{"id":38383,"date":"2026-01-30T02:40:53","date_gmt":"2026-01-29T23:40:53","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=38383"},"modified":"2026-01-30T02:40:53","modified_gmt":"2026-01-29T23:40:53","slug":"ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/","title":{"rendered":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi"},"content":{"rendered":"<p><body><\/p>\n<h2>OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi<\/h2>\n<h3>Giri\u015f<\/h3>\n<p>Bilgi g\u00fcvenli\u011fi, g\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda her kurulu\u015f i\u00e7in kritik bir \u00f6neme sahiptir. Sald\u0131r\u0131lar\u0131n ve g\u00fcvenlik ihlallerinin say\u0131s\u0131 artarken, sistemlerimizi proaktif bir \u015fekilde izlemek ve olas\u0131 tehditlere kar\u015f\u0131 h\u0131zl\u0131ca yan\u0131t vermek zorunlu hale gelmi\u015ftir. \u0130\u015fte bu noktada A\u00e7\u0131k Kaynakl\u0131 G\u00fcvenlik Bilgisi ve Olay Y\u00f6netimi (SIEM) sistemleri devreye girer. OSSEC (Open Source Security Event Corrector), bu alandaki en pop\u00fcler ve g\u00fc\u00e7l\u00fc ara\u00e7lardan biridir. OSSEC, sistem b\u00fct\u00fcnl\u00fc\u011f\u00fc izleme (FIM), log analizi, rootkit tespiti, aktif yan\u0131t yetenekleri ve uyar\u0131 mekanizmalar\u0131 gibi \u00f6zellikleriyle kapsaml\u0131 bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc sunar.<\/p>\n<p>Bu makalede, Ubuntu 14.04 i\u015fletim sistemi \u00fczerinde kurulu bir OSSEC sunucusu kullanarak, a\u011f\u0131n\u0131zdaki \u00e7e\u015fitli sunucu ve istemcilerde \u00e7al\u0131\u015fan OSSEC ajanlar\u0131n\u0131 nas\u0131l kuraca\u011f\u0131n\u0131z\u0131, yap\u0131land\u0131raca\u011f\u0131n\u0131z\u0131 ve en \u00f6nemlisi nas\u0131l etkili bir \u015fekilde izleyece\u011finizi ad\u0131m ad\u0131m inceleyece\u011fiz. Odak noktam\u0131z, OSSEC sunucusunun merkezi bir kontrol paneli gibi davranarak ajanlardan gelen g\u00fcvenlik olaylar\u0131n\u0131 toplamas\u0131n\u0131, analiz etmesini ve y\u00f6neticilere anlaml\u0131 uyar\u0131lar g\u00f6ndermesini sa\u011flamakt\u0131r. Ubuntu 14.04 eski bir s\u00fcr\u00fcm olsa da, OSSEC&#8217;in temel prensipleri ve i\u015fleyi\u015fi bu platformda da ayn\u0131 \u015fekilde ge\u00e7erlidir ve bu rehber, OSSEC&#8217;in temel mant\u0131\u011f\u0131n\u0131 anlamak i\u00e7in sa\u011flam bir temel sunacakt\u0131r.<\/p>\n<h3>OSSEC Mimarisine Genel Bak\u0131\u015f<\/h3>\n<p>OSSEC, merkezi bir sunucu (manager) ve bu sunucuya ba\u011flanan birden fazla ajandan (agent) olu\u015fan da\u011f\u0131t\u0131k bir mimariye sahiptir. Bu mimari, b\u00fcy\u00fck ve karma\u015f\u0131k a\u011f ortamlar\u0131nda bile etkili bir g\u00fcvenlik izlemesi sa\u011flar.<\/p>\n<h4>OSSEC Sunucusu (Manager)<\/h4>\n<p>OSSEC sunucusu, t\u00fcm ajanlardan gelen g\u00fcvenlik olaylar\u0131n\u0131 toplayan, depolayan, analiz eden ve bunlara g\u00f6re uyar\u0131lar \u00fcreten merkezi bile\u015fendir. Sunucu, kendi \u00fczerinde \u00e7al\u0131\u015fan kurallar\u0131 ve korelasyon motorunu kullanarak gelen log verilerini i\u015fler. Temel g\u00f6revleri \u015funlard\u0131r:<\/p>\n<ul>\n<li>Ajanlardan gelen log ve olay verilerini toplama.<\/li>\n<li>Toplanan verileri \u00f6nceden tan\u0131mlanm\u0131\u015f g\u00fcvenlik kurallar\u0131na g\u00f6re analiz etme.<\/li>\n<li>Anormal veya \u015f\u00fcpheli davran\u0131\u015flar\u0131 tespit etme ve uyar\u0131lar olu\u015fturma.<\/li>\n<li>Uyar\u0131lar\u0131 e-posta, syslog veya di\u011fer entegrasyonlar arac\u0131l\u0131\u011f\u0131yla iletme.<\/li>\n<li>Sistem b\u00fct\u00fcnl\u00fc\u011f\u00fc izleme verilerini depolama ve kar\u015f\u0131la\u015ft\u0131rma.<\/li>\n<\/ul>\n<p>OSSEC sunucusu, ajanlarla \u015fifreli ve kimli\u011fi do\u011frulanm\u0131\u015f bir kanal \u00fczerinden ileti\u015fim kurar. Bu ileti\u015fim, ajanlar\u0131n g\u00fcvenlik verilerini g\u00fcvenli bir \u015fekilde sunucuya iletmesini sa\u011flar.<\/p>\n<h4>OSSEC Ajans\u0131 (Agent)<\/h4>\n<p>OSSEC ajanlar\u0131, izlenmesi gereken her bir sunucu, i\u015f istasyonu veya a\u011f cihaz\u0131na kurulan hafif yaz\u0131l\u0131m par\u00e7alar\u0131d\u0131r. Ajanlar, \u00fczerinde \u00e7al\u0131\u015ft\u0131klar\u0131 sistemin g\u00fcvenlik olaylar\u0131n\u0131, log dosyalar\u0131n\u0131, dosya b\u00fct\u00fcnl\u00fc\u011f\u00fc de\u011fi\u015fikliklerini ve di\u011fer \u00f6nemli g\u00fcvenlik metriklerini toplar. Temel g\u00f6revleri \u015funlard\u0131r:<\/p>\n<ul>\n<li>Belirtilen log dosyalar\u0131n\u0131 (\u00f6rne\u011fin, <code>\/var\/log\/auth.log<\/code>, <code>\/var\/log\/syslog<\/code>, web sunucusu loglar\u0131) ger\u00e7ek zamanl\u0131 olarak okuma.<\/li>\n<li>Belirtilen dizinlerdeki ve dosyalardaki de\u011fi\u015fiklikleri (olu\u015fturma, silme, de\u011fi\u015ftirme, izin de\u011fi\u015fiklikleri) izleme (Sistem B\u00fct\u00fcnl\u00fc\u011f\u00fc \u0130zleme &#8211; FIM).<\/li>\n<li>Sistem \u00fczerinde \u00e7al\u0131\u015fan s\u00fcre\u00e7leri, a\u00e7\u0131k portlar\u0131 ve kurulu yaz\u0131l\u0131mlar\u0131 kontrol etme.<\/li>\n<li>Toplanan verileri \u015fifreli bir \u015fekilde OSSEC sunucusuna iletme.<\/li>\n<\/ul>\n<p>Ajanlar, sunucudan ba\u011f\u0131ms\u0131z olarak \u00e7al\u0131\u015fabilir ancak verileri sunucuya iletmek i\u00e7in sunucuya kay\u0131tl\u0131 olmalar\u0131 gerekir.<\/p>\n<h3>\u00d6n Gereksinimler<\/h3>\n<p>Bu rehberi takip edebilmek i\u00e7in a\u015fa\u011f\u0131daki \u00f6n ko\u015fullara sahip olman\u0131z gerekmektedir:<\/p>\n<ul>\n<li>En az iki adet Ubuntu 14.04 sanal veya fiziksel makine: Biri OSSEC sunucusu, di\u011feri ise OSSEC ajan\u0131 olarak g\u00f6rev yapacak. Farkl\u0131 i\u015fletim sistemleri de ajan olarak kullan\u0131labilir, ancak bu rehberde Ubuntu 14.04 \u00fczerine odaklan\u0131lacakt\u0131r.<\/li>\n<li>Temel Linux komut sat\u0131r\u0131 bilgisi ve <code>sudo<\/code> veya <code>root<\/code> ayr\u0131cal\u0131klar\u0131.<\/li>\n<li>Sunucu ile ajanlar aras\u0131nda a\u011f ba\u011flant\u0131s\u0131 ve gerekli portlar\u0131n (varsay\u0131lan olarak UDP 1514) a\u00e7\u0131k olmas\u0131.<\/li>\n<li>Zaman senkronizasyonu (NTP) kurulmu\u015f olmas\u0131, olaylar\u0131n do\u011fru zaman damgalar\u0131yla i\u015flenmesi i\u00e7in \u00f6nemlidir.<\/li>\n<\/ul>\n<h3>OSSEC Sunucusunun Kurulumu (Ubuntu 14.04)<\/h3>\n<p>OSSEC sunucusunu Ubuntu 14.04 \u00fczerine kurmak i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar\u0131 izleyin.<\/p>\n<h4>Paket Depolar\u0131n\u0131 G\u00fcncelleme ve Gerekli Paketleri Kurma<\/h4>\n<p>\u00d6ncelikle sistem paket listesini g\u00fcncelleyelim:<\/p>\n<pre><code class=\"language-bash\">sudo apt-get update\nsudo apt-get upgrade<\/code><\/pre>\n<p>OSSEC&#8217;in derlenmesi veya baz\u0131 ba\u011f\u0131ml\u0131l\u0131klar\u0131 i\u00e7in gerekli olabilecek paketleri kural\u0131m:<\/p>\n<pre><code class=\"language-bash\">sudo apt-get install build-essential libssl-dev<\/code><\/pre>\n<h4>OSSEC Sunucusunu Kurma<\/h4>\n<p>Ubuntu 14.04 i\u00e7in OSSEC paketlerini do\u011frudan <code>apt-get<\/code> ile kurabiliriz:<\/p>\n<pre><code class=\"language-bash\">sudo apt-get install ossec-hids-server<\/code><\/pre>\n<p>Kurulum s\u0131ras\u0131nda size birka\u00e7 soru sorulabilir. Varsay\u0131lan se\u00e7enekleri kabul edebilirsiniz.<\/p>\n<h4>Temel Yap\u0131land\u0131rma<\/h4>\n<p>Kurulum tamamland\u0131ktan sonra, OSSEC sunucusunun temel yap\u0131land\u0131rma dosyas\u0131 olan <code>\/var\/ossec\/etc\/ossec.conf<\/code> dosyas\u0131n\u0131 d\u00fczenlememiz gerekebilir. Bu dosya, OSSEC&#8217;in nas\u0131l \u00e7al\u0131\u015faca\u011f\u0131n\u0131, hangi loglar\u0131 izleyece\u011fini, hangi kurallar\u0131 uygulayaca\u011f\u0131n\u0131 ve hangi uyar\u0131lar\u0131 olu\u015fturaca\u011f\u0131n\u0131 belirler.<\/p>\n<p>Varsay\u0131lan yap\u0131land\u0131rma \u00e7o\u011fu durum i\u00e7in yeterli olsa da, \u00f6zellikle ajanlarla ileti\u015fim i\u00e7in baz\u0131 ayarlar\u0131 kontrol etmekte fayda var.<\/p>\n<pre><code class=\"language-bash\">sudo nano \/var\/ossec\/etc\/ossec.conf<\/code><\/pre>\n<p>Bu dosyada, <code><ossec_config><\/code> etiketi i\u00e7inde a\u015fa\u011f\u0131daki ayarlar\u0131n oldu\u011fundan emin olun veya ekleyin:<\/p>\n<pre><code class=\"language-xml\"><ossec_config>\n  <global>\n    <email_notification>no<\/email_notification>\n    <email_to>root@localhost<\/email_to>\n    <smtp_server>localhost<\/smtp_server>\n    <email_from>ossec@localhost<\/email_from>\n  <\/global>\n\n  <alerts>\n    <log_alert_level>1<\/log_alert_level>\n    <email_alert_level>7<\/email_alert_level>\n  <\/alerts>\n\n  <command>\n    <name>host-deny<\/name>\n    <executable>host-deny.sh<\/executable>\n    <timeout_allowed>yes<\/timeout_allowed>\n  <\/command>\n\n  <command>\n    <name>firewall-drop<\/name>\n    <executable>firewall-drop.sh<\/executable>\n    <timeout_allowed>yes<\/timeout_allowed>\n    <extra_args>-U<\/extra_args>\n  <\/command>\n\n  <active-response>\n    <command>host-deny<\/command>\n    <location>local<\/location>\n    <level>6<\/level>\n    <timeout>360<\/timeout>\n  <\/active-response>\n\n  <active-response>\n    <command>firewall-drop<\/command>\n    <location>local<\/location>\n    <level>6<\/level>\n    <timeout>360<\/timeout>\n  <\/active-response>\n\n  <rootcheck>\n    <frequency>3600<\/frequency>\n    <rootkit_files>\/var\/ossec\/etc\/rootkit_files.txt<\/rootkit_files>\n    <rootkit_trojans>\/var\/ossec\/etc\/rootkit_trojans.txt<\/rootkit_trojans>\n  <\/rootcheck>\n\n  <syscheck>\n    <frequency>3600<\/frequency>\n    <alert_new_files>yes<\/alert_new_files>\n    <auto_ignore>no<\/auto_ignore>\n    <ignore>\/etc\/mtab<\/ignore>\n    <ignore>\/etc\/resolv.conf<\/ignore>\n    <ignore>\/etc\/rc.d\/init.d<\/ignore>\n    <ignore>\/etc\/printcap<\/ignore>\n    <ignore>\/etc\/random-seed<\/ignore>\n    <ignore>\/etc\/adjtime<\/ignore>\n    <ignore>\/etc\/issue<\/ignore>\n    <ignore>\/etc\/issue.net<\/ignore>\n    <ignore>\/etc\/sudoers.d<\/ignore>\n    <ignore>\/etc\/ssh\/ssh_host_*<\/ignore>\n\n    <!-- Directories to check  (read more in ossec.conf manual) -->\n    <directories check_all=\"yes\">\/etc,\/usr\/bin,\/usr\/sbin<\/directories>\n    <directories check_all=\"yes\">\/bin,\/sbin<\/directories>\n    <directories check_all=\"yes\">\/boot<\/directories>\n    <directories check_all=\"yes\">\/var\/www<\/directories>\n  <\/syscheck>\n<\/ossec_config><\/code><\/pre>\n<p>Bu \u00f6rnek yap\u0131land\u0131rma, temel uyar\u0131 seviyelerini, aktif yan\u0131t kurallar\u0131n\u0131 ve sistem b\u00fct\u00fcnl\u00fc\u011f\u00fc izleme (syscheck) i\u00e7in izlenecek dizinleri i\u00e7erir. Kendi ihtiya\u00e7lar\u0131n\u0131za g\u00f6re bu b\u00f6l\u00fcmleri \u00f6zelle\u015ftirebilirsiniz.<\/p>\n<h4>OSSEC Sunucusu Servisini Ba\u015flatma ve Durumunu Kontrol Etme<\/h4>\n<p>Yap\u0131land\u0131rmay\u0131 kaydettikten sonra OSSEC servisini ba\u015flat\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo service ossec-hids-server start<\/code><\/pre>\n<p>Servisin durumunu kontrol edin:<\/p>\n<pre><code class=\"language-bash\">sudo service ossec-hids-server status<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131da <code>ossec-hids-server is running<\/code> veya benzer bir ifade g\u00f6rmelisiniz.<\/p>\n<h3>OSSEC Ajanlar\u0131n\u0131n Kurulumu (Ubuntu 14.04)<\/h3>\n<p>\u015eimdi, izlemek istedi\u011fimiz bir ba\u015fka Ubuntu 14.04 makinesine OSSEC ajan\u0131n\u0131 kural\u0131m.<\/p>\n<h4>Paket Depolar\u0131n\u0131 G\u00fcncelleme ve Gerekli Paketleri Kurma<\/h4>\n<p>Ajan makinesinde de ayn\u0131 \u015fekilde paketleri g\u00fcncelleyin:<\/p>\n<pre><code class=\"language-bash\">sudo apt-get update\nsudo apt-get upgrade<\/code><\/pre>\n<h4>OSSEC Ajan\u0131n\u0131 Kurma<\/h4>\n<p>Ajan paketini kural\u0131m:<\/p>\n<pre><code class=\"language-bash\">sudo apt-get install ossec-hids-agent<\/code><\/pre>\n<h4>Temel Yap\u0131land\u0131rma<\/h4>\n<p>Ajan\u0131n yap\u0131land\u0131rma dosyas\u0131 <code>\/var\/ossec\/etc\/ossec.conf<\/code>&#8216;dur. Bu dosyay\u0131 d\u00fczenleyerek ajan\u0131n OSSEC sunucusuyla ileti\u015fim kurmas\u0131n\u0131 sa\u011flayaca\u011f\u0131z.<\/p>\n<pre><code class=\"language-bash\">sudo nano \/var\/ossec\/etc\/ossec.conf<\/code><\/pre>\n<p><code><client><\/code> etiketi alt\u0131nda, <code><server-ip><\/code> alan\u0131na OSSEC sunucunuzun IP adresini girmeniz <em>\u00e7ok \u00f6nemlidir<\/em>:<\/p>\n<pre><code class=\"language-xml\"><ossec_config>\n  <client>\n    <server-ip>YOUR_OSSEC_SERVER_IP<\/server-ip>\n  <\/client>\n\n  <active-response>\n    <disabled>yes<\/disabled>\n  <\/active-response>\n\n  <rootcheck>\n    <disabled>yes<\/disabled>\n  <\/rootcheck>\n\n  <syscheck>\n    <frequency>3600<\/frequency>\n    <alert_new_files>yes<\/alert_new_files>\n    <auto_ignore>no<\/auto_ignore>\n    <ignore>\/etc\/mtab<\/ignore>\n    <ignore>\/etc\/resolv.conf<\/ignore>\n    <ignore>\/etc\/rc.d\/init.d<\/ignore>\n    <ignore>\/etc\/printcap<\/ignore>\n    <ignore>\/etc\/random-seed<\/ignore>\n    <ignore>\/etc\/adjtime<\/ignore>\n    <ignore>\/etc\/issue<\/ignore>\n    <ignore>\/etc\/issue.net<\/ignore>\n    <ignore>\/etc\/sudoers.d<\/ignore>\n    <ignore>\/etc\/ssh\/ssh_host_*<\/ignore>\n\n    <!-- Directories to check  (read more in ossec.conf manual) -->\n    <directories check_all=\"yes\">\/etc,\/usr\/bin,\/usr\/sbin<\/directories>\n    <directories check_all=\"yes\">\/bin,\/sbin<\/directories>\n    <directories check_all=\"yes\">\/boot<\/directories>\n    <directories check_all=\"yes\">\/var\/www<\/directories>\n  <\/syscheck>\n\n  <localfile>\n    <log_all>no<\/log_all>\n    <log_all_json>no<\/log_all_json>\n    <location>\/var\/log\/auth.log<\/location>\n    <log_format>syslog<\/log_format>\n  <\/localfile>\n\n  <localfile>\n    <location>\/var\/log\/syslog<\/location>\n    <log_format>syslog<\/log_format>\n  <\/localfile>\n\n  <!-- Di\u011fer log dosyalar\u0131n\u0131 buraya ekleyebilirsiniz -->\n\n<\/ossec_config><\/code><\/pre>\n<p><code>YOUR_OSSEC_SERVER_IP<\/code> yerine sunucunuzun ger\u00e7ek IP adresini yaz\u0131n. Ayr\u0131ca, ajan \u00fczerinde aktif yan\u0131t veya rootcheck gibi \u00f6zellikleri devre d\u0131\u015f\u0131 b\u0131rakmak isterseniz <code><disabled>yes<\/disabled><\/code> etiketlerini kullanabilirsiniz. Ajanlar\u0131n hangi log dosyalar\u0131n\u0131 sunucuya g\u00f6nderece\u011fini <code><localfile><\/code> etiketleri ile belirlersiniz.<\/p>\n<h3>Ajanlar\u0131 Sunucuya Kaydetme<\/h3>\n<p>Bu ad\u0131m, OSSEC&#8217;in g\u00fcvenli ileti\u015fimini sa\u011flamak i\u00e7in hayati \u00f6neme sahiptir. Ajanlar, sunucuya \u00f6zel bir anahtar (key) ile kay\u0131t olmal\u0131d\u0131r.<\/p>\n<h4>OSSEC Sunucusunda Ajan Ekleme<\/h4>\n<p>OSSEC sunucusu makinesine geri d\u00f6n\u00fcn. <code>manage_agents<\/code> yard\u0131mc\u0131 program\u0131n\u0131 kullanarak yeni bir ajan ekleyin:<\/p>\n<pre><code class=\"language-bash\">sudo \/var\/ossec\/bin\/manage_agents<\/code><\/pre>\n<p>Kar\u015f\u0131n\u0131za a\u015fa\u011f\u0131daki gibi bir men\u00fc gelecektir:<\/p>\n<pre><code class=\"language-\"><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong>\n<em> OSSEC HIDS Agent Manager.            <\/em>\n<em> The following options are available: <\/em>\n<strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong><strong><\/strong>\n   (A)dd an agent (A).\n   (E)xtract key for an agent (E).\n   (L)ist existing agents (L).\n   (R)emove an agent (R).\n   (Q)uit.\nChoose your action: A<\/code><\/pre>\n<p><code>A<\/code> tu\u015funa basarak yeni bir ajan ekleyin.<\/p>\n<pre><code class=\"language-\">- A new agent is created.\n  Please provide the following:\n   * A name for the new agent (e.g., webserver, mailserver): ubuntu-agent\n   * The IP Address of the new agent: YOUR_AGENT_IP<\/code><\/pre>\n<p>Ajan i\u00e7in bir isim (\u00f6rne\u011fin, <code>ubuntu-agent<\/code>) ve ajan\u0131n IP adresini girin.<\/p>\n<pre><code class=\"language-\">Agent information:\n   ID: 001\n   Name: ubuntu-agent\n   IP Address: YOUR_AGENT_IP\n\nConfirm adding it (y\/n)? y\nAgent 'ubuntu-agent' with ID '001' added.<\/code><\/pre>\n<p>Ajan ba\u015far\u0131yla eklendikten sonra, <code>E<\/code> tu\u015funa basarak bu ajan i\u00e7in anahtar\u0131 \u00e7\u0131karman\u0131z gerekir:<\/p>\n<pre><code class=\"language-\">Choose your action: E\n\n- Provide the ID of the agent to extract the key: 001\n\nAgent key for '001' - 'ubuntu-agent' (YOUR_AGENT_IP):\nMDAxIHVidW50dS1hZ2VudCAxOTIuMTY4LjEuMTAgYjE1YmQ5OTFmOWQ5Y2EwYzUyYjk3M2U2OGU0ZWM0NDQ0Nzc4MjM0Mjc3NDQxNzQzNTc3YjU3M2I3NzI5N2Rj<\/code><\/pre>\n<p>Yukar\u0131daki \u00f6rnekteki gibi uzun bir anahtar dizesi alacaks\u0131n\u0131z. Bu anahtar\u0131 kopyalay\u0131n.<\/p>\n<h4>OSSEC Ajan\u0131nda Anahtar\u0131 \u0130\u00e7e Aktarma<\/h4>\n<p>\u015eimdi ajan makinesine geri d\u00f6n\u00fcn. Kopyalad\u0131\u011f\u0131n\u0131z anahtar\u0131 ajana aktarmak i\u00e7in yine <code>manage_agents<\/code> program\u0131n\u0131 kullan\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo \/var\/ossec\/bin\/manage_agents<\/code><\/pre>\n<p>Bu sefer <code>I<\/code> (Import key) se\u00e7ene\u011fini kullanaca\u011f\u0131z (Not: Ubuntu 14.04&#8217;teki <code>manage_agents<\/code> s\u00fcr\u00fcm\u00fcnde <code>I<\/code> se\u00e7ene\u011fi olmayabilir, bu durumda anahtar\u0131 do\u011frudan <code>client.keys<\/code> dosyas\u0131na ekleyece\u011fiz. E\u011fer <code>I<\/code> se\u00e7ene\u011fi yoksa, a\u015fa\u011f\u0131daki manuel ad\u0131m\u0131 izleyin).<\/p>\n<p><strong>Manuel Anahtar Aktar\u0131m\u0131 (E\u011fer <code>manage_agents<\/code> i\u00e7inde <code>I<\/code> se\u00e7ene\u011fi yoksa):<\/strong><br \/>\nAjan makinesinde <code>\/var\/ossec\/etc\/client.keys<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo nano \/var\/ossec\/etc\/client.keys<\/code><\/pre>\n<p>Bu dosya genellikle bo\u015f veya sadece bir ba\u015fl\u0131k sat\u0131r\u0131 i\u00e7erir. Kopyalad\u0131\u011f\u0131n\u0131z anahtar\u0131 bu dosyan\u0131n sonuna yeni bir sat\u0131r olarak yap\u0131\u015ft\u0131r\u0131n ve kaydedin.<br \/>\n\u00d6rnek <code>client.keys<\/code> i\u00e7eri\u011fi:<\/p>\n<pre><code class=\"language-\"># OSSEC HIDS client key\nMDAxIHVidW50dS1hZ2VudCAxOTIuMTY4LjEuMTAgYjE1YmQ5OTFmOWQ5Y2EwYzUyYjk3M2U2OGU0ZWM0NDQ0Nzc4MjM0Mjc3NDQxNzQzNTc3YjU3M2I3NzI5N2Rj<\/code><\/pre>\n<h4>OSSEC Ajan Servisini Ba\u015flatma<\/h4>\n<p>Anahtar\u0131 ekledikten sonra, ajan servisini ba\u015flat\u0131n:<\/p>\n<pre><code class=\"language-bash\">sudo service ossec-hids-agent start<\/code><\/pre>\n<p>Servisin durumunu kontrol edin:<\/p>\n<pre><code class=\"language-bash\">sudo service ossec-hids-agent status<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131da <code>ossec-hids-agent is running<\/code> g\u00f6rmelisiniz.<\/p>\n<h3>OSSEC Sunucusu \u00dczerinden Ajanlar\u0131 \u0130zleme<\/h3>\n<p>Ajanlar kurulduktan ve sunucuya kaydedildikten sonra, OSSEC sunucusu \u00fczerinden ajanlar\u0131n durumunu kontrol edebilir ve gelen g\u00fcvenlik olaylar\u0131n\u0131 izleyebilirsiniz.<\/p>\n<h4>Ajan Durumu Kontrol\u00fc<\/h4>\n<p>OSSEC sunucusu \u00fczerinde <code>agent_control<\/code> yard\u0131mc\u0131 program\u0131n\u0131 kullanarak t\u00fcm kay\u0131tl\u0131 ajanlar\u0131 ve durumlar\u0131n\u0131 listeleyebilirsiniz:<\/p>\n<pre><code class=\"language-bash\">sudo \/var\/ossec\/bin\/agent_control -l<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131 a\u015fa\u011f\u0131daki gibi olacakt\u0131r:<\/p>\n<pre><code class=\"language-\">OSSEC HIDS agent_control. List of available agents:\n   ID: 001, Name: ubuntu-agent, IP: YOUR_AGENT_IP, Status: Active<\/code><\/pre>\n<p><code>Status: Active<\/code> ifadesi, ajan\u0131n sunucuya ba\u015far\u0131yla ba\u011fland\u0131\u011f\u0131n\u0131 ve veri g\u00f6nderdi\u011fini g\u00f6sterir. E\u011fer <code>Disconnected<\/code> veya ba\u015fka bir durum g\u00f6r\u00fcyorsan\u0131z, ajan\u0131n yap\u0131land\u0131rmas\u0131n\u0131, anahtar\u0131n\u0131, a\u011f ba\u011flant\u0131s\u0131n\u0131 ve g\u00fcvenlik duvar\u0131 ayarlar\u0131n\u0131 kontrol etmeniz gerekir.<\/p>\n<h4>Log Y\u00f6netimi ve Analizi<\/h4>\n<p>OSSEC sunucusu, ajanlardan gelen t\u00fcm g\u00fcvenlik olaylar\u0131n\u0131 ve uyar\u0131lar\u0131n\u0131 <code>\/var\/ossec\/logs\/alerts\/alerts.log<\/code> dosyas\u0131na yazar. Bu dosya, OSSEC&#8217;in kalbidir ve t\u00fcm g\u00fcvenlik olaylar\u0131n\u0131 i\u00e7erir.<\/p>\n<h5>Ger\u00e7ek Zamanl\u0131 \u0130zleme<\/h5>\n<p>En temel izleme y\u00f6ntemi, <code>tail<\/code> komutu ile <code>alerts.log<\/code> dosyas\u0131n\u0131 ger\u00e7ek zamanl\u0131 olarak takip etmektir:<\/p>\n<pre><code class=\"language-bash\">sudo tail -f \/var\/ossec\/logs\/alerts\/alerts.log<\/code><\/pre>\n<p>Bu komut, yeni uyar\u0131lar olu\u015ftuk\u00e7a ekrana basacakt\u0131r. Ajan makinesinde bir test olay\u0131 olu\u015fturarak (\u00f6rne\u011fin, yanl\u0131\u015f bir parola ile SSH oturumu a\u00e7maya \u00e7al\u0131\u015farak) uyar\u0131lar\u0131n gelip gelmedi\u011fini kontrol edebilirsiniz.<br \/>\nAjan makinesinde:<\/p>\n<pre><code class=\"language-bash\">ssh wronguser@localhost<\/code><\/pre>\n<p>Sunucu makinesinde <code>alerts.log<\/code> \u00e7\u0131kt\u0131s\u0131 \u015funa benzer bir uyar\u0131 g\u00f6sterecektir:<\/p>\n<pre><code class=\"language-\"><em><\/em> Alert 1490940600.12345: - sshd,authentication_failed,\n2023 Mar 30 10:30:00 ubuntu-agent->\/var\/log\/auth.log\nRule: 5712 (level 5) -> 'SSH authentication failed.'\nSrc IP: 127.0.0.1\nUser: wronguser<\/code><\/pre>\n<p>Bu, ajandan gelen loglar\u0131n sunucu taraf\u0131ndan ba\u015far\u0131yla i\u015flendi\u011fini g\u00f6sterir.<\/p>\n<h5>Ge\u00e7mi\u015f Uyar\u0131lar\u0131 \u0130nceleme<\/h5>\n<p><code>alerts.log<\/code> dosyas\u0131 b\u00fcy\u00fcd\u00fck\u00e7e, belirli olaylar\u0131 veya zaman aral\u0131klar\u0131n\u0131 bulmak i\u00e7in <code>grep<\/code>, <code>awk<\/code> gibi komutlar\u0131 kullanabilirsiniz.<br \/>\n\u00d6rne\u011fin, belirli bir IP adresinden gelen SSH ba\u015far\u0131s\u0131z giri\u015f denemelerini bulmak i\u00e7in:<\/p>\n<pre><code class=\"language-bash\">sudo grep \"authentication failed\" \/var\/ossec\/logs\/alerts\/alerts.log | grep \"Src IP: 192.168.1.10\"<\/code><\/pre>\n<p>Uyar\u0131 seviyesine g\u00f6re filtreleme:<\/p>\n<pre><code class=\"language-bash\">sudo grep \"level 10\" \/var\/ossec\/logs\/alerts\/alerts.log<\/code><\/pre>\n<p><code>alerts.json<\/code> dosyas\u0131 da mevcuttur ve yap\u0131land\u0131r\u0131lm\u0131\u015f JSON format\u0131nda uyar\u0131lar i\u00e7erir. Bu dosya, uyar\u0131lar\u0131 SIEM veya log y\u00f6netim sistemleri gibi harici ara\u00e7lara aktarmak i\u00e7in idealdir.<\/p>\n<h4>Sistem B\u00fct\u00fcnl\u00fc\u011f\u00fc \u0130zleme (FIM)<\/h4>\n<p>OSSEC&#8217;in en g\u00fc\u00e7l\u00fc \u00f6zelliklerinden biri FIM&#8217;dir. Ajanlar, izlenen dosya ve dizinlerdeki de\u011fi\u015fiklikleri (i\u00e7erik, izinler, sahiplik, son eri\u015fim zaman\u0131 vb.) tespit eder ve sunucuya bildirir.<\/p>\n<h5>FIM Yap\u0131land\u0131rmas\u0131<\/h5>\n<p>Hem sunucu hem de ajan \u00fczerindeki <code>ossec.conf<\/code> dosyas\u0131nda <code><syscheck><\/code> b\u00f6l\u00fcm\u00fc FIM&#8217;i yap\u0131land\u0131rmak i\u00e7in kullan\u0131l\u0131r. Daha \u00f6nce g\u00f6sterilen \u00f6rnek yap\u0131land\u0131rmada, <code>\/etc<\/code>, <code>\/usr\/bin<\/code>, <code>\/usr\/sbin<\/code>, <code>\/bin<\/code>, <code>\/sbin<\/code>, <code>\/boot<\/code> ve <code>\/var\/www<\/code> gibi kritik dizinler izlenmek \u00fczere ayarlanm\u0131\u015ft\u0131r.<br \/>\nAjan makinesinde <code>\/etc\/passwd<\/code> dosyas\u0131n\u0131 de\u011fi\u015ftirmeyi deneyin:<\/p>\n<pre><code class=\"language-bash\">sudo nano \/etc\/passwd<\/code><\/pre>\n<p>Dosyaya rastgele bir karakter ekleyip kaydedin. Birka\u00e7 dakika i\u00e7inde OSSEC sunucusu <code>alerts.log<\/code> dosyas\u0131nda buna benzer bir uyar\u0131 g\u00f6sterecektir:<\/p>\n<pre><code class=\"language-\"><em><\/em> Alert 1490940700.12345: - ossec,syscheck,pci_dss_11.5.1,\n2023 Mar 30 10:31:00 ubuntu-agent->syscheck\nRule: 550 (level 7) -> 'Integrity checksum changed for: '\/etc\/passwd'.'\nFile: \/etc\/passwd\nPrevious hash: 12345...\nNew hash: 67890...<\/code><\/pre>\n<p>Bu, OSSEC&#8217;in dosya b\u00fct\u00fcnl\u00fc\u011f\u00fc de\u011fi\u015fikliklerini ba\u015far\u0131yla izledi\u011fini g\u00f6sterir.<\/p>\n<h4>Rootkit ve Zafiyet Tespiti<\/h4>\n<p>OSSEC, bilinen rootkit&#8217;leri ve sistemdeki zafiyetleri tespit etmek i\u00e7in \u00f6nceden tan\u0131mlanm\u0131\u015f kurallar ve veritabanlar\u0131 kullan\u0131r. Sunucu \u00fczerinde \u00e7al\u0131\u015fan rootcheck motoru, ajanlardan gelen bilgileri analiz ederek \u015f\u00fcpheli aktiviteleri belirler.<br \/>\n<code><rootcheck><\/code> b\u00f6l\u00fcm\u00fc, <code>ossec.conf<\/code> i\u00e7inde yap\u0131land\u0131r\u0131l\u0131r. Ajan \u00fczerinde rootcheck&#8217;i etkinle\u015ftirdiyseniz (varsay\u0131lan olarak genellikle kapal\u0131d\u0131r), OSSEC periyodik olarak sistemde rootkit belirtileri arayacakt\u0131r. Tespit edildi\u011finde, <code>alerts.log<\/code> dosyas\u0131na y\u00fcksek seviyeli uyar\u0131lar yaz\u0131lacakt\u0131r.<\/p>\n<h4>Aktif Yan\u0131t (Active Response)<\/h4>\n<p>OSSEC, belirli uyar\u0131 seviyelerine ula\u015f\u0131ld\u0131\u011f\u0131nda otomatik olarak yan\u0131t vermesini sa\u011flayacak aktif yan\u0131t mekanizmalar\u0131na sahiptir. \u00d6rne\u011fin, bir IP adresinden belirli say\u0131da ba\u015far\u0131s\u0131z SSH denemesi gelirse, OSSEC o IP adresini g\u00fcvenlik duvar\u0131nda engelleyebilir.<\/p>\n<h5>Aktif Yan\u0131t Yap\u0131land\u0131rmas\u0131<\/h5>\n<p>Aktif yan\u0131t, hem sunucu hem de ajan taraf\u0131nda yap\u0131land\u0131r\u0131labilir. Genellikle sunucu taraf\u0131nda yap\u0131land\u0131r\u0131l\u0131r ve komutlar yerel olarak sunucuda \u00e7al\u0131\u015f\u0131r veya ajanlara komut g\u00f6nderilir.<br \/>\nSunucu <code>ossec.conf<\/code> dosyas\u0131nda <code><active-response><\/code> etiketleri ile aktif yan\u0131t kurallar\u0131 tan\u0131mlan\u0131r. Yukar\u0131daki \u00f6rnek yap\u0131land\u0131rmada <code>host-deny<\/code> ve <code>firewall-drop<\/code> komutlar\u0131, seviye 6 ve \u00fczeri uyar\u0131lar i\u00e7in 360 saniye boyunca IP adresini engellemek \u00fczere ayarlanm\u0131\u015ft\u0131r.<\/p>\n<p><strong>\u00d6NEML\u0130:<\/strong> Aktif yan\u0131t\u0131 dikkatli bir \u015fekilde yap\u0131land\u0131r\u0131n. Yanl\u0131\u015f yap\u0131land\u0131rma, me\u015fru kullan\u0131c\u0131lar\u0131 veya hizmetleri engelleyerek kesintilere neden olabilir. Test ortam\u0131nda denemeden \u00fcretim ortam\u0131nda kullanmay\u0131n.<\/p>\n<h4>Uyar\u0131 Seviyeleri ve Kurallar<\/h4>\n<p>OSSEC, olaylar\u0131 \u00f6nem derecelerine g\u00f6re s\u0131n\u0131fland\u0131rmak i\u00e7in uyar\u0131 seviyeleri (level 1&#8217;den 15&#8217;e kadar) kullan\u0131r. Seviye 1 en d\u00fc\u015f\u00fck, seviye 15 en y\u00fcksek \u00f6neme sahiptir.<br \/>\nOSSEC, <code>\/var\/ossec\/rules<\/code> dizininde bir\u00e7ok \u00f6nceden tan\u0131mlanm\u0131\u015f kural dosyas\u0131 ile gelir. Bu kurallar, farkl\u0131 log t\u00fcrleri ve g\u00fcvenlik olaylar\u0131 i\u00e7in tasarlanm\u0131\u015ft\u0131r.<\/p>\n<h5>\u00d6zel Kurallar Olu\u015fturma<\/h5>\n<p>Kendi \u00f6zel kurallar\u0131n\u0131z\u0131 olu\u015fturmak veya mevcut kurallar\u0131 de\u011fi\u015ftirmek i\u00e7in <code>\/var\/ossec\/rules\/local_rules.xml<\/code> dosyas\u0131n\u0131 kullanmal\u0131s\u0131n\u0131z. Bu dosya, OSSEC g\u00fcncellemeleri s\u0131ras\u0131nda \u00fczerine yaz\u0131lmayaca\u011f\u0131 i\u00e7in g\u00fcvenlidir.<br \/>\n\u00d6rnek: Belirli bir kelime i\u00e7eren syslog mesajlar\u0131 i\u00e7in \u00f6zel bir uyar\u0131 olu\u015fturmak.<\/p>\n<pre><code class=\"language-xml\"><!-- \/var\/ossec\/rules\/local_rules.xml -->\n<group name=\"local,syslog,\">\n  <rule id=\"100001\" level=\"7\">\n    <if_sid>510<\/if_sid>\n    <match>CRITICAL_KEYWORD<\/match>\n    <description>Kritik bir anahtar kelime syslog'da tespit edildi.<\/description>\n  <\/rule>\n<\/group><\/code><\/pre>\n<p>Bu kural, e\u011fer syslog&#8217;da (510 numaral\u0131 kural, genel syslog mesajlar\u0131n\u0131 yakalar) &#8220;CRITICAL_KEYWORD&#8221; kelimesi ge\u00e7erse, seviye 7&#8217;de bir uyar\u0131 olu\u015fturacakt\u0131r.<\/p>\n<h5>Kurallar\u0131 Test Etme<\/h5>\n<p>Yeni bir kural olu\u015fturduktan veya mevcut bir kural\u0131 de\u011fi\u015ftirdikten sonra, <code>ossec-logtest<\/code> yard\u0131mc\u0131 program\u0131n\u0131 kullanarak kural\u0131 test etmek \u00e7ok \u00f6nemlidir:<\/p>\n<pre><code class=\"language-bash\">sudo \/var\/ossec\/bin\/ossec-logtest<\/code><\/pre>\n<p>Ard\u0131ndan, test etmek istedi\u011finiz log sat\u0131r\u0131n\u0131 yap\u0131\u015ft\u0131r\u0131n ve Enter tu\u015funa bas\u0131n. OSSEC, bu log sat\u0131r\u0131na hangi kurallar\u0131n uydu\u011funu ve hangi uyar\u0131 seviyesinin tetiklenece\u011fini g\u00f6sterecektir.<br \/>\n\u00d6rnek:<\/p>\n<pre><code class=\"language-\">Type your log here (or 'quit' to exit): Mar 30 10:35:00 ubuntu-agent CRITICAL_KEYWORD detected in system log.<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131, kural\u0131n\u0131z\u0131n ba\u015far\u0131yla tetiklenip tetiklenmedi\u011fini g\u00f6sterecektir.<\/p>\n<h3>Sorun Giderme ve En \u0130yi Uygulamalar<\/h3>\n<h4>Ortak Sorunlar<\/h4>\n<ul>\n<li><strong>Ajan\u0131n Ba\u011flant\u0131s\u0131n\u0131n Kesilmesi (Disconnected Agent):<\/strong>\n<ul>\n<li><strong>G\u00fcvenlik Duvar\u0131:<\/strong> Sunucu ve ajan aras\u0131ndaki 1514\/UDP portunun a\u00e7\u0131k oldu\u011fundan emin olun. Hem sunucu hem de ajan taraf\u0131nda g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 kontrol edin (<code>sudo ufw status<\/code> veya <code>sudo iptables -L<\/code>).<\/li>\n<li><strong>Yanl\u0131\u015f IP veya Anahtar:<\/strong> Ajan\u0131n <code>ossec.conf<\/code> dosyas\u0131ndaki <code><server-ip><\/code> adresinin do\u011fru oldu\u011fundan ve <code>client.keys<\/code> dosyas\u0131ndaki anahtar\u0131n sunucudan al\u0131nan anahtarla e\u015fle\u015fti\u011finden emin olun.<\/li>\n<li><strong>Ajan Servisi Kapal\u0131:<\/strong> Ajan makinesinde OSSEC ajan servisinin \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olun (<code>sudo service ossec-hids-agent status<\/code>).<\/li>\n<li><strong>Zaman Senkronizasyonu:<\/strong> Sunucu ve ajan aras\u0131nda zaman fark\u0131 varsa (NTP ile senkronize de\u011filse) ileti\u015fim sorunlar\u0131 ya\u015fanabilir.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Uyar\u0131lar\u0131n Gelmemesi:<\/strong>\n<ul>\n<li><strong>Log Yolu:<\/strong> Ajan\u0131n <code>ossec.conf<\/code> dosyas\u0131nda <code><localfile><\/code> etiketlerinde belirtilen log yollar\u0131n\u0131n do\u011fru oldu\u011fundan ve ajan taraf\u0131ndan okunabilir oldu\u011fundan emin olun.<\/li>\n<li><strong>Kural Yoklu\u011fu\/Yanl\u0131\u015fl\u0131\u011f\u0131:<\/strong> \u0130lgili g\u00fcvenlik olay\u0131n\u0131 yakalayacak bir kural\u0131n olup olmad\u0131\u011f\u0131n\u0131 veya kural\u0131n do\u011fru yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131n\u0131 kontrol edin (<code>ossec-logtest<\/code> kullan\u0131n).<\/li>\n<li><strong>Uyar\u0131 Seviyesi:<\/strong> Olu\u015fturulan uyar\u0131 seviyesinin <code>alerts.log<\/code>&#8216;a yaz\u0131lacak minimum seviyenin (<code><alerts><log_alert_level><\/code>) alt\u0131nda olmad\u0131\u011f\u0131ndan emin olun.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Performans Sorunlar\u0131:<\/strong>\n<ul>\n<li><strong>Y\u00fcksek Log Hacmi:<\/strong> \u00c7ok fazla log dosyas\u0131n\u0131 izlemek veya \u00e7ok detayl\u0131 loglama yapmak CPU ve disk kullan\u0131m\u0131n\u0131 art\u0131rabilir. Gereksiz loglar\u0131 filtreleyin veya sadece kritik loglar\u0131 izleyin.<\/li>\n<li><strong>Sistem B\u00fct\u00fcnl\u00fc\u011f\u00fc \u0130zleme Frekans\u0131:<\/strong> <code>syscheck<\/code> frekans\u0131n\u0131 (<code><frequency><\/code>) art\u0131rmak (daha s\u0131k tarama) kaynak t\u00fcketimini art\u0131r\u0131r. Daha uzun aral\u0131klar belirleyin veya sadece kritik dizinleri izleyin.<\/li>\n<li><strong>Ignore Listeleri:<\/strong> <code>syscheck<\/code> i\u00e7in s\u0131k de\u011fi\u015fen ancak \u00f6nemsiz olan dosyalar\u0131 (<code>\/var\/log\/lastlog<\/code>, <code>\/etc\/mtab<\/code> vb.) <code>ignore<\/code> listesine ekleyerek gereksiz taramalar\u0131 azalt\u0131n.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4>En \u0130yi Uygulamalar<\/h4>\n<ul>\n<li><strong>D\u00fczenli Log Kontrol\u00fc:<\/strong> Sadece otomatik uyar\u0131lar\u0131 beklemeyin. Periyodik olarak <code>alerts.log<\/code> dosyas\u0131n\u0131 g\u00f6zden ge\u00e7irin.<\/li>\n<li><strong>Minimum Ayr\u0131cal\u0131k Prensibi:<\/strong> OSSEC ajanlar\u0131n\u0131n ve sunucusunun \u00e7al\u0131\u015ft\u0131\u011f\u0131 kullan\u0131c\u0131lar\u0131n sadece gerekli ayr\u0131cal\u0131klara sahip oldu\u011fundan emin olun.<\/li>\n<li><strong>Kritik Dosya ve Dizinleri \u0130zleme:<\/strong> \u00d6zellikle <code>\/etc<\/code>, <code>\/bin<\/code>, <code>\/sbin<\/code>, <code>\/usr\/bin<\/code>, <code>\/usr\/sbin<\/code> ve web sunucusu k\u00f6k dizinleri gibi kritik sistem dizinlerini ve dosyalar\u0131n\u0131 FIM ile izleyin.<\/li>\n<li><strong>Gereksiz Loglar\u0131 Filtreleme:<\/strong> Sadece g\u00fcvenlik a\u00e7\u0131s\u0131ndan anlaml\u0131 olan loglar\u0131 i\u015fleyin. G\u00fcr\u00fclt\u00fcy\u00fc azaltmak, \u00f6nemli uyar\u0131lar\u0131 ka\u00e7\u0131rman\u0131z\u0131 engeller.<\/li>\n<li><strong>Kurallar\u0131 \u00d6zelle\u015ftirme:<\/strong> Ortam\u0131n\u0131za \u00f6zg\u00fc tehditleri ve davran\u0131\u015flar\u0131 tespit etmek i\u00e7in <code>local_rules.xml<\/code> dosyas\u0131nda \u00f6zel kurallar olu\u015fturun.<\/li>\n<li><strong>OSSEC&#8217;i G\u00fcncel Tutma:<\/strong> G\u00fcvenlik yamalar\u0131 ve yeni \u00f6zellikler i\u00e7in OSSEC&#8217;i d\u00fczenli olarak g\u00fcncelleyin (Ubuntu 14.04 i\u00e7in bu, OSSEC&#8217;in daha yeni s\u00fcr\u00fcmlerini derlemeyi gerektirebilir).<\/li>\n<li><strong>Yedekleme:<\/strong> OSSEC yap\u0131land\u0131rma dosyalar\u0131n\u0131 (<code>ossec.conf<\/code>, <code>local_rules.xml<\/code>) ve \u00f6zellikle <code>client.keys<\/code> dosyas\u0131n\u0131 d\u00fczenli olarak yedekleyin.<\/li>\n<li><strong>Zaman Senkronizasyonu (NTP):<\/strong> Sunucu ve t\u00fcm ajanlar\u0131n NTP ile senkronize oldu\u011fundan emin olun. Bu, olaylar\u0131n do\u011fru kronolojik s\u0131rayla i\u015flenmesi ve korelasyonu i\u00e7in kritik \u00f6neme sahiptir.<\/li>\n<li><strong>Web Aray\u00fczleri ile Entegrasyon:<\/strong> B\u00fcy\u00fck ve karma\u015f\u0131k ortamlar i\u00e7in, OSSEC uyar\u0131lar\u0131n\u0131 g\u00f6rselle\u015ftirmek ve daha kolay y\u00f6netmek amac\u0131yla Kibana\/Elastic Stack gibi ara\u00e7larla entegrasyon d\u00fc\u015f\u00fcn\u00fcn. OSSEC&#8217;in <code>\/var\/ossec\/logs\/alerts\/alerts.json<\/code> \u00e7\u0131kt\u0131s\u0131 bu t\u00fcr entegrasyonlar i\u00e7in idealdir.<\/li>\n<\/ul>\n<h3>Sonu\u00e7<\/h3>\n<p>OSSEC, a\u00e7\u0131k kaynakl\u0131 bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc olarak sistemlerinizin g\u00fcvenli\u011fini art\u0131rmak i\u00e7in g\u00fc\u00e7l\u00fc yetenekler sunar. Bu rehberde, Ubuntu 14.04 \u00fczerinde bir OSSEC sunucusu kurmay\u0131, ajanlar\u0131 yap\u0131land\u0131rmay\u0131 ve en \u00f6nemlisi, merkezi bir noktadan bu ajanlardan gelen g\u00fcvenlik olaylar\u0131n\u0131 nas\u0131l etkili bir \u015fekilde izleyece\u011finizi \u00f6\u011frendiniz.<\/p>\n<p>Merkezi log analizi, sistem b\u00fct\u00fcnl\u00fc\u011f\u00fc izleme, rootkit tespiti ve aktif yan\u0131t gibi \u00f6zellikleriyle OSSEC, g\u00fcvenlik duru\u015funuzu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirebilir. Do\u011fru yap\u0131land\u0131rma ve s\u00fcrekli izleme ile OSSEC, potansiyel g\u00fcvenlik tehditlerini erken a\u015famada tespit etmenize ve bunlara kar\u015f\u0131 proaktif \u00f6nlemler alman\u0131za yard\u0131mc\u0131 olacakt\u0131r. G\u00fcvenlik, s\u00fcrekli bir s\u00fcre\u00e7tir ve OSSEC gibi ara\u00e7lar, bu s\u00fcre\u00e7te vazge\u00e7ilmez birer m\u00fcttefiktir. Unutmay\u0131n, bu rehber Ubuntu 14.04&#8217;e odaklanm\u0131\u015f olsa da, OSSEC&#8217;in temel prensipleri ve komutlar\u0131 modern Linux da\u011f\u0131t\u0131mlar\u0131nda da b\u00fcy\u00fck \u00f6l\u00e7\u00fcde ayn\u0131 kalmaktad\u0131r. G\u00fcvenlik yolculu\u011funuzda OSSEC&#8217;in potansiyelini tam olarak kullanmak i\u00e7in yap\u0131land\u0131rmalar\u0131 kendi ortam\u0131n\u0131za g\u00f6re \u00f6zelle\u015ftirmekten ve \u00f6zel kurallar geli\u015ftirmekten \u00e7ekinmeyin.<br \/>\n<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi\nGiri\u015f\nBilgi g\u00fcvenli\u011fi, g\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda her kurulu\u015f","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-38383","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v20.5 (Yoast SEO v25.3.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi\" \/>\n<meta property=\"og:description\" content=\"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi Giri\u015f Bilgi g\u00fcvenli\u011fi, g\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda her kurulu\u015f\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-29T23:40:53+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi\",\"datePublished\":\"2026-01-29T23:40:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\"},\"wordCount\":2867,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\",\"name\":\"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-01-29T23:40:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi","og_description":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi Giri\u015f Bilgi g\u00fcvenli\u011fi, g\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda her kurulu\u015f","og_url":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-01-29T23:40:53+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"18 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi","datePublished":"2026-01-29T23:40:53+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/"},"wordCount":2867,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/","name":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-01-29T23:40:53+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/ossec-sunucusu-uzerinden-ossec-ajanlarini-izleme-ubuntu-14-04-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"OSSEC Sunucusu \u00dczerinden OSSEC Ajanlar\u0131n\u0131 \u0130zleme: Ubuntu 14.04 Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=38383"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38383\/revisions"}],"predecessor-version":[{"id":38384,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38383\/revisions\/38384"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=38383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=38383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=38383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}