G\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda, veri g\u00fcvenli\u011fi her zamankinden daha kritik bir \u00f6neme sahiptir. \u0130\u015fletmeler ve geli\u015ftiriciler, verilerini depolamak ve y\u00f6netmek i\u00e7in \u00e7e\u015fitli veritaban\u0131 \u00e7\u00f6z\u00fcmlerine y\u00f6nelirken, bu veritabanlar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak en b\u00fcy\u00fck \u00f6nceliklerden biri haline gelmi\u015ftir. MongoDB, esnek yap\u0131s\u0131 ve y\u00fcksek performans\u0131yla pop\u00fcler bir NoSQL veritaban\u0131 olsa da, varsay\u0131lan kurulumlar\u0131 genellikle yeterince g\u00fcvenli de\u011fildir ve d\u0131\u015far\u0131dan gelebilecek sald\u0131r\u0131lara a\u00e7\u0131kt\u0131r.<\/p>\n
Bu makalede, Ubuntu 16.04 i\u015fletim sistemi \u00fczerinde, konteynerle\u015ftirme i\u00e7in Docker ve g\u00fcvenli uzaktan eri\u015fim i\u00e7in OpenVPN kullanarak nas\u0131l sa\u011flam ve g\u00fcvenli bir MongoDB sunucusu kurulaca\u011f\u0131n\u0131 ayr\u0131nt\u0131l\u0131 olarak ele alaca\u011f\u0131z. Docker, uygulamalar\u0131 izole edilmi\u015f ortamlarda \u00e7al\u0131\u015ft\u0131rma yetene\u011fi sayesinde g\u00fcvenlik ve ta\u015f\u0131nabilirlik sa\u011flarken, OpenVPN, a\u011f trafi\u011fini \u015fifreleyerek yetkisiz eri\u015fimi engeller ve yaln\u0131zca yetkili kullan\u0131c\u0131lar\u0131n veritaban\u0131na eri\u015fmesini sa\u011flar. Ubuntu 16.04, kararl\u0131 yap\u0131s\u0131yla bu t\u00fcr bir sunucu kurulumu i\u00e7in g\u00fcvenilir bir temel olu\u015fturur.<\/p>\n
Bu k\u0131lavuz, sunucu haz\u0131rl\u0131\u011f\u0131ndan ba\u015flayarak Docker ve OpenVPN kurulumuna, ard\u0131ndan MongoDB’nin Docker i\u00e7inde g\u00fcvenli bir \u015fekilde \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131na ve son olarak g\u00fcvenlik en iyi uygulamalar\u0131na kadar t\u00fcm ad\u0131mlar\u0131 kapsayacakt\u0131r. Amac\u0131m\u0131z, verilerinizin gizlili\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korurken, esnek ve y\u00f6netilebilir bir veritaban\u0131 altyap\u0131s\u0131 olu\u015fturman\u0131za yard\u0131mc\u0131 olmakt\u0131r.<\/p>\n
MongoDB, varsay\u0131lan olarak gelen ba\u011flant\u0131lara izin verecek \u015fekilde yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131nda, internete a\u00e7\u0131k b\u0131rak\u0131ld\u0131\u011f\u0131nda ciddi g\u00fcvenlik riskleri ta\u015f\u0131r. Ge\u00e7mi\u015fte, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f MongoDB sunucular\u0131n\u0131n fidye yaz\u0131l\u0131mlar\u0131 veya veri ihlalleri gibi sald\u0131r\u0131lara maruz kald\u0131\u011f\u0131 bir\u00e7ok vaka ya\u015fanm\u0131\u015ft\u0131r. Bu t\u00fcr ihlaller, finansal kay\u0131plara, itibar zedelenmesine ve yasal yapt\u0131r\u0131mlara yol a\u00e7abilir.<\/p>\n
G\u00fcvenlik, sadece verilerinizi korumakla kalmaz, ayn\u0131 zamanda yasal d\u00fczenlemelere (\u00f6rne\u011fin GDPR, KVKK) uyum sa\u011flamak i\u00e7in de zorunludur. Kimlik do\u011frulama, yetkilendirme, a\u011f izolasyonu ve \u015fifreleme gibi g\u00fcvenlik \u00f6nlemleri, bir MongoDB da\u011f\u0131t\u0131m\u0131n\u0131n temel ta\u015flar\u0131d\u0131r. OpenVPN ile a\u011f izolasyonu sa\u011flayarak ve Docker ile MongoDB’yi izole bir ortamda \u00e7al\u0131\u015ft\u0131rarak, d\u0131\u015f sald\u0131r\u0131 y\u00fczeyini \u00f6nemli \u00f6l\u00e7\u00fcde azaltm\u0131\u015f olaca\u011f\u0131z.<\/p>\n
Bu rehbere ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki \u00f6n gereksinimlere sahip oldu\u011funuzdan emin olun:<\/p>\n
* Ubuntu 16.04 Sunucusu:<\/strong> Tercihen yeni kurulmu\u015f, temiz bir Ubuntu 16.04 LTS sunucusu (VPS, bulut sunucusu veya fiziksel sunucu). G\u00fcvenli bir sistemin temeli, g\u00fcncel ve iyi yap\u0131land\u0131r\u0131lm\u0131\u015f bir i\u015fletim sistemidir. \u0130lk olarak, sunucunuzu g\u00fcncelleyece\u011fiz ve temel g\u00fcvenlik ayarlar\u0131n\u0131 yapaca\u011f\u0131z.<\/p>\n Sunucunuzdaki t\u00fcm paketleri g\u00fcncelleyerek olas\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapat\u0131n:<\/p>\n Ubuntu’nun varsay\u0131lan g\u00fcvenlik duvar\u0131 olan UFW (Uncomplicated Firewall) ile yaln\u0131zca gerekli portlara eri\u015fime izin vererek sunucunuzu koruyaca\u011f\u0131z. \u0130lk olarak SSH ba\u011flant\u0131 noktas\u0131n\u0131 (varsay\u0131lan 22) a\u00e7\u0131n, ard\u0131ndan g\u00fcvenlik duvar\u0131n\u0131 etkinle\u015ftirin.<\/p>\n UFW durumunu kontrol edebilirsiniz:<\/p>\n MongoDB’yi izole bir konteyner i\u00e7inde \u00e7al\u0131\u015ft\u0131rmak i\u00e7in Docker’\u0131 kuraca\u011f\u0131z. Ubuntu 16.04 i\u00e7in Docker’\u0131n resmi kurulum y\u00f6ntemini kullanmak en iyisidir.<\/p>\n Docker’\u0131n HTTPS \u00fczerinden depolar\u0131 kullanabilmesi i\u00e7in gerekli paketleri y\u00fckleyin:<\/p>\n Docker’\u0131n resmi GPG anahtar\u0131n\u0131 sisteminize ekleyin:<\/p>\n Docker deposunu APT kaynaklar\u0131n\u0131za ekleyin. Ubuntu 16.04 i\u00e7in Depo eklendikten sonra, paket listesini g\u00fcncelleyin ve Docker CE’yi (Community Edition) y\u00fckleyin:<\/p>\n Docker’\u0131n do\u011fru \u015fekilde kuruldu\u011funu ve \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulamak i\u00e7in Bu komut, Docker’\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve konteynerleri do\u011fru bir \u015fekilde ba\u015flatabildi\u011fini g\u00f6steren bir mesaj \u00e7\u0131kt\u0131s\u0131 vermelidir.<\/p>\n De\u011fi\u015fikliklerin etkili olmas\u0131 i\u00e7in oturumu kapat\u0131p tekrar a\u00e7man\u0131z veya sunucuyu yeniden ba\u015flatman\u0131z gerekebilir.<\/p>\n OpenVPN, sunucunuza g\u00fcvenli bir t\u00fcnel olu\u015fturarak, yaln\u0131zca yetkili istemcilerin MongoDB’ye eri\u015fmesini sa\u011flayacakt\u0131r. Bu b\u00f6l\u00fcmde, OpenVPN sunucusunu Ubuntu 16.04 \u00fczerine kuracak ve yap\u0131land\u0131raca\u011f\u0131z. OpenVPN’i do\u011frudan ana bilgisayara kurmak, a\u011f yap\u0131land\u0131rmas\u0131 ve y\u00f6nlendirme a\u00e7\u0131s\u0131ndan daha esnek ve kararl\u0131 bir \u00e7\u00f6z\u00fcm sunar.<\/p>\n OpenVPN ve sertifikalar\u0131 y\u00f6netmek i\u00e7in Easy-RSA arac\u0131n\u0131 y\u00fckleyin:<\/p>\n G\u00fcvenli bir OpenVPN ba\u011flant\u0131s\u0131 i\u00e7in bir Sertifika Yetkilisi (CA) olu\u015fturmal\u0131, sunucu ve istemci sertifikalar\u0131n\u0131 imzalamal\u0131y\u0131z.<\/p>\n Easy-RSA i\u00e7in bir \u00e7al\u0131\u015fma dizini olu\u015fturun ve gerekli dosyalar\u0131 kopyalay\u0131n:<\/p>\n Easy-RSA dizinine ge\u00e7in ve PKI (Public Key Infrastructure) ortam\u0131n\u0131 ba\u015flat\u0131n:<\/p>\n Yeni bir Sertifika Yetkilisi (CA) olu\u015fturun. Bir parola belirlemeniz istenecektir; bu parolay\u0131 g\u00fcvenli bir yerde saklay\u0131n.<\/p>\n Ortak Ad (Common Name) soruldu\u011funda, istedi\u011finiz bir ad\u0131 girebilirsiniz (\u00f6rn. OpenVPN sunucusu i\u00e7in bir sertifika ve \u00f6zel anahtar olu\u015fturun:<\/p>\n Ard\u0131ndan, sunucu sertifikas\u0131n\u0131 CA ile imzalay\u0131n:<\/p>\n Diffie-Hellman anahtar de\u011fi\u015fimi i\u00e7in bir dosya olu\u015fturun. Bu i\u015flem biraz zaman alabilir:<\/p>\n Ekstra bir g\u00fcvenlik katman\u0131 i\u00e7in HMAC (Hash-based Message Authentication Code) anahtar\u0131 olu\u015fturun:<\/p>\n \u015eimdi OpenVPN sunucusunu yap\u0131land\u0131raca\u011f\u0131z. \u00d6rnek bir yap\u0131land\u0131rma dosyas\u0131n\u0131 kopyalay\u0131p d\u00fczenleyece\u011fiz.<\/p>\n Gerekli sertifika ve anahtar dosyalar\u0131n\u0131 OpenVPN yap\u0131land\u0131rma dizinine kopyalay\u0131n:<\/p>\n \u00d6rnek OpenVPN yap\u0131land\u0131rma dosyas\u0131n\u0131 kopyalay\u0131n ve d\u00fczenleyin:<\/p>\n A\u015fa\u011f\u0131daki sat\u0131rlar\u0131 bulup d\u00fczenleyin veya ekleyin (mevcut Dosyay\u0131 kaydedin ve kapat\u0131n ( Sunucunun VPN istemcilerinden gelen trafi\u011fi y\u00f6nlendirebilmesi i\u00e7in IP y\u00f6nlendirmeyi etkinle\u015ftirmeniz gerekir.<\/p>\n Dosyan\u0131n i\u00e7inde \u015fu sat\u0131r\u0131 bulun ve yorum i\u015faretini ( Dosyay\u0131 kaydedin ve kapat\u0131n. De\u011fi\u015fiklikleri uygulamak i\u00e7in:<\/p>\n OpenVPN trafi\u011finin ge\u00e7i\u015fine izin vermek i\u00e7in UFW kurallar\u0131n\u0131 g\u00fcncelleyece\u011fiz. Ayr\u0131ca NAT (Network Address Translation) kurallar\u0131 eklememiz gerekecek.<\/p>\n \u015eimdi UFW’nin NAT kurallar\u0131n\u0131 eklemek i\u00e7in Dosyan\u0131n en ba\u015f\u0131na, Dosyay\u0131 kaydedin ve kapat\u0131n.<\/p>\n Son olarak, OpenVPN’in kulland\u0131\u011f\u0131 T\u00fcm yap\u0131land\u0131rmalar tamamland\u0131ktan sonra OpenVPN servisini ba\u015flat\u0131n ve sistem ba\u015flang\u0131c\u0131nda otomatik ba\u015flamas\u0131n\u0131 sa\u011flay\u0131n:<\/p>\n Durumun \u0130stemcilerin VPN sunucusuna ba\u011flanabilmesi i\u00e7in istemci sertifikalar\u0131 ve bir yap\u0131land\u0131rma dosyas\u0131 olu\u015fturmam\u0131z gerekiyor.<\/p>\n Her istemci i\u00e7in ayr\u0131 bir sertifika ve anahtar olu\u015fturmak en iyi g\u00fcvenlik uygulamas\u0131d\u0131r. \u00d6rnek olarak \u0130stemci i\u00e7in bir \u015eimdi A\u015fa\u011f\u0131daki de\u011fi\u015fiklikleri yap\u0131n:<\/p>\n Dosyay\u0131 kaydedin. \u015eimdi, t\u00fcm gerekli dosyalar\u0131 tek bir \u0130\u00e7ine a\u015fa\u011f\u0131daki i\u00e7eri\u011fi yap\u0131\u015ft\u0131r\u0131n:<\/p>\n Komut dosyas\u0131n\u0131 y\u00fcr\u00fct\u00fclebilir yap\u0131n:<\/p>\n \u015eimdi Bu, \u0130stemci taraf\u0131nda OpenVPN yaz\u0131l\u0131m\u0131n\u0131 kurun ve bu OpenVPN t\u00fcneli kurulduktan sonra, MongoDB’yi Docker i\u00e7inde g\u00fcvenli bir \u015fekilde \u00e7al\u0131\u015ft\u0131rabiliriz. MongoDB’nin sadece Docker i\u00e7 a\u011f\u0131na ba\u011fl\u0131 olmas\u0131n\u0131 sa\u011flayaca\u011f\u0131z, b\u00f6ylece d\u0131\u015far\u0131dan do\u011frudan eri\u015filemez olacak.<\/p>\n MongoDB konteynerini di\u011fer konteynerlerden ve ana bilgisayar\u0131n genel a\u011f\u0131ndan izole etmek i\u00e7in \u00f6zel bir Docker a\u011f\u0131 olu\u015ftural\u0131m. Bu a\u011f, OpenVPN istemcilerinin eri\u015febilece\u011fi bir alt a\u011fa sahip olacak.<\/p>\n Bu komut, Konteynerler ge\u00e7icidir. Verilerinizi kaybetmemek i\u00e7in bir Docker birimi (volume) kullanmal\u0131y\u0131z.<\/p>\n \u015eimdi MongoDB konteynerini olu\u015fturup \u00e7al\u0131\u015ft\u0131raca\u011f\u0131z. G\u00fcvenlik i\u00e7in, MongoDB’yi kimlik do\u011frulamay\u0131 etkinle\u015ftirerek ve yaln\u0131zca Docker a\u011f\u0131na ba\u011flayarak ba\u015flataca\u011f\u0131z.<\/p>\n Bu komutu a\u00e7\u0131klayal\u0131m: Konteynerin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n:<\/p>\n Art\u0131k MongoDB konteynerimiz \u00e7al\u0131\u015f\u0131yor ve kimlik do\u011frulamas\u0131 etkin. OpenVPN istemcinizden ba\u011flanmadan \u00f6nce, konteynerin i\u00e7 IP adresini bulman\u0131z gerekebilir.<\/p>\n Bu, OpenVPN istemcinizden ba\u011flanmadan \u00f6nce, MongoDB’ye ba\u011flan\u0131p admin kullan\u0131c\u0131s\u0131n\u0131n olu\u015fturuldu\u011funu ve kimlik do\u011frulaman\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 test edebiliriz. Bunu ana sunucu \u00fczerinden, Docker i\u00e7indeki Ba\u015far\u0131l\u0131 bir \u015fekilde ba\u011flan\u0131rsan\u0131z, T\u00fcm kurulum tamamland\u0131\u011f\u0131nda, OpenVPN istemcinizden MongoDB sunucunuza g\u00fcvenli bir \u015fekilde ba\u011flanabilirsiniz.<\/p>\n 1. OpenVPN Ba\u011flant\u0131s\u0131:<\/strong> \u0130stemci makinenizde Bu ba\u011flant\u0131, OpenVPN t\u00fcneli \u00fczerinden \u015fifrelenmi\u015f ve kimlik do\u011frulamal\u0131 bir \u015fekilde ger\u00e7ekle\u015fecektir.<\/p>\n * OpenVPN Ba\u011flant\u0131 Sorunlar\u0131:<\/strong> * G\u00fc\u00e7l\u00fc Parolalar:<\/strong> T\u00fcm kullan\u0131c\u0131lar i\u00e7in g\u00fc\u00e7l\u00fc, karma\u015f\u0131k parolalar kullan\u0131n ve d\u00fczenli olarak de\u011fi\u015ftirin. Bu makalede, Ubuntu 16.04 \u00fczerinde OpenVPN ve Docker kullanarak g\u00fcvenli bir MongoDB sunucusu \u00e7al\u0131\u015ft\u0131rman\u0131n kapsaml\u0131 ad\u0131mlar\u0131n\u0131 ele ald\u0131k. Sunucuyu haz\u0131rlamaktan ba\u015flayarak, Docker’\u0131 kurmaya, OpenVPN ile g\u00fcvenli bir eri\u015fim t\u00fcneli olu\u015fturmaya ve son olarak MongoDB’yi Docker i\u00e7inde kimlik do\u011frulama ve a\u011f izolasyonu ile yap\u0131land\u0131rmaya kadar t\u00fcm s\u00fcreci detayland\u0131rd\u0131k.<\/p>\n Bu yap\u0131land\u0131rma, MongoDB veritaban\u0131n\u0131za yaln\u0131zca yetkili kullan\u0131c\u0131lar\u0131n OpenVPN t\u00fcneli \u00fczerinden eri\u015fmesini sa\u011flayarak, d\u0131\u015far\u0131dan gelebilecek bir\u00e7ok yayg\u0131n sald\u0131r\u0131ya kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma katman\u0131 sunar. Docker’\u0131n konteynerle\u015ftirme yetenekleri sayesinde, MongoDB uygulaman\u0131z izole ve y\u00f6netilebilir bir ortamda \u00e7al\u0131\u015f\u0131rken, OpenVPN ise t\u00fcm a\u011f trafi\u011fini \u015fifreleyerek veri gizlili\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flar.<\/p>\n Unutmay\u0131n ki g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir. Sistemlerinizi d\u00fczenli olarak g\u00fcncellemeli, g\u00fc\u00e7l\u00fc parolalar kullanmal\u0131, en az yetki prensibini uygulamal\u0131 ve yedekleme stratejilerinizi g\u00f6zden ge\u00e7irmelisiniz. Bu rehberde belirtilen ad\u0131mlar\u0131 uygulayarak, verileriniz i\u00e7in sa\u011flam bir g\u00fcvenlik temeli olu\u015fturmu\u015f olacaks\u0131n\u0131z.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Ubuntu 16.04 \u00dczerinde OpenVPN ve Docker ile G\u00fcvenli Bir MongoDB Sunucusu \u00c7al\u0131\u015ft\u0131rmak\nGiri\u015f\nG\u00fcn\u00fcm\u00fcz\u00fcn h\u0131zla de\u011fi\u015fen dijital d\u00fcnyas\u0131nda","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-38349","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n
\n* SSH Eri\u015fimi:<\/strong> Sunucuya SSH \u00fczerinden eri\u015fim.
\n* Sudo Yetkileri:<\/strong> Komutlar\u0131 \u00e7al\u0131\u015ft\u0131rmak i\u00e7in sudo<\/code> yetkilerine sahip bir kullan\u0131c\u0131 hesab\u0131.
\n* Temel Linux Bilgisi:<\/strong> Linux komut sat\u0131r\u0131 ve dosya sistemi hakk\u0131nda temel bilgi.
\n* Statik Genel IP Adresi:<\/strong> OpenVPN sunucusunun internet \u00fczerinden eri\u015filebilir olmas\u0131 i\u00e7in statik bir genel IP adresi gereklidir.<\/p>\n1. Ubuntu 16.04 Sunucusunu Haz\u0131rlama<\/h3>\n
1.1 Sistem G\u00fcncelleme<\/h4>\n
sudo apt update\nsudo apt upgrade -y\nsudo apt dist-upgrade -y\nsudo apt autoremove -y<\/code><\/pre>\n1.2 G\u00fcvenlik Duvar\u0131 Yap\u0131land\u0131rmas\u0131 (UFW)<\/h4>\n
sudo ufw allow OpenSSH\nsudo ufw enable<\/code><\/pre>\ny<\/code> ile onaylay\u0131n. G\u00fcvenlik duvar\u0131n\u0131 etkinle\u015ftirdikten sonra, SSH ba\u011flant\u0131n\u0131z\u0131n kesilmedi\u011finden emin olun.
\n\u015eimdi, OpenVPN i\u00e7in kullanaca\u011f\u0131m\u0131z UDP portunu (varsay\u0131lan 1194) ve Docker i\u00e7in daha sonra i\u00e7 a\u011fda kullanaca\u011f\u0131m\u0131z portlar\u0131 a\u00e7mak \u00fczere haz\u0131rl\u0131k yapal\u0131m. \u015eimdilik sadece OpenVPN portunu a\u00e7aca\u011f\u0131z.<\/p>\nsudo ufw allow 1194\/udp<\/code><\/pre>\nsudo ufw status verbose<\/code><\/pre>\n2. Docker Kurulumu<\/h3>\n
2.1 Docker Ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 Y\u00fckleme<\/h4>\n
sudo apt-get install -y apt-transport-https ca-certificates curl software-properties-common<\/code><\/pre>\n2.2 Docker GPG Anahtar\u0131n\u0131 Ekleme<\/h4>\n
curl -fsSL https:\/\/download.docker.com\/linux\/ubuntu\/gpg | sudo apt-key add -<\/code><\/pre>\n2.3 Docker Deposunu Ekleme<\/h4>\n
xenial<\/code> kod ad\u0131n\u0131 kullanaca\u011f\u0131z:<\/p>\nsudo add-apt-repository \"deb [arch=amd64] https:\/\/download.docker.com\/linux\/ubuntu xenial stable\"<\/code><\/pre>\n2.4 Docker Kurulumu<\/h4>\n
sudo apt update\nsudo apt install -y docker-ce<\/code><\/pre>\n2.5 Docker Kurulumunu Do\u011frulama<\/h4>\n
hello-world<\/code> konteynerini \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\nsudo docker run hello-world<\/code><\/pre>\n2.6 Kullan\u0131c\u0131y\u0131 Docker Grubuna Ekleme (\u0130ste\u011fe Ba\u011fl\u0131 ama \u00d6nerilir)<\/h4>\n
sudo<\/code> kullanmadan Docker komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rmak i\u00e7in mevcut kullan\u0131c\u0131n\u0131z\u0131 docker<\/code> grubuna ekleyebilirsiniz. Bu, geli\u015ftirme ortamlar\u0131nda kolayl\u0131k sa\u011flarken, \u00fcretim ortamlar\u0131nda dikkatli kullan\u0131lmal\u0131d\u0131r.<\/p>\nsudo usermod -aG docker $USER<\/code><\/pre>\n3. OpenVPN Sunucusunu Kurma<\/h3>\n
3.1 OpenVPN ve Easy-RSA Kurulumu<\/h4>\n
sudo apt install -y openvpn easy-rsa<\/code><\/pre>\n3.2 Easy-RSA ile Sertifika Yetkilisi (CA) ve Sertifikalar\u0131 Olu\u015fturma<\/h4>\n
3.2.1 Easy-RSA Dizini Olu\u015fturma<\/h5>\n
mkdir ~\/easy-rsa\ncp -r \/usr\/share\/easy-rsa\/* ~\/easy-rsa\/\nchmod 700 ~\/easy-rsa<\/code><\/pre>\n3.2.2 PKI Ortam\u0131n\u0131 Ba\u015flatma<\/h5>\n
cd ~\/easy-rsa\n.\/easyrsa init-pki<\/code><\/pre>\n3.2.3 CA Olu\u015fturma<\/h5>\n
.\/easyrsa build-ca nopass\nE\u011fer parola istemiyorsan\u0131z 'nopass' kullan\u0131n, ancak parola kullanmak daha g\u00fcvenlidir.<\/h2>\n
.\/easyrsa build-ca<\/code><\/pre>\n<\/h2>\n
MyOpenVPN-CA<\/code>).<\/p>\n3.2.4 Sunucu Sertifikas\u0131 ve \u00d6zel Anahtar Olu\u015fturma<\/h5>\n
.\/easyrsa gen-req server nopass\nOrtak Ad soruldu\u011funda 'server' yaz\u0131n.<\/code><\/pre>\n<\/h2>\n
.\/easyrsa sign-req server server\nOnaylamak i\u00e7in 'yes' yaz\u0131n.<\/code><\/pre>\n<\/h2>\n
3.2.5 Diffie-Hellman Anahtar\u0131 Olu\u015fturma<\/h5>\n
.\/easyrsa gen-dh<\/code><\/pre>\n3.2.6 HMAC Anahtar\u0131 Olu\u015fturma<\/h5>\n
openvpn --genkey --secret ta.key<\/code><\/pre>\n3.3 OpenVPN Sunucu Yap\u0131land\u0131rmas\u0131<\/h4>\n
3.3.1 Yap\u0131land\u0131rma Dosyalar\u0131n\u0131 Kopyalama<\/h5>\n
sudo cp pki\/ca.crt \/etc\/openvpn\/\nsudo cp pki\/issued\/server.crt \/etc\/openvpn\/\nsudo cp pki\/private\/server.key \/etc\/openvpn\/\nsudo cp ta.key \/etc\/openvpn\/\nsudo cp pki\/dh.pem \/etc\/openvpn\/<\/code><\/pre>\n3.3.2 Sunucu Yap\u0131land\u0131rma Dosyas\u0131 Olu\u015fturma<\/h5>\n
sudo cp \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/server.conf.gz \/etc\/openvpn\/\nsudo gzip -d \/etc\/openvpn\/server.conf.gz\nsudo nano \/etc\/openvpn\/server.conf<\/code><\/pre>\nserver.conf<\/code> dosyas\u0131nda baz\u0131lar\u0131 zaten olabilir):<\/p>\nport 1194\nproto udp\ndev tun\n\nca ca.crt\ncert server.crt\nkey server.key\ndh dh.pem\ntls-auth ta.key 0 # This is needed on the server\nkey-direction 0\n\nserver 10.8.0.0 255.255.255.0 # OpenVPN client IP range\nifconfig-pool-persist ipp.txt\n\npush \"redirect-gateway def1 bypass-dhcp\" # Push all client traffic through VPN\npush \"dhcp-option DNS 8.8.8.8\" # Google DNS, you can use any DNS server\npush \"dhcp-option DNS 8.8.4.4\"\n\nkeepalive 10 120\n\ncipher AES-256-CBC\nauth SHA256\n\nuser nobody\ngroup nogroup\n\npersist-key\npersist-tun\n\nstatus openvpn-status.log\nverb 3\nexplicit-exit-notify 1\n\nDocker network i\u00e7in route ekleme<\/h2>\n
Docker'\u0131n varsay\u0131lan k\u00f6pr\u00fc a\u011f\u0131 genellikle 172.17.0.0\/16'd\u0131r.<\/h2>\n
E\u011fer \u00f6zel bir Docker a\u011f\u0131 kullan\u0131yorsan\u0131z (ki kullanaca\u011f\u0131z), o a\u011f\u0131n subnet'ini buraya ekleyin.<\/h2>\n
\u00d6rn: Docker a\u011f\u0131n\u0131z\u0131n subnet'i 172.18.0.0\/16 ise:<\/h2>\npush \"route 172.18.0.0 255.255.0.0\"<\/code><\/pre>\n
Ctrl+O<\/code>, Enter<\/code>, Ctrl+X<\/code>).<\/p>\n3.4 IP Y\u00f6nlendirmeyi Etkinle\u015ftirme<\/h4>\n
sudo nano \/etc\/sysctl.conf<\/code><\/pre>\n#<\/code>) kald\u0131r\u0131n (veya ekleyin):<\/p>\nnet.ipv4.ip_forward=1<\/code><\/pre>\nsudo sysctl -p<\/code><\/pre>\n3.5 UFW Kurallar\u0131n\u0131 G\u00fcncelleme<\/h4>\n
sudo nano \/etc\/default\/ufw<\/code><\/pre>\nDEFAULT_FORWARD_POLICY=\"DROP\"<\/code> sat\u0131r\u0131n\u0131 DEFAULT_FORWARD_POLICY=\"ACCEPT\"<\/code> olarak de\u011fi\u015ftirin.<\/p>\n\/etc\/ufw\/before.rules<\/code> dosyas\u0131n\u0131 d\u00fczenleyin:<\/p>\nsudo nano \/etc\/ufw\/before.rules<\/code><\/pre>\n*nat<\/code> ve -A POSTROUTING<\/code> sat\u0131rlar\u0131n\u0131 ekleyin. eth0<\/code> yerine sunucunuzun ana a\u011f aray\u00fcz\u00fcn\u00fcn ad\u0131n\u0131 kullanmal\u0131s\u0131n\u0131z (genellikle eth0<\/code> veya ens3<\/code>). Bunu ip a<\/code> komutuyla kontrol edebilirsiniz.<\/p>\n#\nrules.before<\/h2>\n
# Rules that should be run before the ufw command line rules. Custom<\/h2>\n
rules should be added to the end of this file, but can also be<\/h2>\n
inserted into the middle of the chain.<\/h2>\n
# START OPENVPN RULES<\/h2>\n
NAT table rules<\/h2>\n*nat\n:POSTROUTING ACCEPT [0:0]\n
Allow traffic from OpenVPN client to eth0 (change to your main interface)<\/h2>\n-A POSTROUTING -s 10.8.0.0\/8 -o eth0 -j MASQUERADE\nCOMMIT\n
END OPENVPN RULES<\/h2>\n\n
Don't delete these required lines, otherwise ufw will stop working.<\/h2>\n*filter\n:ufw-before-input - [0:0]\n:ufw-before-output - [0:0]\n:ufw-before-forward - [0:0]\n:ufw-user-input - [0:0]\n:ufw-user-output - [0:0]\n:ufw-user-forward - [0:0]\n
... (rest of the file)<\/code><\/pre>\n<\/h2>\n
tun<\/code> aray\u00fcz\u00fcne izin veren bir UFW kural\u0131 ekleyin:<\/p>\nsudo ufw allow in on tun0 from any to any\nsudo ufw reload<\/code><\/pre>\n3.6 OpenVPN Servisini Ba\u015flatma<\/h4>\n
sudo systemctl start openvpn@server\nsudo systemctl enable openvpn@server\nsudo systemctl status openvpn@server<\/code><\/pre>\nactive (running)<\/code> oldu\u011funu do\u011frulay\u0131n.<\/p>\n3.7 \u0130stemci Yap\u0131land\u0131rmas\u0131<\/h4>\n
3.7.1 \u0130stemci Sertifikas\u0131 ve \u00d6zel Anahtar Olu\u015fturma<\/h5>\n
client1<\/code> ad\u0131nda bir istemci olu\u015ftural\u0131m:<\/p>\ncd ~\/easy-rsa\n.\/easyrsa gen-req client1 nopass\n.\/easyrsa sign-req client client1<\/code><\/pre>\n3.7.2 \u0130stemci Yap\u0131land\u0131rma Dosyas\u0131 Olu\u015fturma<\/h5>\n
.ovpn<\/code> yap\u0131land\u0131rma dosyas\u0131 olu\u015fturun. Bu dosyay\u0131 istemci makinenize kopyalayacaks\u0131n\u0131z.<\/p>\nmkdir -p ~\/client-configs\/files\nchmod 700 ~\/client-configs\/files\n\ncp \/usr\/share\/doc\/openvpn\/examples\/sample-config-files\/client.conf ~\/client-configs\/base.conf<\/code><\/pre>\n~\/client-configs\/base.conf<\/code> dosyas\u0131n\u0131 d\u00fczenleyin:<\/p>\nnano ~\/client-configs\/base.conf<\/code><\/pre>\nclient\ndev tun\nproto udp\n\nremote YOUR_SERVER_IP 1194 # YOUR_SERVER_IP yerine sunucunuzun genel IP adresini yaz\u0131n\n\nresolv-retry infinite\nnobind\n\npersist-key\npersist-tun\n\nremote-cert-tls server\n\ncipher AES-256-CBC\nauth SHA256\n\nkey-direction 1\n\ncomp-lzo # veya lz4-v2 e\u011fer sunucuda da etkinse\n\nverb 3\n\nBu sat\u0131rlar\u0131 yorum sat\u0131r\u0131 yap\u0131n veya silin, \u00e7\u00fcnk\u00fc sertifikalar\u0131 dosyaya dahil edece\u011fiz<\/h2>\n
ca ca.crt<\/h2>\n
cert client.crt<\/h2>\n
key client.key<\/code><\/pre>\n<\/h2>\n
.ovpn<\/code> dosyas\u0131na birle\u015ftiren bir komut dosyas\u0131 olu\u015ftural\u0131m:<\/p>\nnano ~\/client-configs\/make_config.sh<\/code><\/pre>\n#!\/bin\/bash\n\nFirst argument: Client identifier<\/h2>\nKEY_DIR=~\/easy-rsa\/pki\nOUTPUT_DIR=~\/client-configs\/files\nBASE_CONFIG=~\/client-configs\/base.conf\n\ncat ${BASE_CONFIG} \\\n <(echo -e '
chmod 700 ~\/client-configs\/make_config.sh<\/code><\/pre>\nclient1<\/code> i\u00e7in .ovpn<\/code> dosyas\u0131n\u0131 olu\u015fturun:<\/p>\n~\/client-configs\/make_config.sh client1<\/code><\/pre>\n~\/client-configs\/files\/client1.ovpn<\/code> dosyas\u0131n\u0131 olu\u015fturacakt\u0131r. Bu dosyay\u0131 g\u00fcvenli bir \u015fekilde istemci makinenize kopyalay\u0131n (\u00f6rne\u011fin scp<\/code> veya sftp<\/code> kullanarak).<\/p>\nscp ~\/client-configs\/files\/client1.ovpn your_local_user@your_local_ip:\/path\/to\/save\/client1.ovpn<\/code><\/pre>\n.ovpn<\/code> dosyas\u0131n\u0131 kullanarak VPN’e ba\u011flan\u0131n. Ba\u011flant\u0131 ba\u015far\u0131l\u0131 oldu\u011funda, art\u0131k sunucunuzun dahili a\u011f\u0131na g\u00fcvenli bir \u015fekilde eri\u015febileceksiniz.<\/p>\n4. Docker \u0130\u00e7inde MongoDB \u00c7al\u0131\u015ft\u0131rma<\/h3>\n
4.1 \u00d6zel Bir Docker A\u011f\u0131 Olu\u015fturma<\/h4>\n
sudo docker network create --subnet=172.18.0.0\/16 mongodb-net<\/code><\/pre>\n172.18.0.0\/16<\/code> alt a\u011f\u0131na sahip mongodb-net<\/code> ad\u0131nda bir Docker a\u011f\u0131 olu\u015fturur. OpenVPN sunucusu yap\u0131land\u0131rmas\u0131nda bu alt a\u011f\u0131 istemcilere y\u00f6nlendirmeyi unutmay\u0131n (yukar\u0131daki push \"route 172.18.0.0 255.255.0.0\"<\/code> sat\u0131r\u0131).<\/p>\n4.2 MongoDB Verileri \u0130\u00e7in Kal\u0131c\u0131 Bir Birim Olu\u015fturma<\/h4>\n
sudo docker volume create mongodb_data<\/code><\/pre>\n4.3 MongoDB Konteynerini \u00c7al\u0131\u015ft\u0131rma<\/h4>\n
sudo docker run -d \\\n --name mongodb \\\n --network mongodb-net \\\n -p 127.0.0.1:27017:27017 \\\n -v mongodb_data:\/data\/db \\\n -e MONGO_INITDB_ROOT_USERNAME=admin \\\n -e MONGO_INITDB_ROOT_PASSWORD=your_strong_admin_password \\\n mongo:4.0 --auth --bind_ip 0.0.0.0<\/code><\/pre>\n
\n* -d<\/code>: Konteyneri arka planda \u00e7al\u0131\u015ft\u0131r\u0131r.
\n* --name mongodb<\/code>: Konteynerin ad\u0131n\u0131 mongodb<\/code> olarak ayarlar.
\n* --network mongodb-net<\/code>: Konteyneri az \u00f6nce olu\u015fturdu\u011fumuz mongodb-net<\/code> a\u011f\u0131na ba\u011flar.
\n -p 127.0.0.1:27017:27017<\/code>: MongoDB’nin 27017 portunu, ana bilgisayar\u0131n <\/em>yaln\u0131zca localhost (127.0.0.1)* aray\u00fcz\u00fcndeki 27017 portuna e\u015fler. Bu, MongoDB’nin do\u011frudan d\u0131\u015far\u0131dan eri\u015filememesini sa\u011flar. OpenVPN istemcisi ba\u011flan\u0131rken bu localhost portunu kullanmayacak, do\u011frudan Docker a\u011f\u0131ndaki MongoDB IP’sine eri\u015fecektir. Bu port e\u015flemesi, e\u011fer OpenVPN ba\u011flant\u0131s\u0131 kurulamazsa veya test amac\u0131yla ana sunucu \u00fczerinden ba\u011flant\u0131 kurmak isterseniz faydal\u0131 olabilir, ancak d\u0131\u015far\u0131ya a\u00e7\u0131k de\u011fildir.
\n* -v mongodb_data:\/data\/db<\/code>: Kal\u0131c\u0131 veriler i\u00e7in mongodb_data<\/code> birimini \/data\/db<\/code> dizinine ba\u011flar.
\n* -e MONGO_INITDB_ROOT_USERNAME=admin<\/code>: Ba\u015flang\u0131\u00e7ta bir admin<\/code> kullan\u0131c\u0131s\u0131 olu\u015fturur.
\n* -e MONGO_INITDB_ROOT_PASSWORD=your_strong_admin_password<\/code>: admin<\/code> kullan\u0131c\u0131s\u0131 i\u00e7in g\u00fc\u00e7l\u00fc bir parola belirler. Bu parolay\u0131 kendi g\u00fcvenli parolan\u0131zla de\u011fi\u015ftirin!<\/strong>
\n* mongo:4.0<\/code>: Resmi MongoDB 4.0 Docker g\u00f6r\u00fcnt\u00fcs\u00fcn\u00fc kullan\u0131r. \u0130htiya\u00e7lar\u0131n\u0131za g\u00f6re farkl\u0131 bir s\u00fcr\u00fcm se\u00e7ebilirsiniz.
\n* --auth<\/code>: MongoDB’de kimlik do\u011frulamas\u0131n\u0131 etkinle\u015ftirir. Bu \u00e7ok \u00f6nemlidir.
\n* --bind_ip 0.0.0.0<\/code>: MongoDB’nin konteyner i\u00e7indeki t\u00fcm aray\u00fczlere ba\u011flanmas\u0131n\u0131 sa\u011flar. Ancak -p<\/code> bayra\u011f\u0131 sayesinde bu sadece Docker i\u00e7 a\u011f\u0131yla s\u0131n\u0131rl\u0131 kal\u0131r.<\/p>\nsudo docker ps<\/code><\/pre>\nmongodb<\/code> konteynerinin Up<\/code> durumda oldu\u011funu g\u00f6rmelisiniz.<\/p>\n4.4 MongoDB’ye Ba\u011flant\u0131 ve Kullan\u0131c\u0131 Y\u00f6netimi<\/h4>\n
sudo docker inspect mongodb | grep \"IPAddress\"<\/code><\/pre>\n172.18.0.x<\/code> gibi bir IP adresi d\u00f6nd\u00fcrecektir. Bu IP, OpenVPN istemcinizden ba\u011flan\u0131rken kullanaca\u011f\u0131n\u0131z adrestir.<\/p>\nmongo<\/code> kabu\u011funu kullanarak yapabiliriz.<\/p>\nsudo docker exec -it mongodb mongo admin -u admin -p your_strong_admin_password --authenticationDatabase admin<\/code><\/pre>\nadmin<\/code> kabu\u011funa d\u00fc\u015feceksiniz. Buradan ek kullan\u0131c\u0131lar olu\u015fturabilir ve yetkilendirmeleri y\u00f6netebilirsiniz. \u00d6rne\u011fin, mydb<\/code> veritaban\u0131 i\u00e7in bir uygulama kullan\u0131c\u0131s\u0131 olu\u015ftural\u0131m:<\/p>\nuse mydb\ndb.createUser(\n {\n user: \"appuser\",\n pwd: \"your_app_password\",\n roles: [ { role: \"readWrite\", db: \"mydb\" } ]\n }\n)\nexit<\/code><\/pre>\nyour_app_password<\/code> yerine g\u00fc\u00e7l\u00fc bir parola kullan\u0131n.<\/strong><\/p>\n5. MongoDB’ye G\u00fcvenli Ba\u011flant\u0131<\/h3>\n
5.1 OpenVPN \u0130stemcisinden Ba\u011flant\u0131<\/h4>\n
client1.ovpn<\/code> dosyas\u0131n\u0131 kullanarak OpenVPN ba\u011flant\u0131s\u0131n\u0131 kurun. Ba\u011flant\u0131n\u0131n ba\u015far\u0131l\u0131 oldu\u011fundan emin olun.
\n2. MongoDB IP Adresi:<\/strong> OpenVPN ba\u011flant\u0131s\u0131 kurulduktan sonra, istemci makineniz, MongoDB konteynerinin 172.18.0.x<\/code> IP adresine do\u011frudan eri\u015febilir olmal\u0131d\u0131r (OpenVPN sunucusunun bu alt a\u011f i\u00e7in rotay\u0131 istemcilere iletti\u011fini varsayarak).
\n3. MongoDB’ye Ba\u011flanma:<\/strong> mongo<\/code> kabu\u011fu veya tercih etti\u011finiz MongoDB istemci s\u00fcr\u00fcc\u00fcs\u00fcn\u00fc kullanarak ba\u011flan\u0131n:<\/p>\nmongo --host 172.18.0.x --port 27017 -u appuser -p your_app_password --authenticationDatabase mydb<\/code><\/pre>\n172.18.0.x<\/code> yerine MongoDB konteynerinizin ger\u00e7ek IP adresini, appuser<\/code> ve your_app_password<\/code> yerine olu\u015fturdu\u011funuz uygulama kullan\u0131c\u0131s\u0131n\u0131n bilgilerini kullan\u0131n. mydb<\/code> yerine ise kullan\u0131c\u0131n\u0131n yetkili oldu\u011fu veritaban\u0131n\u0131n ad\u0131n\u0131 yaz\u0131n.<\/p>\n6. Sorun Giderme ve En \u0130yi Uygulamalar<\/h3>\n
6.1 Sorun Giderme<\/h4>\n
\n * Sunucu g\u00fcvenlik duvar\u0131n\u0131 (UFW) kontrol edin: sudo ufw status<\/code>. 1194\/udp portunun a\u00e7\u0131k oldu\u011fundan emin olun.
\n * OpenVPN sunucu g\u00fcnl\u00fcklerini kontrol edin: sudo journalctl -u openvpn@server<\/code>.
\n * IP y\u00f6nlendirmeyi kontrol edin: cat \/proc\/sys\/net\/ipv4\/ip_forward<\/code>. De\u011fer 1<\/code> olmal\u0131.
\n * ufw before.rules<\/code> dosyas\u0131ndaki NAT kurallar\u0131n\u0131n do\u011fru aray\u00fcz ve IP aral\u0131\u011f\u0131 i\u00e7in ayarland\u0131\u011f\u0131ndan emin olun.
\n* MongoDB Ba\u011flant\u0131 Sorunlar\u0131:<\/strong>
\n * Docker konteynerinin \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun: sudo docker ps<\/code>.
\n * MongoDB konteyner g\u00fcnl\u00fcklerini kontrol edin: sudo docker logs mongodb<\/code>.
\n * MongoDB’nin --auth<\/code> ve --bind_ip 0.0.0.0<\/code> ile ba\u015flat\u0131ld\u0131\u011f\u0131ndan emin olun.
\n * OpenVPN istemcinizin MongoDB konteynerinin IP adresine ping atabildi\u011finden emin olun.
\n * Kullan\u0131c\u0131 ad\u0131, parola ve kimlik do\u011frulama veritaban\u0131n\u0131n do\u011fru oldu\u011fundan emin olun.<\/p>\n6.2 En \u0130yi Uygulamalar<\/h4>\n
\n* En Az Yetki Prensibi:<\/strong> Her kullan\u0131c\u0131ya yaln\u0131zca i\u015flerini yapmak i\u00e7in ihtiya\u00e7 duyduklar\u0131 en d\u00fc\u015f\u00fck ayr\u0131cal\u0131klar\u0131 verin. admin<\/code> kullan\u0131c\u0131s\u0131n\u0131 yaln\u0131zca y\u00f6netim g\u00f6revleri i\u00e7in kullan\u0131n.
\n* D\u00fczenli G\u00fcncellemeler:<\/strong> Ubuntu, Docker, OpenVPN ve MongoDB’yi d\u00fczenli olarak g\u00fcncel tutun. sudo apt update && sudo apt upgrade -y<\/code> ve sudo docker pull mongo:latest<\/code> gibi komutlar\u0131 periyodik olarak \u00e7al\u0131\u015ft\u0131r\u0131n.
\n* Yedeklemeler:<\/strong> MongoDB verilerinizin d\u00fczenli yedeklerini al\u0131n ve bu yedekleri g\u00fcvenli, ayr\u0131 bir konumda saklay\u0131n. Docker birimleri i\u00e7in yedekleme stratejileri geli\u015ftirin.
\n* \u0130zleme ve G\u00fcnl\u00fck Kayd\u0131:<\/strong> Sunucu ve MongoDB g\u00fcnl\u00fcklerini d\u00fczenli olarak izleyin. Anormal etkinlikler i\u00e7in uyar\u0131lar ayarlay\u0131n.
\n* Kaynak S\u0131n\u0131rlamalar\u0131:<\/strong> Docker konteynerleri i\u00e7in CPU ve bellek s\u0131n\u0131rlar\u0131 belirleyerek (\u00f6rne\u011fin --cpus<\/code> ve --memory<\/code> bayraklar\u0131 ile), di\u011fer hizmetleri veya ana bilgisayar\u0131 etkilemesini engelleyin.
\n* Ek G\u00fcvenlik Katmanlar\u0131:<\/strong> Gerekirse, Docker konteynerleri aras\u0131nda TLS\/SSL \u015fifrelemesi gibi ek g\u00fcvenlik katmanlar\u0131 d\u00fc\u015f\u00fcnebilirsiniz. Ancak OpenVPN t\u00fcneli, istemci ve sunucu aras\u0131ndaki trafi\u011fi zaten \u015fifrelemektedir.
\n* G\u00fcvenlik Denetimleri:<\/strong> Periyodik olarak g\u00fcvenlik denetimleri yaparak zay\u0131f noktalar\u0131 tespit edin ve giderin.<\/p>\nSonu\u00e7<\/h3>\n