ossec-hids\/archive\/2.9.3.tar.gz<\/code><\/pre>\n
\u0130ndirme tamamland\u0131ktan sonra, s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f dosyay\u0131 a\u00e7\u0131n:<\/p>\n
sudo tar -xvzf 2.9.3.tar.gz<\/code><\/pre>\n
A\u00e7\u0131lan dizine ge\u00e7in:<\/p>\n
cd ossec-hids-2.9.3<\/code><\/pre>\n
3. OSSEC Derleme ve Kurulumu<\/h4>\n
OSSEC’in kurulum beti\u011fini \u00e7al\u0131\u015ft\u0131rarak derleme ve kurulum s\u00fcrecini ba\u015flat\u0131n.<\/p>\n
sudo .\/install.sh<\/code><\/pre>\n
Kurulum beti\u011fi size bir dizi soru soracakt\u0131r. Bu sorulara do\u011fru yan\u0131tlar\u0131 vermek \u00f6nemlidir:<\/p>\n
1.  Dil se\u00e7imi:<\/strong> en<\/code> (English) yaz\u0131p Enter’a bas\u0131n.
\n2.  Kurulum tipi:<\/strong> What kind of installation do you want (server, agent, local, help)?<\/code> sorusuna local<\/code> yaz\u0131p Enter’a bas\u0131n. Bu, hem Manager hem de Agent i\u015flevlerini tek bir makinede birle\u015ftiren yerel bir kurulum yapaca\u011f\u0131m\u0131z\u0131 belirtir.
\n3.  Kurulum dizini:<\/strong> Where do you want to install OSSEC HIDS? [\/var\/ossec]<\/code> Varsay\u0131lan dizini (\/var\/ossec<\/code>) kullanmak genellikle en iyi se\u00e7enektir. Enter’a basarak onaylay\u0131n.
\n4.  E-posta bildirimleri:<\/strong> Do you want to receive email notifications? (y\/n)<\/code> G\u00fcvenlik olaylar\u0131 hakk\u0131nda e-posta almak istiyorsan\u0131z y<\/code> yaz\u0131n ve e-posta adresinizi girin. Aksi takdirde n<\/code> yaz\u0131n. Daha sonra konfig\u00fcrasyon dosyas\u0131nda da ayarlanabilir.
\n5.  Syslog deste\u011fi:<\/strong> Do you want to enable Syslog output? (y\/n)<\/code> Genellikle n<\/code> olarak b\u0131rak\u0131labilir, zira yerel kurulumda loglar zaten OSSEC taraf\u0131ndan i\u015flenir. Harici bir SIEM’e g\u00f6nderilecekse y<\/code> se\u00e7ene\u011fi de\u011ferlendirilebilir.
\n6.  Rootcheck etkinle\u015ftirme:<\/strong> Do you want to enable Rootcheck? (y\/n)<\/code> Kesinlikle y<\/code> se\u00e7ene\u011fini se\u00e7in. Bu, rootkit tespiti i\u00e7in \u00f6nemlidir.
\n7.  Aktif yan\u0131t etkinle\u015ftirme:<\/strong> Do you want to enable Active Response? (y\/n)<\/code> Potansiyel sald\u0131r\u0131lara otomatik olarak yan\u0131t vermek istiyorsan\u0131z y<\/code> se\u00e7ene\u011fini se\u00e7in. SSH denemelerinde IP engelleme gibi \u00f6zellikler sa\u011flar.
\n8.  Dosya b\u00fct\u00fcnl\u00fc\u011f\u00fc kontrol\u00fc (FIM) etkinle\u015ftirme:<\/strong> Do you want to enable the Firewall-drop response? (y\/n)<\/code> Bu soru, \u00f6nceki “Active Response” sorusuna y<\/code> dediyseniz gelir. y<\/code> se\u00e7ene\u011fini se\u00e7in.
\n9.  Sistem b\u00fct\u00fcnl\u00fc\u011f\u00fc kontrol\u00fc (Integrity Checking) etkinle\u015ftirme:<\/strong> Bu soru FIM i\u00e7in belirli dizinleri sormak i\u00e7indir. \/etc<\/code>, \/usr\/bin<\/code>, \/usr\/sbin<\/code>, \/bin<\/code>, \/sbin<\/code> gibi kritik dizinler varsay\u0131lan olarak izlenir. Eklemek istedi\u011finiz ba\u015fka dizinler varsa, bunlar\u0131 belirtebilirsiniz. Genellikle varsay\u0131lanlar yeterlidir.<\/p>\n
T\u00fcm sorular\u0131 yan\u0131tlad\u0131ktan sonra, kurulum beti\u011fi OSSEC’i derlemeye ve kurmaya ba\u015flayacakt\u0131r. Bu i\u015flem birka\u00e7 dakika s\u00fcrebilir. Kurulum tamamland\u0131\u011f\u0131nda, “OSSEC HIDS installation finished” mesaj\u0131n\u0131 g\u00f6receksiniz.<\/p>\n
4. OSSEC Servisinin Ba\u015flat\u0131lmas\u0131<\/h4>\n
Kurulum tamamland\u0131ktan sonra, OSSEC servisini ba\u015flatabiliriz.<\/p>\n
sudo \/var\/ossec\/bin\/ossec-control start<\/code><\/pre>\n
Servisin ba\u015far\u0131yla ba\u015flat\u0131l\u0131p ba\u015flat\u0131lmad\u0131\u011f\u0131n\u0131 kontrol etmek i\u00e7in:<\/p>\n
sudo \/var\/ossec\/bin\/ossec-control status<\/code><\/pre>\n
Bu komut, OSSEC’in t\u00fcm bile\u015fenlerinin (ossec-maild, ossec-execd, ossec-logcollector, ossec-monitord, ossec-analysisd, ossec-syscheckd, ossec-rootcheck) \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6stermelidir.<\/p>\n
OSSEC’in loglar\u0131n\u0131 ger\u00e7ek zamanl\u0131 olarak izlemek i\u00e7in a\u015fa\u011f\u0131daki komutu kullanabilirsiniz:<\/p>\n
tail -f \/var\/ossec\/logs\/ossec.log<\/code><\/pre>\n
Burada OSSEC’in ba\u015flang\u0131\u00e7ta yapt\u0131\u011f\u0131 kontrolleri ve herhangi bir hatay\u0131 g\u00f6rebilirsiniz. Ayr\u0131ca, tespit edilen g\u00fcvenlik uyar\u0131lar\u0131n\u0131 g\u00f6rmek i\u00e7in:<\/p>\n
tail -f \/var\/ossec\/logs\/alerts\/alerts.log<\/code><\/pre>\n
Bu log dosyas\u0131, OSSEC’in kurallar\u0131n\u0131 tetikleyen t\u00fcm olaylar\u0131 i\u00e7erir ve g\u00fcvenlik olaylar\u0131n\u0131 izlemenin ana noktas\u0131d\u0131r.<\/p>\n
Temel OSSEC Konfig\u00fcrasyonu<\/h3>\n
OSSEC’in ana konfig\u00fcrasyon dosyas\u0131 \/var\/ossec\/etc\/ossec.conf<\/code> adresindedir. Bu dosyay\u0131 d\u00fczenleyerek OSSEC’in davran\u0131\u015f\u0131n\u0131 \u00f6zelle\u015ftirebilirsiniz. De\u011fi\u015fiklik yapt\u0131ktan sonra OSSEC servisini yeniden ba\u015flatmay\u0131 unutmay\u0131n: sudo \/var\/ossec\/bin\/ossec-control restart<\/code>.<\/p>\n
1. Log \u0130zleme (Log Monitoring)<\/h4>\n
OSSEC’in en temel i\u015flevlerinden biri log izlemedir. Varsay\u0131lan olarak, OSSEC bir\u00e7ok standart Linux log dosyas\u0131n\u0131 izler. Ancak, ek log dosyalar\u0131n\u0131 veya \u00f6zel uygulama loglar\u0131n\u0131 izlemek isteyebilirsiniz. Bunun i\u00e7in ossec.conf<\/code> dosyas\u0131ndaki <\/code> etiketlerini kullan\u0131r\u0131z.<\/p>\n
\u00d6rnek olarak, Apache web sunucusu loglar\u0131n\u0131 izlemek istedi\u011fimizi varsayal\u0131m (e\u011fer Apache y\u00fckl\u00fcyse):<\/p>\n
\n  ...\n  \n    no<\/log_all>\n    \/var\/log\/auth.log<\/location>\n  <\/localfile>\n\n  \n    no<\/log_all>\n    \/var\/log\/syslog<\/location>\n  <\/localfile>\n\n  \n  \n    no<\/log_all>\n    \/var\/log\/apache2\/access.log<\/location>\n  <\/localfile>\n\n  \n  \n    no<\/log_all>\n    \/var\/log\/apache2\/error.log<\/location>\n  <\/localfile>\n  ...\n<\/ossec_config><\/code><\/pre>\n
no<\/log_all><\/code> se\u00e7ene\u011fi, OSSEC’in yaln\u0131zca belirli kurallar\u0131 tetikleyen olaylar\u0131 kaydetmesini sa\u011flar. E\u011fer t\u00fcm loglar\u0131 kaydetmek isterseniz yes<\/code> yapabilirsiniz, ancak bu \u00e7ok fazla disk alan\u0131 kaplayabilir. Yeni bir log dosyas\u0131 ekledikten sonra OSSEC’i yeniden ba\u015flat\u0131n.<\/p>\n
2. Dosya B\u00fct\u00fcnl\u00fc\u011f\u00fc Kontrol\u00fc (File Integrity Monitoring – FIM)<\/h4>\n
FIM, sistemin kritik dosyalar\u0131nda yap\u0131lan yetkisiz de\u011fi\u015fiklikleri tespit etmek i\u00e7in hayati \u00f6neme sahiptir. <\/code> etiketleri ile hangi dizinlerin izlenece\u011fini belirleyebilirsiniz.<\/p>\n
\n  ...\n  \n    3600<\/frequency> \n\n    \n    yes<\/report_changes>\n\n    \n    \/etc<\/directories>\n    \/usr\/bin<\/directories>\n    \/usr\/sbin<\/directories>\n    \/bin<\/directories>\n    \/sbin<\/directories>\n\n    \n    \/etc\/mtab<\/ignore>\n    \/etc\/logrotate.conf<\/ignore>\n    \/etc\/ssh\/ssh_host_*_key<\/ignore>\n  <\/syscheck>\n  ...\n<\/ossec_config><\/code><\/pre>\n
*   <\/code>: Kontrollerin ne s\u0131kl\u0131kta yap\u0131laca\u011f\u0131n\u0131 saniye cinsinden belirtir.
\n*   yes<\/report_changes><\/code>: Dosya de\u011fi\u015fikliklerinin raporlanmas\u0131n\u0131 sa\u011flar.
\n*   realtime=\"yes\"<\/code>: Baz\u0131 dosya sistemlerinde ger\u00e7ek zamanl\u0131 izleme yapmaya \u00e7al\u0131\u015f\u0131r (inotify gibi).
\n*   check_all=\"yes\"<\/code>: T\u00fcm dosya \u00f6zelliklerini (izinler, sahiplik, i\u00e7erik) kontrol eder.<\/p>\n
3. Rootkit Tespiti (Rootkit Detection)<\/h4>\n
Rootkit tespiti, varsay\u0131lan olarak etkindir ve genellikle ek bir konfig\u00fcrasyon gerektirmez. OSSEC, bilinen rootkit imzalar\u0131n\u0131 ve davran\u0131\u015flar\u0131n\u0131 arar.<\/p>\n
\n  ...\n  \n    3600<\/frequency> \n    yes<\/check_unixaudit>\n    yes<\/check_kernel_if>\n    yes<\/check_sysmsg>\n    yes<\/check_trojans>\n    yes<\/check_dev>\n    yes<\/check_files>\n    yes<\/check_pids>\n    yes<\/check_ports>\n    yes<\/check_if>\n  <\/rootcheck>\n  ...\n<\/ossec_config><\/code><\/pre>\n
Bu se\u00e7enekler, OSSEC’in rootkit tespiti i\u00e7in hangi t\u00fcr kontrolleri yapaca\u011f\u0131n\u0131 belirler. Genellikle varsay\u0131lan ayarlar yeterlidir.<\/p>\n
4. Aktif Yan\u0131t (Active Response)<\/h4>\n
Aktif yan\u0131t, belirli olaylara otomatik olarak tepki vermeyi sa\u011flar. En yayg\u0131n kullan\u0131lan aktif yan\u0131tlardan biri, \u00e7ok say\u0131da ba\u015far\u0131s\u0131z oturum a\u00e7ma giri\u015fiminden sonra bir IP adresini g\u00fcvenlik duvar\u0131nda engellemektir (firewall-drop<\/code>).<\/p>\n
\n  ...\n  \n    \n    firewall-drop<\/command>\n    local<\/location>\n    5712<\/rules_id> \n    600<\/timeout> \n  <\/active-response>\n\n  \n  \n    host-deny<\/command>\n    local<\/location>\n    5700,5710<\/rules_id>\n    360<\/timeout>\n  <\/active-response>\n  ...\n<\/ossec_config><\/code><\/pre>\n
rules_id<\/code> de\u011feri, hangi OSSEC kural\u0131 tetiklendi\u011finde aktif yan\u0131t\u0131n devreye girece\u011fini belirtir. 5712<\/code> genellikle SSH ba\u015far\u0131s\u0131z giri\u015f denemelerini izleyen kurald\u0131r. timeout<\/code>, IP adresinin ne kadar s\u00fcreyle engellenece\u011fini saniye cinsinden belirtir. Aktif yan\u0131tlar\u0131 dikkatli kullan\u0131n, yanl\u0131\u015f konfig\u00fcrasyonlar sisteminize eri\u015fimi engelleyebilir.<\/p>\n
5. E-posta Bildirimleri (Email Alerts)<\/h4>\n
OSSEC, \u00f6nemli g\u00fcvenlik olaylar\u0131 hakk\u0131nda e-posta bildirimleri g\u00f6nderebilir. Kurulum s\u0131ras\u0131nda e-posta ayarlar\u0131n\u0131 yapmad\u0131ysan\u0131z veya de\u011fi\u015ftirmek isterseniz, ossec.conf<\/code> dosyas\u0131n\u0131n <\/code> b\u00f6l\u00fcm\u00fcnde d\u00fczenleme yapabilirsiniz.<\/p>\n
\n  \n    yes<\/email_notification>\n    guvenlik_ekibi@example.com<\/email_to>\n    localhost<\/smtp_server> \n    ossec@localhost<\/email_from>\n  <\/global>\n  ...\n<\/ossec_config><\/code><\/pre>\n
E-posta bildirimlerinin \u00e7al\u0131\u015fmas\u0131 i\u00e7in sisteminizde bir posta aktar\u0131m arac\u0131s\u0131 (MTA) y\u00fckl\u00fc ve yap\u0131land\u0131r\u0131lm\u0131\u015f olmal\u0131d\u0131r (\u00f6rne\u011fin, Postfix veya Sendmail). E\u011fer y\u00fckl\u00fc de\u011filse, Debian’da Postfix’i kurabilirsiniz:<\/p>\n
sudo apt-get install -y postfix mailutils<\/code><\/pre>\n
Postfix kurulumu s\u0131ras\u0131nda “Internet Site” se\u00e7ene\u011fini se\u00e7ebilir ve alan ad\u0131n\u0131z\u0131 belirtebilirsiniz. Daha sonra \/etc\/postfix\/main.cf<\/code> dosyas\u0131n\u0131 d\u00fczenleyerek detayl\u0131 ayarlar yapabilirsiniz.<\/p>\n
OSSEC Kurulumunun Test Edilmesi<\/h3>\n
OSSEC’i kurduktan ve temel konfig\u00fcrasyonlar\u0131 yapt\u0131ktan sonra, her \u015feyin beklendi\u011fi gibi \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak i\u00e7in testler yapmak \u00f6nemlidir.<\/p>\n
1. Log \u0130zleme Testi<\/h4>\n
Yeni bir log dosyas\u0131 olu\u015fturarak ve bunu ossec.conf<\/code>‘a ekleyerek test edebilirsiniz.<\/p>\n
1.  ossec.conf<\/code>‘a a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 ekleyin:<\/p>\n
\n      yes<\/log_all>\n      \/var\/log\/ossec_test.log<\/location>\n    <\/localfile><\/code><\/pre>\n
2.  OSSEC’i yeniden ba\u015flat\u0131n: sudo \/var\/ossec\/bin\/ossec-control restart<\/code>
\n3.  Test log dosyas\u0131na bir girdi ekleyin: echo \"Bu bir OSSEC log izleme testidir.\" | sudo tee -a \/var\/log\/ossec_test.log<\/code>
\n4.  alerts.log<\/code> dosyas\u0131n\u0131 kontrol edin: tail -f \/var\/ossec\/logs\/alerts\/alerts.log<\/code>
\n    Belirtti\u011finiz log girdisini i\u00e7eren bir uyar\u0131 g\u00f6rmelisiniz (ID: 500, “Log file read”).<\/p>\n
2. Dosya B\u00fct\u00fcnl\u00fc\u011f\u00fc Kontrol\u00fc Testi<\/h4>\n
\u0130zlenen bir dizindeki bir dosyay\u0131 de\u011fi\u015ftirerek FIM’i test edebilirsiniz. \u00d6rne\u011fin, \/etc\/passwd<\/code> dosyas\u0131n\u0131 de\u011fi\u015ftirmek.<\/p>\n
1.  \/etc\/passwd<\/code> dosyas\u0131n\u0131n bir yede\u011fini al\u0131n: sudo cp \/etc\/passwd \/etc\/passwd.bak<\/code>
\n2.  \/etc\/passwd<\/code> dosyas\u0131na ge\u00e7ici bir sat\u0131r ekleyin: echo \"testuser:x:1001:1001::\/home\/testuser:\/bin\/bash\" | sudo tee -a \/etc\/passwd<\/code>
\n3.  OSSEC’in syscheck<\/code> taramas\u0131n\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 bekleyin (veya manuel olarak tetikleyin: sudo \/var\/ossec\/bin\/agent_control -r -a <\/code> yerel kurulumda agent_id 000 olarak ge\u00e7erlidir). Varsay\u0131lan s\u0131kl\u0131k 1 saat oldu\u011fundan, hemen g\u00f6rmek i\u00e7in biraz beklemek veya frekans\u0131 d\u00fc\u015f\u00fcrmek gerekebilir.
\n4.  alerts.log<\/code> dosyas\u0131n\u0131 kontrol edin: tail -f \/var\/ossec\/logs\/alerts\/alerts.log<\/code>
\n    \/etc\/passwd<\/code> dosyas\u0131nda yap\u0131lan de\u011fi\u015fikli\u011fi g\u00f6steren bir uyar\u0131 (ID: 550, “Integrity checksum changed”) g\u00f6rmelisiniz.
\n5.  De\u011fi\u015fikli\u011fi geri al\u0131n: sudo mv \/etc\/passwd.bak \/etc\/passwd<\/code><\/p>\n
3. Aktif Yan\u0131t Testi<\/h4>\n
SSH ba\u015far\u0131s\u0131z giri\u015f denemelerine kar\u015f\u0131 firewall-drop<\/code> aktif yan\u0131t\u0131n\u0131 test edelim.<\/p>\n
1.  ossec.conf<\/code> dosyas\u0131nda firewall-drop<\/code> kural\u0131n\u0131n etkin oldu\u011fundan emin olun (yukar\u0131daki 6.4 b\u00f6l\u00fcm\u00fcne bak\u0131n).
\n2.  OSSEC’i yeniden ba\u015flat\u0131n: sudo \/var\/ossec\/bin\/ossec-control restart<\/code>
\n3.  Ba\u015fka bir makineden (veya ayn\u0131 makineden) yanl\u0131\u015f parola kullanarak SSH oturumu a\u00e7maya \u00e7al\u0131\u015f\u0131n. Bunu birka\u00e7 kez tekrarlay\u0131n (varsay\u0131lan kural 6 denemeden sonra tetiklenir).
\n    ssh user@your_debian_ip<\/code>
\n4.  alerts.log<\/code> dosyas\u0131n\u0131 kontrol edin. Rule: 5712 - SSHD brute force trying to get access to the system.<\/code> gibi bir uyar\u0131 ve ard\u0131ndan Active response: firewall-drop<\/code> mesaj\u0131n\u0131 g\u00f6rmelisiniz.
\n5.  Engellenen IP adresinin iptables<\/code> kurallar\u0131nda g\u00f6r\u00fcnd\u00fc\u011f\u00fcn\u00fc kontrol edin: sudo iptables -L<\/code>
\n    Engellenen IP adresini i\u00e7eren bir kural g\u00f6rmelisiniz. Belirtilen s\u00fcre sonunda bu kural otomatik olarak kald\u0131r\u0131lacakt\u0131r.<\/p>\n
OSSEC Y\u00f6netimi ve Bak\u0131m\u0131<\/h3>\n
OSSEC’in g\u00fcnl\u00fck y\u00f6netimi ve bak\u0131m\u0131, sistemin s\u00fcrekli olarak d\u00fczg\u00fcn \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flamak i\u00e7in \u00f6nemlidir.<\/p>\n
*   Servis Kontrol\u00fc:<\/strong>
\n    *   Ba\u015flat: sudo \/var\/ossec\/bin\/ossec-control start<\/code>
\n    *   Durdur: sudo \/var\/ossec\/bin\/ossec-control stop<\/code>
\n    *   Yeniden Ba\u015flat: sudo \/var\/ossec\/bin\/ossec-control restart<\/code>
\n    *   Durum: sudo \/var\/ossec\/bin\/ossec-control status<\/code>
\n*   Log Dosyalar\u0131:<\/strong>
\n    *   OSSEC sistem loglar\u0131: \/var\/ossec\/logs\/ossec.log<\/code>
\n    *   G\u00fcvenlik uyar\u0131lar\u0131: \/var\/ossec\/logs\/alerts\/alerts.log<\/code>
\n    *   Ar\u015fivlenmi\u015f uyar\u0131lar: \/var\/ossec\/logs\/alerts\/YYYY\/MMM\/ossec-alerts-DD.log<\/code>
\n*   Kurallar ve Dekoderler:<\/strong> OSSEC, g\u00fcvenlik olaylar\u0131n\u0131 yorumlamak ve uyar\u0131lar olu\u015fturmak i\u00e7in kurallar ve dekoderler kullan\u0131r. Bunlar \/var\/ossec\/rules<\/code> ve \/var\/ossec\/etc\/decoders<\/code> dizinlerinde bulunur. \u0130htiya\u00e7 duyulursa \u00f6zel kurallar ve dekoderler olu\u015fturulabilir.
\n*   G\u00fcncelleme:<\/strong> OSSEC’i g\u00fcncellemek i\u00e7in, yeni s\u00fcr\u00fcm\u00fcn kaynak kodunu indirip yukar\u0131daki ad\u0131mlar\u0131 takip ederek yeniden derlemeniz ve kurman\u0131z gerekir. Bu i\u015flem mevcut konfig\u00fcrasyonunuzu koruyacakt\u0131r.
\n*   Performans:<\/strong> B\u00fcy\u00fck sistemlerde veya y\u00fcksek trafikli sunucularda OSSEC, CPU ve disk I\/O \u00fczerinde ek y\u00fck olu\u015fturabilir. Konfig\u00fcrasyonu optimize ederek (\u00f6rne\u011fin, gereksiz dizinleri izlemeyerek, tarama s\u0131kl\u0131\u011f\u0131n\u0131 ayarlayarak) performans\u0131 art\u0131rabilirsiniz.<\/p>\n
Sonu\u00e7 ve \u0130leri Ad\u0131mlar<\/h3>\n
Bu makalede, Debian 8 i\u015fletim sistemi \u00fczerine OSSEC HIDS’in yerel bir kurulumunu nas\u0131l yapaca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m \u00f6\u011frendiniz. OSSEC’i kurarak, sisteminizin loglar\u0131n\u0131 ger\u00e7ek zamanl\u0131 olarak izleyebilir, kritik dosya de\u011fi\u015fikliklerini tespit edebilir, rootkit’lere kar\u015f\u0131 koruma sa\u011flayabilir ve potansiyel sald\u0131r\u0131lara otomatik olarak yan\u0131t verebilirsiniz. Bu, tek bir sunucunun veya kritik bir i\u015f istasyonunun g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131racak g\u00fc\u00e7l\u00fc bir ad\u0131md\u0131r.<\/p>\n
Ancak, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve OSSEC kurulumunuzu optimize etmek ve s\u00fcrd\u00fcrmek i\u00e7in daha fazla ad\u0131m atman\u0131z gerekebilir:<\/p>\n
*   Kural ve Dekoder Optimizasyonu:<\/strong> Varsay\u0131lan kurallar iyi bir ba\u015flang\u0131\u00e7 noktas\u0131 olsa da, uygulaman\u0131za ve sisteminize \u00f6zel tehditleri tespit etmek i\u00e7in kendi \u00f6zel kurallar\u0131n\u0131z\u0131 ve dekoderlerinizi olu\u015fturmay\u0131 d\u00fc\u015f\u00fcnebilirsiniz.
\n*   SIEM Entegrasyonu:<\/strong> E\u011fer birden fazla sisteminiz varsa, OSSEC uyar\u0131lar\u0131n\u0131 merkezi bir G\u00fcvenlik Bilgileri ve Olay Y\u00f6netimi (SIEM) \u00e7\u00f6z\u00fcm\u00fcne (\u00f6rne\u011fin, ELK Stack, Splunk, Graylog) g\u00f6ndermek, t\u00fcm g\u00fcvenlik olaylar\u0131n\u0131z\u0131 tek bir yerden izlemenizi sa\u011flar.
\n*   Daha Yeni Bir \u0130\u015fletim Sistemine Ge\u00e7i\u015f:<\/strong> Debian 8 art\u0131k desteklenmedi\u011finden, g\u00fcvenlik g\u00fcncellemeleri almamaktad\u0131r. M\u00fcmk\u00fcn olan en k\u0131sa s\u00fcrede daha g\u00fcncel bir Debian s\u00fcr\u00fcm\u00fcne (Debian 11 veya 12 gibi) y\u00fckseltme yapman\u0131z \u015fiddetle tavsiye edilir. OSSEC kurulum ad\u0131mlar\u0131 yeni s\u00fcr\u00fcmlerde de benzer olacakt\u0131r.
\n*   Geli\u015fmi\u015f Aktif Yan\u0131tlar:<\/strong> firewall-drop<\/code> d\u0131\u015f\u0131nda, OSSEC’in daha karma\u015f\u0131k aktif yan\u0131t komut dosyalar\u0131 vard\u0131r veya kendi \u00f6zel komut dosyalar\u0131n\u0131z\u0131 yazarak belirli olaylara daha \u00f6zelle\u015ftirilmi\u015f tepkiler verebilirsiniz.
\n*   D\u00fczenli \u0130zleme ve Ayarlama:<\/strong> OSSEC’in \u00fcretti\u011fi uyar\u0131lar\u0131 d\u00fczenli olarak g\u00f6zden ge\u00e7irmek, yanl\u0131\u015f pozitifleri azaltmak ve ger\u00e7ek tehditleri ka\u00e7\u0131rmamak i\u00e7in \u00f6nemlidir. Konfig\u00fcrasyonunuzu ve kural setinizi zamanla ayarlaman\u0131z gerekebilir.<\/p>\n
Unutmay\u0131n, hi\u00e7bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc %100 koruma sa\u011flamaz. OSSEC, \u00e7ok katmanl\u0131 bir g\u00fcvenlik stratejisinin \u00f6nemli bir par\u00e7as\u0131d\u0131r ve di\u011fer g\u00fcvenlik \u00f6nlemleriyle (g\u00fcvenlik duvarlar\u0131, g\u00fc\u00e7l\u00fc parolalar, d\u00fczenli yamalar, yedeklemeler) birlikte kullan\u0131lmal\u0131d\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?\nG\u00fcn\u00fcm\u00fcz\u00fcn s\u00fcrekli geli\u015fen siber tehdit ortam\u0131nda, sistem g\u00fcvenli\u011fini sa\u011flamak","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-37436","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nDebian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?\" \/>\n<meta property=\"og:description\" content=\"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r? G\u00fcn\u00fcm\u00fcz\u00fcn s\u00fcrekli geli\u015fen siber tehdit ortam\u0131nda, sistem g\u00fcvenli\u011fini sa\u011flamak\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-04T16:40:49+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?\",\"datePublished\":\"2026-01-04T16:40:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\"},\"wordCount\":2637,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\",\"name\":\"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-01-04T16:40:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/","og_locale":"tr_TR","og_type":"article","og_title":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?","og_description":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r? G\u00fcn\u00fcm\u00fcz\u00fcn s\u00fcrekli geli\u015fen siber tehdit ortam\u0131nda, sistem g\u00fcvenli\u011fini sa\u011flamak","og_url":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-01-04T16:40:49+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"15 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?","datePublished":"2026-01-04T16:40:49+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/"},"wordCount":2637,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/","url":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/","name":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r? - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-01-04T16:40:49+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/debian-8-uzerine-yerel-bir-ossec-kurulumu-nasil-yapilir\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Debian 8 \u00dczerine Yerel Bir OSSEC Kurulumu Nas\u0131l Yap\u0131l\u0131r?"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=37436"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37436\/revisions"}],"predecessor-version":[{"id":37437,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37436\/revisions\/37437"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=37436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=37436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=37436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}