{"id":38466,"date":"2026-01-31T17:40:50","date_gmt":"2026-01-31T14:40:50","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=38466"},"modified":"2026-01-31T17:40:50","modified_gmt":"2026-01-31T14:40:50","slug":"fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/","title":{"rendered":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131"},"content":{"rendered":"

<\/p>\n

Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131<\/h2>\n

Linux sunucular\u0131, internete a\u00e7\u0131k olduklar\u0131 s\u00fcrece s\u00fcrekli olarak \u00e7e\u015fitli siber sald\u0131r\u0131lar\u0131n hedefi haline gelirler. Bu sald\u0131r\u0131lar\u0131n ba\u015f\u0131nda, kullan\u0131c\u0131 ad\u0131 ve \u015fifreleri tahmin etmeye y\u00f6nelik “brute-force” (kaba kuvvet) ve “dictionary” (s\u00f6zl\u00fck) sald\u0131r\u0131lar\u0131 gelir. \u00d6zellikle SSH (Secure Shell) gibi kritik servisler, sunucuya uzaktan eri\u015fim sa\u011flad\u0131\u011f\u0131 i\u00e7in bu t\u00fcr sald\u0131r\u0131lara kar\u015f\u0131 olduk\u00e7a savunmas\u0131zd\u0131r. Ba\u015far\u0131s\u0131z giri\u015f denemeleri sadece g\u00fcvenlik riski olu\u015fturmakla kalmaz, ayn\u0131 zamanda sunucu kaynaklar\u0131n\u0131 t\u00fcketerek performans\u0131 d\u00fc\u015f\u00fcrebilir ve yasal kullan\u0131c\u0131lar\u0131n eri\u015fimini engelleyebilir. \u0130\u015fte bu noktada Fail2Ban devreye girer. Fail2Ban, Linux sistemlerinde \u00e7al\u0131\u015fan, log dosyalar\u0131n\u0131 izleyerek k\u00f6t\u00fc niyetli aktiviteyi tespit eden ve belirli bir s\u00fcre boyunca bu aktiviteleri ger\u00e7ekle\u015ftiren IP adreslerini otomatik olarak engelleyen g\u00fc\u00e7l\u00fc bir sald\u0131r\u0131 \u00f6nleme arac\u0131d\u0131r. Bu makalede, Fail2Ban’in ne oldu\u011funu, nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131, kurulumunu, yap\u0131land\u0131rmas\u0131n\u0131 ve sunucular\u0131n\u0131z\u0131 korumak i\u00e7in nas\u0131l etkin bir \u015fekilde kullanabilece\u011finizi detayl\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n

Neden Fail2Ban’e \u0130htiya\u00e7 Duyar\u0131z?<\/h3>\n

G\u00fcn\u00fcm\u00fczde internete ba\u011fl\u0131 her sunucu, potansiyel bir sald\u0131r\u0131 vekt\u00f6r\u00fcd\u00fcr. Sald\u0131rganlar, zay\u0131f \u015fifreleri veya varsay\u0131lan yap\u0131land\u0131rmalar\u0131 kullanarak sistemlere s\u0131zmaya \u00e7al\u0131\u015f\u0131rlar. Fail2Ban’in neden bu kadar \u00f6nemli oldu\u011funu anlamak i\u00e7in kar\u015f\u0131la\u015f\u0131lan yayg\u0131n tehditlere g\u00f6z atmak faydal\u0131 olacakt\u0131r:<\/p>\n

Brute-Force Sald\u0131r\u0131lar\u0131<\/h4>\n

Brute-force sald\u0131r\u0131lar\u0131, bir sald\u0131rgan\u0131n t\u00fcm olas\u0131 \u015fifre kombinasyonlar\u0131n\u0131 veya yayg\u0131n kullan\u0131lan \u015fifre listelerini sistematik olarak deneyerek bir sisteme yetkisiz eri\u015fim sa\u011flamaya \u00e7al\u0131\u015ft\u0131\u011f\u0131 bir y\u00f6ntemdir. \u00d6zellikle SSH, FTP, SMTP gibi servisler, bu t\u00fcr sald\u0131r\u0131lar\u0131n ana hedefleridir. Bir sunucuda, saniyede onlarca, hatta y\u00fczlerce ba\u015far\u0131s\u0131z giri\u015f denemesi g\u00f6rebilirsiniz. Bu durum sadece g\u00fcvenlik a\u00e7\u0131\u011f\u0131 yaratmakla kalmaz, ayn\u0131 zamanda CPU, bellek ve a\u011f bant geni\u015fli\u011fi gibi sunucu kaynaklar\u0131n\u0131 da a\u015f\u0131r\u0131 derecede t\u00fcketir, bu da me\u015fru kullan\u0131c\u0131lar\u0131n servislerden yararlanmas\u0131n\u0131 engeller.<\/p>\n

S\u00f6zl\u00fck Sald\u0131r\u0131lar\u0131<\/h4>\n

S\u00f6zl\u00fck sald\u0131r\u0131lar\u0131, brute-force sald\u0131r\u0131lar\u0131n\u0131n bir alt k\u00fcmesidir ve genellikle daha verimlidir. Sald\u0131rganlar, yayg\u0131n \u015fifreler, isimler, tarihler veya \u00f6nceden ele ge\u00e7irilmi\u015f \u015fifre veritabanlar\u0131ndan elde edilen kombinasyonlar\u0131 i\u00e7eren “s\u00f6zl\u00fck” dosyalar\u0131n\u0131 kullanarak giri\u015f yapmaya \u00e7al\u0131\u015f\u0131r. Bu y\u00f6ntem, \u00f6zellikle zay\u0131f ve tahmin edilebilir \u015fifreler kullanan hesaplar i\u00e7in b\u00fcy\u00fck bir risktir.<\/p>\n

Kaynak T\u00fcketimi ve Hizmet Reddi<\/h4>\n

S\u00fcrekli ba\u015far\u0131s\u0131z giri\u015f denemeleri, sunucunun i\u015flemci g\u00fcc\u00fcn\u00fc, belle\u011fini ve a\u011f kaynaklar\u0131n\u0131 gereksiz yere me\u015fgul eder. Her deneme, sunucunun kimlik do\u011frulama mekanizmas\u0131n\u0131 tetikler ve log dosyalar\u0131na kay\u0131t d\u00fc\u015fer. Bu durum, sunucunun yava\u015flamas\u0131na, hatta belirli bir noktada tamamen hizmet d\u0131\u015f\u0131 kalmas\u0131na (Denial of Service – DoS) neden olabilir. Fail2Ban, bu t\u00fcr sald\u0131r\u0131lar\u0131 erken a\u015famada tespit edip engelleyerek sunucu kaynaklar\u0131n\u0131n korunmas\u0131na yard\u0131mc\u0131 olur.<\/p>\n

G\u00fcvenlik A\u00e7\u0131klar\u0131 ve Zay\u0131f \u015eifreler<\/h4>\n

Kullan\u0131c\u0131lar\u0131n zay\u0131f \u015fifreler kullanmas\u0131 veya varsay\u0131lan \u015fifreleri de\u011fi\u015ftirmemesi, sald\u0131rganlar i\u00e7in kolay bir hedef olu\u015fturur. Fail2Ban, bu t\u00fcr zafiyetleri do\u011frudan d\u00fczeltmese de, bu zafiyetlerden yararlanmaya \u00e7al\u0131\u015fan otomatik botlara kar\u015f\u0131 bir savunma hatt\u0131 olu\u015fturur. G\u00fc\u00e7l\u00fc \u015fifre politikalar\u0131 ve Fail2Ban gibi ara\u00e7lar\u0131n birle\u015fimi, \u00e7ok daha sa\u011flam bir g\u00fcvenlik duru\u015fu sa\u011flar.<\/p>\n

Fail2Ban Nedir?<\/h3>\n

Fail2Ban, Python ile yaz\u0131lm\u0131\u015f, a\u00e7\u0131k kaynakl\u0131 bir sald\u0131r\u0131 \u00f6nleme yaz\u0131l\u0131m\u0131d\u0131r. Temel amac\u0131, Linux sunucular\u0131ndaki servislerin (SSH, Apache, Nginx, Postfix, FTP vb.) log dosyalar\u0131n\u0131 izlemek ve belirli bir s\u00fcre i\u00e7inde \u00e7ok say\u0131da ba\u015far\u0131s\u0131z giri\u015f denemesi veya ba\u015fka k\u00f6t\u00fc niyetli davran\u0131\u015flar sergileyen IP adreslerini otomatik olarak engellemektir. Bu engelleme i\u015flemi genellikle sunucunun g\u00fcvenlik duvar\u0131 (iptables, nftables, firewalld gibi) kurallar\u0131 \u00fczerinden ger\u00e7ekle\u015ftirilir.<\/p>\n

Fail2Ban’in \u00e7al\u0131\u015fma prensibi olduk\u00e7a basittir:<\/p>\n

1. Log Dosyalar\u0131n\u0131 \u0130zleme:<\/strong> Fail2Ban, yap\u0131land\u0131r\u0131ld\u0131\u011f\u0131 servislerin log dosyalar\u0131n\u0131 s\u00fcrekli olarak tarar (\u00f6rne\u011fin, \/var\/log\/auth.log<\/code> SSH i\u00e7in, \/var\/log\/apache2\/error.log<\/code> Apache i\u00e7in).
\n2. Desen E\u015fle\u015ftirme:<\/strong> Bu log dosyalar\u0131nda, \u00f6nceden tan\u0131mlanm\u0131\u015f d\u00fczenli ifadeler (regex) kullanarak k\u00f6t\u00fc niyetli aktivite g\u00f6steren desenleri (\u00f6rne\u011fin, “Authentication failure” veya “Invalid user”) arar.
\n3. Sald\u0131rgan Tespiti:<\/strong> E\u011fer belirli bir IP adresinden belirli bir zaman dilimi i\u00e7inde (findtime) belirli bir say\u0131da (maxretry) e\u015fle\u015fen desen tespit edilirse, Fail2Ban bu IP adresini sald\u0131rgan olarak i\u015faretler.
\n4. Aksiyon Alma:<\/strong> \u0130\u015faretlenen IP adresi i\u00e7in \u00f6nceden tan\u0131mlanm\u0131\u015f bir “aksiyon” (action) ger\u00e7ekle\u015ftirilir. Bu aksiyon genellikle IP adresini g\u00fcvenlik duvar\u0131 \u00fczerinden belirli bir s\u00fcre boyunca (bantime) engellemektir.
\n5. Engeli Kald\u0131rma:<\/strong> Belirlenen engelleme s\u00fcresi doldu\u011funda, Fail2Ban otomatik olarak IP adresinin engelini kald\u0131r\u0131r.<\/p>\n

Bu d\u00f6ng\u00fc, sunucunun g\u00fcvenli\u011fini otomatik ve proaktif bir \u015fekilde sa\u011flamaya devam eder.<\/p>\n

Fail2Ban’in Temel Bile\u015fenleri ve \u00c7al\u0131\u015fma Prensibi<\/h3>\n

Fail2Ban’in etkin bir \u015fekilde \u00e7al\u0131\u015fabilmesi i\u00e7in birka\u00e7 temel bile\u015fene ve bunlar\u0131n birbiriyle uyumlu \u00e7al\u0131\u015fmas\u0131na ihtiya\u00e7 vard\u0131r. Bu bile\u015fenler, Fail2Ban’in esnekli\u011fini ve \u00f6zelle\u015ftirilebilirli\u011fini sa\u011flar.<\/p>\n

Jail (H\u00fccre)<\/h4>\n

“Jail” veya “h\u00fccre”, Fail2Ban’in en temel yap\u0131land\u0131rma birimidir. Her jail, belirli bir servisi (\u00f6rne\u011fin SSH, Apache, Nginx, Postfix) ve o servise \u00f6zg\u00fc g\u00fcvenlik politikalar\u0131n\u0131 tan\u0131mlar. Bir jail, a\u015fa\u011f\u0131daki temel parametreleri i\u00e7erir:<\/p>\n

* enabled<\/code><\/strong>: Jail’in etkin olup olmad\u0131\u011f\u0131n\u0131 belirtir (true<\/code> veya false<\/code>).
\n* port<\/code><\/strong>: Servisin kulland\u0131\u011f\u0131 port numaras\u0131 (\u00f6rne\u011fin, SSH i\u00e7in 22).
\n* filter<\/code><\/strong>: Hangi filtre dosyas\u0131n\u0131n kullan\u0131laca\u011f\u0131n\u0131 belirtir (\u00f6rne\u011fin, sshd<\/code> filtresi SSH i\u00e7in). Bu filtre, log dosyalar\u0131nda aranacak desenleri i\u00e7erir.
\n* logpath<\/code><\/strong>: Servisin log dosyas\u0131n\u0131n yolu (\u00f6rne\u011fin, \/var\/log\/auth.log<\/code>).
\n* maxretry<\/code><\/strong>: Belirlenen findtime<\/code> s\u00fcresi i\u00e7inde izin verilen maksimum ba\u015far\u0131s\u0131z deneme say\u0131s\u0131. Bu say\u0131ya ula\u015f\u0131ld\u0131\u011f\u0131nda IP engellenir.
\n* findtime<\/code><\/strong>: maxretry<\/code> say\u0131s\u0131n\u0131n say\u0131laca\u011f\u0131 s\u00fcre penceresi (saniye cinsinden).
\n* bantime<\/code><\/strong>: Engellenen bir IP adresinin ne kadar s\u00fcreyle engelli kalaca\u011f\u0131 (saniye cinsinden).<\/p>\n

Jail yap\u0131land\u0131rmalar\u0131 genellikle \/etc\/fail2ban\/jail.conf<\/code> dosyas\u0131nda bulunur. Ancak, bu dosyay\u0131 do\u011frudan d\u00fczenlemek yerine, g\u00fcncellemeler s\u0131ras\u0131nda \u00fczerine yaz\u0131lmas\u0131n\u0131 \u00f6nlemek i\u00e7in \/etc\/fail2ban\/jail.local<\/code> ad\u0131nda bir kopya olu\u015fturup bu kopyay\u0131 d\u00fczenlemek en iyi uygulamad\u0131r. jail.local<\/code> dosyas\u0131, jail.conf<\/code> dosyas\u0131ndaki ayarlar\u0131 ge\u00e7ersiz k\u0131lar.<\/p>\n

Filter (Filtre)<\/h4>\n

Filtreler, Fail2Ban’in log dosyalar\u0131nda k\u00f6t\u00fc niyetli desenleri tan\u0131mas\u0131n\u0131 sa\u011flayan d\u00fczenli ifade (regex) setleridir. Her servis i\u00e7in ayr\u0131 bir filtre dosyas\u0131 bulunur ve bunlar genellikle \/etc\/fail2ban\/filter.d\/<\/code> dizininde yer al\u0131r (\u00f6rne\u011fin, sshd.conf<\/code>, apache-auth.conf<\/code>).<\/p>\n

Bir filtre dosyas\u0131 genellikle iki ana b\u00f6l\u00fcmden olu\u015fur:<\/p>\n

* [INCLUDES]<\/code><\/strong>: Di\u011fer filtre dosyalar\u0131n\u0131 veya regex’leri dahil etmek i\u00e7in kullan\u0131l\u0131r.
\n* [Definition]<\/code><\/strong>:
\n * failregex<\/code><\/strong>: Ba\u015far\u0131s\u0131z giri\u015f denemelerini veya k\u00f6t\u00fc niyetli aktiviteleri yakalamak i\u00e7in kullan\u0131lan bir veya daha fazla d\u00fczenli ifade. Fail2Ban, bu regex’leri log sat\u0131rlar\u0131nda arar.
\n * ignoreregex<\/code><\/strong>: Fail2Ban’in g\u00f6z ard\u0131 etmesi gereken, ancak failregex<\/code> ile e\u015fle\u015febilecek desenleri tan\u0131mlar. Bu, yanl\u0131\u015f pozitifleri \u00f6nlemek i\u00e7in kullan\u0131\u015fl\u0131d\u0131r.<\/p>\n

\u00d6rne\u011fin, SSH i\u00e7in sshd.conf<\/code> filtresinde, “Authentication failure” veya “Invalid user” gibi mesajlar\u0131 yakalayan failregex<\/code> sat\u0131rlar\u0131 bulunur. Fail2Ban, bir log sat\u0131r\u0131nda bu desenlerden birini tespit etti\u011finde, ilgili IP adresini sayaca ekler.<\/p>\n

Action (Eylem)<\/h4>\n

Aksiyonlar, bir IP adresi maxretry<\/code> s\u0131n\u0131r\u0131n\u0131 a\u015ft\u0131\u011f\u0131nda Fail2Ban’in ger\u00e7ekle\u015ftirece\u011fi i\u015flemleri tan\u0131mlar. Aksiyon dosyalar\u0131 genellikle \/etc\/fail2ban\/action.d\/<\/code> dizininde bulunur (\u00f6rne\u011fin, iptables-multiport.conf<\/code>, sendmail-whois.conf<\/code>).<\/p>\n

Fail2Ban varsay\u0131lan olarak iptables<\/code> g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 kullanarak IP adreslerini engeller. Ancak farkl\u0131 aksiyonlar da tan\u0131mlanabilir:<\/p>\n

* iptables<\/code><\/strong>: En yayg\u0131n kullan\u0131lan aksiyondur. Belirli bir IP adresini belirli bir port veya t\u00fcm portlar i\u00e7in engellemek \u00fczere iptables<\/code> kurallar\u0131 ekler.
\n* sendmail<\/code><\/strong>: Engelleme ger\u00e7ekle\u015fti\u011finde y\u00f6neticiye e-posta bildirimi g\u00f6nderir.
\n* nftables<\/code><\/strong>: nftables<\/code> kullanan sistemler i\u00e7in.
\n* firewalld<\/code><\/strong>: firewalld<\/code> kullanan sistemler i\u00e7in.
\n* hostsdeny<\/code><\/strong>: hosts.deny<\/code> dosyas\u0131n\u0131 kullanarak engelleme yapar.<\/p>\n

Bir jail i\u00e7in birden fazla aksiyon tan\u0131mlanabilir. \u00d6rne\u011fin, bir IP engellendi\u011finde hem iptables<\/code> ile engellemek hem de y\u00f6neticiye e-posta g\u00f6ndermek m\u00fcmk\u00fcnd\u00fcr. Aksiyonlar, action_<\/code> ile ba\u015flayan de\u011fi\u015fkenler arac\u0131l\u0131\u011f\u0131yla \u00f6zelle\u015ftirilebilir.<\/p>\n

Log Y\u00f6neticisi<\/h4>\n

Fail2Ban, log dosyalar\u0131n\u0131 izleyerek \u00e7al\u0131\u015ft\u0131\u011f\u0131 i\u00e7in, bu log dosyalar\u0131n\u0131n do\u011fru bir \u015fekilde yap\u0131land\u0131r\u0131lmas\u0131 ve y\u00f6netilmesi \u00f6nemlidir. Fail2Ban, inotify<\/code> mekanizmas\u0131 gibi sistem \u00f6zelliklerini kullanarak log dosyalar\u0131ndaki de\u011fi\u015fiklikleri ger\u00e7ek zamanl\u0131 olarak takip eder. Log dosyalar\u0131n\u0131n logrotate<\/code> gibi ara\u00e7larla d\u00fczenli olarak d\u00f6nd\u00fcr\u00fclmesi (rotate) durumunda, Fail2Ban’in bu yeni dosya yap\u0131lar\u0131n\u0131 da takip edebilmesi i\u00e7in uygun yap\u0131land\u0131rmalar\u0131n yap\u0131lmas\u0131 gerekir. Varsay\u0131lan olarak, Fail2Ban bu durumlar\u0131 sorunsuz bir \u015fekilde y\u00f6netir.<\/p>\n

Fail2Ban Nas\u0131l Kurulur ve Yap\u0131land\u0131r\u0131l\u0131r?<\/h3>\n

Fail2Ban’in kurulumu ve temel yap\u0131land\u0131rmas\u0131 olduk\u00e7a basittir, ancak etkin bir koruma sa\u011flamak i\u00e7in do\u011fru ad\u0131mlar\u0131n izlenmesi gerekir.<\/p>\n

Kurulum<\/h4>\n

Fail2Ban, \u00e7o\u011fu Linux da\u011f\u0131t\u0131m\u0131n\u0131n varsay\u0131lan paket depolar\u0131nda bulunur. Kurulum, kullan\u0131lan da\u011f\u0131t\u0131ma g\u00f6re de\u011fi\u015fir:<\/p>\n

* Debian\/Ubuntu tabanl\u0131 sistemler:<\/strong><\/p>\n

sudo apt update\n    sudo apt install fail2ban<\/code><\/pre>\n
*   CentOS\/RHEL\/Fedora tabanl\u0131 sistemler:<\/strong><\/p>\n
sudo yum install epel-release # E\u011fer EPEL deposu y\u00fckl\u00fc de\u011filse\n    sudo yum install fail2ban fail2ban-systemd # fail2ban-systemd systemd ile entegrasyon i\u00e7in<\/code><\/pre>\n
    veya Fedora 22+ ve CentOS 8+ i\u00e7in:<\/p>\n
sudo dnf install fail2ban fail2ban-systemd<\/code><\/pre>\n
Kurulum tamamland\u0131ktan sonra Fail2Ban servisini ba\u015flat\u0131n ve sistem ba\u015flang\u0131c\u0131nda otomatik ba\u015flamas\u0131 i\u00e7in etkinle\u015ftirin:<\/p>\n
sudo systemctl start fail2ban\nsudo systemctl enable fail2ban<\/code><\/pre>\n
Temel Yap\u0131land\u0131rma<\/h4>\n
Fail2Ban’in ana yap\u0131land\u0131rma dosyas\u0131 \/etc\/fail2ban\/jail.conf<\/code>‘tur. Bu dosyay\u0131 do\u011frudan d\u00fczenlemek yerine, jail.local<\/code> ad\u0131nda bir kopya olu\u015fturmak ve de\u011fi\u015fiklikleri bu kopya \u00fczerinde yapmak en iyi uygulamad\u0131r.<\/strong> Bu, gelecekteki g\u00fcncellemelerde yap\u0131land\u0131rman\u0131z\u0131n kaybolmas\u0131n\u0131 \u00f6nler.<\/p>\n
sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/code><\/pre>\n
\u015eimdi \/etc\/fail2ban\/jail.local<\/code> dosyas\u0131n\u0131 bir metin d\u00fczenleyici ile a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/fail2ban\/jail.local<\/code><\/pre>\n
Bu dosya i\u00e7inde, [DEFAULT]<\/code> b\u00f6l\u00fcm\u00fc ve ard\u0131ndan her servis i\u00e7in ayr\u0131 [jail_name]<\/code> b\u00f6l\u00fcmleri bulunur.<\/p>\n
[DEFAULT]<\/code> B\u00f6l\u00fcm\u00fc:<\/strong>
\nBu b\u00f6l\u00fcm, t\u00fcm jail’ler i\u00e7in varsay\u0131lan ayarlar\u0131 tan\u0131mlar. \u00d6zelle\u015ftirmeniz gereken baz\u0131 anahtar parametreler \u015funlard\u0131r:<\/p>\n
*   bantime<\/code><\/strong>: Engelleme s\u00fcresi. Varsay\u0131lan olarak 10 dakika (600 saniye) olabilir. G\u00fcvenli\u011fi art\u0131rmak i\u00e7in bu s\u00fcreyi art\u0131rabilirsiniz, \u00f6rne\u011fin 1 saat (3600 saniye) veya daha uzun.<\/p>\n
bantime = 3600<\/code><\/pre>\n
*   findtime<\/code><\/strong>: Belirli bir IP adresinden maxretry<\/code> say\u0131s\u0131n\u0131n say\u0131laca\u011f\u0131 s\u00fcre penceresi. Varsay\u0131lan olarak 10 dakika (600 saniye) olabilir.<\/p>\n
findtime = 600<\/code><\/pre>\n
*   maxretry<\/code><\/strong>: findtime<\/code> s\u00fcresi i\u00e7inde izin verilen maksimum ba\u015far\u0131s\u0131z deneme say\u0131s\u0131. Varsay\u0131lan olarak 5 olabilir.<\/p>\n
maxretry = 5<\/code><\/pre>\n
*   destemail<\/code><\/strong>: Engelleme ger\u00e7ekle\u015fti\u011finde e-posta bildirimi g\u00f6nderilecek adres. E-posta bildirimlerini etkinle\u015ftirmek isterseniz bu ayar\u0131 yapmal\u0131s\u0131n\u0131z.<\/p>\n
destemail = admin@example.com<\/code><\/pre>\n
*   sendername<\/code><\/strong>: G\u00f6nderilecek e-postalar\u0131n g\u00f6nderen ad\u0131.<\/p>\n
sendername = Fail2Ban<\/code><\/pre>\n
*   mta<\/code><\/strong>: E-posta g\u00f6ndermek i\u00e7in kullan\u0131lacak posta aktar\u0131m arac\u0131s\u0131 (Mail Transfer Agent). Varsay\u0131lan olarak sendmail<\/code> olabilir.<\/p>\n
mta = sendmail<\/code><\/pre>\n
*   action<\/code><\/strong>: Engelleme ger\u00e7ekle\u015fti\u011finde al\u0131nacak varsay\u0131lan aksiyon. Varsay\u0131lan olarak IP adresini engellemek ve e-posta g\u00f6ndermek i\u00e7in action_<\/code> parametresiyle tan\u0131mlanm\u0131\u015f bir aksiyon seti kullan\u0131l\u0131r. \u00d6rne\u011fin:<\/p>\n
action = %(action_mwl)s<\/code><\/pre>\n
    Bu, iptables<\/code> ile engelleme yapar, y\u00f6neticiye e-posta g\u00f6nderir ve whois bilgisi ekler.<\/p>\n
*   ignoreip<\/code><\/strong>: Fail2Ban’in asla engellemeyece\u011fi IP adresleri veya IP aral\u0131klar\u0131. Kendi IP adresinizi veya g\u00fcvenilir a\u011flar\u0131n\u0131z\u0131n IP’lerini buraya eklemek, yanl\u0131\u015fl\u0131kla kendinizi engellemenizi \u00f6nler. Birden fazla IP adresi bo\u015flukla ayr\u0131l\u0131r.<\/p>\n
ignoreip = 127.0.0.1\/8 ::1 192.168.1.0\/24 203.0.113.45<\/code><\/pre>\n
Servis Jail’lerini Etkinle\u015ftirme:<\/strong>
\njail.local<\/code> dosyas\u0131nda, korumak istedi\u011finiz servisler i\u00e7in ilgili jail b\u00f6l\u00fcmlerini bulup enabled = true<\/code> olarak ayarlaman\u0131z gerekir.<\/p>\n
*   SSH Korumas\u0131 (\u00c7ok \u00d6nemli):<\/strong><\/p>\n
[sshd]\n    enabled = true\n    port = ssh\n    filter = sshd\n    logpath = \/var\/log\/auth.log\n    maxretry = 3\n    bantime = 3600<\/code><\/pre>\n
    port = ssh<\/code> asl\u0131nda 22 numaral\u0131 portu ifade eder. E\u011fer SSH portunuzu de\u011fi\u015ftirdiyseniz (ki bu iyi bir g\u00fcvenlik uygulamas\u0131d\u0131r), buraya yeni port numaras\u0131n\u0131 yazmal\u0131s\u0131n\u0131z (\u00f6rne\u011fin port = 2222<\/code>).<\/p>\n
*   Apache Web Sunucusu Korumas\u0131:<\/strong>
\n    Apache i\u00e7in farkl\u0131 jail’ler mevcuttur:
\n    *   [apache-auth]<\/code>: HTTP kimlik do\u011frulama hatalar\u0131 i\u00e7in.
\n    *   [apache-badbots]<\/code>: K\u00f6t\u00fc niyetli botlar\u0131 engellemek i\u00e7in.
\n    *   [apache-noscript]<\/code>: Komut dosyas\u0131 enjeksiyonu denemeleri i\u00e7in.
\n    *   [apache-overflows]<\/code>: Buffer overflow denemeleri i\u00e7in.
\n    *   [apache-dos]<\/code>: Apache DoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131.<\/p>\n
    \u00d6rnek bir Apache kimlik do\u011frulama jail’i:<\/p>\n
[apache-auth]\n    enabled = true\n    port = http,https\n    filter = apache-auth\n    logpath = \/var\/log\/apache2\/error.log # veya \/var\/log\/httpd\/error_log\n    maxretry = 6\n    bantime = 3600<\/code><\/pre>\n
*   Nginx Web Sunucusu Korumas\u0131:<\/strong>
\n    Nginx i\u00e7in de benzer \u015fekilde jail’ler etkinle\u015ftirilebilir. Logpath’i kendi Nginx yap\u0131land\u0131rman\u0131za g\u00f6re ayarlaman\u0131z gerekebilir.<\/p>\n
[nginx-http-auth]\n    enabled = true\n    port = http,https\n    filter = nginx-http-auth\n    logpath = \/var\/log\/nginx\/error.log\n    maxretry = 6\n    bantime = 3600\n\n    [nginx-badbots]\n    enabled = true\n    port = http,https\n    filter = nginx-badbots\n    logpath = \/var\/log\/nginx\/access.log\n    maxretry = 2\n    bantime = 86400 # K\u00f6t\u00fc botlar\u0131 daha uzun s\u00fcre engellemek isteyebilirsiniz<\/code><\/pre>\n
*   E-posta Servisleri (Postfix, Dovecot, etc.):<\/strong><\/p>\n
[postfix]\n    enabled = true\n    port = smtp,ssmtp,submission,imap,imaps,pop3,pop3s\n    filter = postfix\n    logpath = \/var\/log\/mail.log # veya \/var\/log\/maillog\n    maxretry = 5\n    bantime = 3600\n\n    [dovecot]\n    enabled = true\n    port = imap,imaps,pop3,pop3s\n    filter = dovecot\n    logpath = \/var\/log\/mail.log # veya \/var\/log\/maillog\n    maxretry = 5\n    bantime = 3600<\/code><\/pre>\n
Yap\u0131land\u0131rma dosyas\u0131n\u0131 kaydettikten sonra, Fail2Ban servisini yeniden ba\u015flatman\u0131z gerekir ki de\u011fi\u015fiklikler uygulans\u0131n:<\/p>\n
sudo systemctl restart fail2ban<\/code><\/pre>\n
Geli\u015fmi\u015f Yap\u0131land\u0131rma \u0130pu\u00e7lar\u0131<\/h4>\n
*   \u00d6zel Filtreler Yazma:<\/strong> E\u011fer Fail2Ban’in varsay\u0131lan filtreleri belirli bir uygulaman\u0131z\u0131n veya servisinizin loglar\u0131n\u0131 yeterince iyi i\u015flemezse, kendi \u00f6zel filtrelerinizi \/etc\/fail2ban\/filter.d\/<\/code> dizininde olu\u015fturabilirsiniz. D\u00fczenli ifade yetene\u011fi bu noktada \u00e7ok \u00f6nemlidir.
\n*   \u00d6zel Aksiyonlar Tan\u0131mlama:<\/strong> Engellenen IP’ler i\u00e7in daha karma\u015f\u0131k aksiyonlar almak isteyebilirsiniz. \u00d6rne\u011fin, bir IP’yi Cloudflare g\u00fcvenlik duvar\u0131ndan engellemek veya bir bildirim sistemine entegre etmek. Bu t\u00fcr aksiyonlar\u0131 \/etc\/fail2ban\/action.d\/<\/code> dizininde tan\u0131mlayabilirsiniz.
\n*   Backend Ayarlar\u0131:<\/strong> Fail2Ban’in log dosyalar\u0131n\u0131 nas\u0131l izleyece\u011fini belirten backend<\/code> ayar\u0131 vard\u0131r. Varsay\u0131lan olarak auto<\/code> (inotify, polling, gamin) kullan\u0131l\u0131r, ancak belirli durumlarda (\u00f6rne\u011fin eski sistemlerde) polling<\/code> veya inotify<\/code> olarak manuel ayarlanabilir.<\/p>\n
Fail2Ban Y\u00f6netimi ve \u0130zlenmesi<\/h3>\n
Fail2Ban’in do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak ve gerekti\u011finde manuel m\u00fcdahalede bulunmak i\u00e7in baz\u0131 y\u00f6netim komutlar\u0131n\u0131 bilmek \u00f6nemlidir.<\/p>\n
Servis Komutlar\u0131<\/h4>\n
Standart systemctl<\/code> komutlar\u0131, Fail2Ban servisini kontrol etmek i\u00e7in kullan\u0131l\u0131r:<\/p>\n
*   Ba\u015flatma:<\/strong> sudo systemctl start fail2ban<\/code>
\n*   Durdurma:<\/strong> sudo systemctl stop fail2ban<\/code>
\n*   Yeniden Ba\u015flatma:<\/strong> sudo systemctl restart fail2ban<\/code> (Yap\u0131land\u0131rma de\u011fi\u015fikliklerinden sonra gerekli)
\n*   Durum Kontrol\u00fc:<\/strong> sudo systemctl status fail2ban<\/code> (Servisin \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131n\u0131, son loglar\u0131n\u0131 g\u00f6sterir)
\n*   Sistem Ba\u015flang\u0131c\u0131nda Etkinle\u015ftirme:<\/strong> sudo systemctl enable fail2ban<\/code>
\n*   Sistem Ba\u015flang\u0131c\u0131nda Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> sudo systemctl disable fail2ban<\/code><\/p>\n
fail2ban-client Komutlar\u0131<\/h4>\n
Fail2Ban’in kendi komut sat\u0131r\u0131 arac\u0131 olan fail2ban-client<\/code>, daha detayl\u0131 y\u00f6netim ve izleme sa\u011flar:<\/p>\n
*   Genel Durumu G\u00f6r\u00fcnt\u00fcleme:<\/strong> Fail2Ban’in \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve hangi jail’lerin etkin oldu\u011funu g\u00f6sterir.<\/p>\n
sudo fail2ban-client status<\/code><\/pre>\n
*   Belirli Bir Jail’in Durumunu G\u00f6r\u00fcnt\u00fcleme:<\/strong> Belirli bir jail’in (\u00f6rne\u011fin sshd<\/code>) etkin olup olmad\u0131\u011f\u0131n\u0131, engellenen IP adreslerinin listesini ve deneme say\u0131lar\u0131n\u0131 g\u00f6sterir.<\/p>\n
sudo fail2ban-client status sshd<\/code><\/pre>\n
*   Bir IP Adresinin Engelini Kald\u0131rma:<\/strong> Yanl\u0131\u015fl\u0131kla engellenen veya engeli kald\u0131r\u0131lmas\u0131 gereken bir IP adresini manuel olarak serbest b\u0131rak\u0131r.<\/p>\n
sudo fail2ban-client set sshd unbanip 203.0.113.45<\/code><\/pre>\n
    Veya t\u00fcm jail’lerden engeli kald\u0131rmak i\u00e7in:<\/p>\n
sudo fail2ban-client unban 203.0.113.45<\/code><\/pre>\n
*   Yap\u0131land\u0131rmay\u0131 Yeniden Y\u00fckleme:<\/strong> jail.local<\/code> veya di\u011fer yap\u0131land\u0131rma dosyalar\u0131nda de\u011fi\u015fiklik yapt\u0131ktan sonra servisi yeniden ba\u015flatmak yerine sadece yap\u0131land\u0131rmay\u0131 yeniden y\u00fckler.<\/p>\n
sudo fail2ban-client reload<\/code><\/pre>\n
*   Bir IP Adresini Manuel Olarak Engelleme:<\/strong><\/p>\n
sudo fail2ban-client set sshd banip 203.0.113.46<\/code><\/pre>\n
Log Dosyalar\u0131<\/h4>\n
Fail2Ban’in kendi log dosyas\u0131 \/var\/log\/fail2ban.log<\/code>‘dur. Bu dosyay\u0131 inceleyerek hangi IP adreslerinin ne zaman ve hangi jail taraf\u0131ndan engellendi\u011fini g\u00f6rebilirsiniz.<\/p>\n
sudo tail -f \/var\/log\/fail2ban.log<\/code><\/pre>\n
Ayr\u0131ca, Fail2Ban’in iptables<\/code> kurallar\u0131n\u0131 kontrol ederek engellenen IP’leri do\u011frudan g\u00fcvenlik duvar\u0131ndan da g\u00f6rebilirsiniz:<\/p>\n
sudo iptables -L -n<\/code><\/pre>\n
Bu komut, Fail2Ban taraf\u0131ndan eklenen f2b-<\/code> ile ba\u015flayan zincirleri ve bu zincirlerdeki engellenen IP adreslerini g\u00f6sterecektir.<\/p>\n
Fail2Ban’in Avantajlar\u0131 ve Dezavantajlar\u0131<\/h3>\n
Her g\u00fcvenlik arac\u0131 gibi, Fail2Ban’in de kendine \u00f6zg\u00fc avantajlar\u0131 ve dezavantajlar\u0131 bulunmaktad\u0131r.<\/p>\n
Avantajlar\u0131<\/h4>\n
*   Otomatik Koruma:<\/strong> Loglar\u0131 s\u00fcrekli izleyerek ve otomatik olarak IP’leri engelleyerek sunucu y\u00f6neticisinin y\u00fck\u00fcn\u00fc azalt\u0131r.
\n*   Kaynak Verimlili\u011fi:<\/strong> Sadece k\u00f6t\u00fc niyetli aktivite tespit edildi\u011finde devreye girer, bu da normal \u00e7al\u0131\u015fma s\u0131ras\u0131nda sunucu kaynaklar\u0131n\u0131 minimum d\u00fczeyde t\u00fcketmesini sa\u011flar.
\n*   Esneklik ve \u00d6zelle\u015ftirilebilirlik:<\/strong> Kapsaml\u0131 yap\u0131land\u0131rma se\u00e7enekleri, \u00f6zel filtreler ve aksiyonlar sayesinde bir\u00e7ok farkl\u0131 servis ve sald\u0131r\u0131 senaryosuna uyarlanabilir.
\n*   Geni\u015f Servis Deste\u011fi:<\/strong> SSH, Apache, Nginx, Postfix, Dovecot, FTP gibi \u00e7ok \u00e7e\u015fitli pop\u00fcler servisleri koruyabilir.
\n*   Ekstra G\u00fcvenlik Katman\u0131:<\/strong> Mevcut g\u00fcvenlik \u00f6nlemlerine ek olarak, \u00f6zellikle brute-force sald\u0131r\u0131lar\u0131na kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir savunma hatt\u0131 olu\u015fturur.
\n*   Ger\u00e7ek Zamanl\u0131 Tehdit Alg\u0131lama:<\/strong> Loglar\u0131 ger\u00e7ek zamanl\u0131 olarak izleyerek sald\u0131r\u0131lara an\u0131nda tepki verir.<\/p>\n
Dezavantajlar\u0131<\/h4>\n
*   Yanl\u0131\u015f Pozitifler:<\/strong> Yanl\u0131\u015f yap\u0131land\u0131rma veya a\u015f\u0131r\u0131 agresif kurallar nedeniyle me\u015fru kullan\u0131c\u0131lar (\u00f6rne\u011fin, \u015fifresini unutan bir kullan\u0131c\u0131) yanl\u0131\u015fl\u0131kla engellenebilir. Bu durum, eri\u015fim sorunlar\u0131na yol a\u00e7abilir.
\n*   DDoS Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 S\u0131n\u0131rl\u0131 Koruma:<\/strong> Fail2Ban, \u00f6zellikle da\u011f\u0131t\u0131k ve y\u00fcksek hacimli DoS\/DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 tek ba\u015f\u0131na yeterli bir \u00e7\u00f6z\u00fcm de\u011fildir. \u00c7\u00fcnk\u00fc bu t\u00fcr sald\u0131r\u0131lar genellikle binlerce farkl\u0131 IP adresinden gelir ve Fail2Ban’in g\u00fcvenlik duvar\u0131 kurallar\u0131 bu kadar \u00e7ok IP’yi verimli bir \u015fekilde y\u00f6netmekte zorlanabilir.
\n*   Geli\u015fmi\u015f Sald\u0131r\u0131lara Kar\u015f\u0131 Yetersizlik:<\/strong> Yava\u015f ve da\u011f\u0131t\u0131k sald\u0131r\u0131lar (low-and-slow attacks) veya IP adresini s\u00fcrekli de\u011fi\u015ftiren sald\u0131rganlar (proxy veya VPN kullanarak) Fail2Ban’i atlatabilir.
\n*   Yap\u0131land\u0131rma Karma\u015f\u0131kl\u0131\u011f\u0131:<\/strong> \u00d6zellikle \u00f6zel filtreler ve aksiyonlar yazmak, d\u00fczenli ifade bilgisi ve Fail2Ban’in i\u00e7 i\u015fleyi\u015fi hakk\u0131nda derinlemesine bilgi gerektirebilir.
\n*   IP Adresi De\u011fi\u015fikli\u011fi:<\/strong> Sald\u0131rganlar, yeni IP adresleri kullanarak engellemeyi kolayca a\u015fabilirler. Bu nedenle Fail2Ban, tek ba\u015f\u0131na bir \u00e7\u00f6z\u00fcm olmaktan ziyade, \u00e7ok katmanl\u0131 bir g\u00fcvenlik stratejisinin par\u00e7as\u0131 olmal\u0131d\u0131r.
\n*   Log Y\u00fck\u00fc:<\/strong> \u00c7ok yo\u011fun sald\u0131r\u0131larda, Fail2Ban’in i\u015fleyece\u011fi log miktar\u0131 artabilir ve bu da performans d\u00fc\u015f\u00fc\u015f\u00fcne neden olabilir.<\/p>\n
En \u0130yi Uygulamalar ve Ek G\u00fcvenlik \u00d6nlemleri<\/h3>\n
Fail2Ban, sunucu g\u00fcvenli\u011fi i\u00e7in harika bir ara\u00e7 olsa da, tek ba\u015f\u0131na yeterli de\u011fildir. Kapsaml\u0131 bir g\u00fcvenlik stratejisinin par\u00e7as\u0131 olarak di\u011fer g\u00fcvenlik \u00f6nlemleriyle birlikte kullan\u0131lmal\u0131d\u0131r.<\/p>\n
*   G\u00fc\u00e7l\u00fc \u015eifreler ve SSH Anahtarlar\u0131:<\/strong> T\u00fcm kullan\u0131c\u0131 hesaplar\u0131 i\u00e7in uzun, karma\u015f\u0131k ve benzersiz \u015fifreler kullan\u0131n. SSH i\u00e7in parola ile kimlik do\u011frulama yerine SSH anahtar \u00e7iftlerini kullanmay\u0131 tercih edin. Bu, brute-force sald\u0131r\u0131lar\u0131n\u0131n etkinli\u011fini b\u00fcy\u00fck \u00f6l\u00e7\u00fcde azalt\u0131r.
\n*   Varsay\u0131lan SSH Portunu De\u011fi\u015ftirme:<\/strong> SSH servisi genellikle 22 numaral\u0131 portu kullan\u0131r. Bu portu standart olmayan bir portla (\u00f6rne\u011fin 2222 veya 49152-65535 aras\u0131 bir port) de\u011fi\u015ftirmek, otomatik taray\u0131c\u0131lar\u0131n ve botlar\u0131n ke\u015fif sald\u0131r\u0131lar\u0131n\u0131 azalt\u0131r.
\n*   SSH Parola Kimlik Do\u011frulamas\u0131n\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma:<\/strong> SSH anahtarlar\u0131 kullan\u0131yorsan\u0131z, sshd_config<\/code> dosyas\u0131nda PasswordAuthentication no<\/code> ayar\u0131n\u0131 yaparak parola ile giri\u015fi tamamen devre d\u0131\u015f\u0131 b\u0131rak\u0131n. Bu, brute-force sald\u0131r\u0131lar\u0131n\u0131 imkans\u0131z hale getirir.
\n*   G\u00fcvenlik Duvar\u0131 (Firewall) Kullan\u0131m\u0131:<\/strong> Sadece gerekli portlar\u0131 a\u00e7an bir g\u00fcvenlik duvar\u0131 (UFW, iptables, firewalld) yap\u0131land\u0131r\u0131n. \u00d6rne\u011fin, web sunucusu i\u00e7in sadece 80 ve 443 portlar\u0131n\u0131, SSH i\u00e7in ise sadece belirli IP adreslerinden veya VPN \u00fczerinden eri\u015fime izin verin.
\n*   Sistemi ve Yaz\u0131l\u0131mlar\u0131 G\u00fcncel Tutma:<\/strong> \u0130\u015fletim sisteminizi ve t\u00fcm y\u00fckl\u00fc yaz\u0131l\u0131mlar\u0131 (Fail2Ban dahil) d\u00fczenli olarak g\u00fcncelleyin. G\u00fcvenlik yamalar\u0131, bilinen zafiyetleri kapat\u0131r.
\n*   Loglar\u0131 D\u00fczenli \u0130zleme:<\/strong> Fail2Ban’in kendi loglar\u0131n\u0131 (\/var\/log\/fail2ban.log<\/code>) ve korunan servislerin loglar\u0131n\u0131 d\u00fczenli olarak kontrol edin. Bu, \u015f\u00fcpheli aktiviteleri veya yanl\u0131\u015f pozitifleri erken tespit etmenize yard\u0131mc\u0131 olur.
\n*   \u0130ki Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (2FA):<\/strong> M\u00fcmk\u00fcnse, SSH ve di\u011fer kritik servisler i\u00e7in iki fakt\u00f6rl\u00fc kimlik do\u011frulamay\u0131 etkinle\u015ftirin. Bu, \u015fifre \u00e7al\u0131nsa bile yetkisiz eri\u015fimi engeller.
\n*   VPN Kullan\u0131m\u0131:<\/strong> Sunucuya uzaktan eri\u015firken, g\u00fcvenli bir VPN (Virtual Private Network) kullanmak, ba\u011flant\u0131n\u0131z\u0131 \u015fifreleyerek ve IP adresinizi gizleyerek ek bir g\u00fcvenlik katman\u0131 sa\u011flar.
\n*   Web Uygulama G\u00fcvenlik Duvar\u0131 (WAF):<\/strong> Web uygulamalar\u0131n\u0131z\u0131 SQL enjeksiyonu, XSS gibi sald\u0131r\u0131lara kar\u015f\u0131 korumak i\u00e7in bir WAF kullanmay\u0131 d\u00fc\u015f\u00fcn\u00fcn.<\/p>\n
Sonu\u00e7<\/h3>\n
Fail2Ban, Linux sunucular\u0131n\u0131n siber g\u00fcvenlik stratejisinin \u00f6nemli bir par\u00e7as\u0131d\u0131r. \u00d6zellikle brute-force ve s\u00f6zl\u00fck sald\u0131r\u0131lar\u0131na kar\u015f\u0131 otomatik ve proaktif bir koruma sa\u011flayarak sunucu kaynaklar\u0131n\u0131 korur ve yetkisiz eri\u015fim denemelerini engeller. Kurulumu ve temel yap\u0131land\u0131rmas\u0131 nispeten kolayd\u0131r ve \u00e7o\u011fu pop\u00fcler servisi destekler. Ancak, Fail2Ban’in tek ba\u015f\u0131na bir “g\u00fcm\u00fc\u015f kur\u015fun” olmad\u0131\u011f\u0131n\u0131 unutmamak gerekir. Da\u011f\u0131t\u0131k hizmet reddi (DDoS) sald\u0131r\u0131lar\u0131 gibi daha karma\u015f\u0131k tehditlere kar\u015f\u0131 s\u0131n\u0131rl\u0131 koruma sa\u011flar ve yanl\u0131\u015f pozitifler gibi dezavantajlar\u0131 da bulunmaktad\u0131r.<\/p>\n
En iyi g\u00fcvenlik, katmanl\u0131 bir yakla\u015f\u0131mla elde edilir. Fail2Ban’i g\u00fc\u00e7l\u00fc \u015fifre politikalar\u0131, SSH anahtarlar\u0131, g\u00fcvenlik duvar\u0131 kurallar\u0131, d\u00fczenli g\u00fcncellemeler ve iki fakt\u00f6rl\u00fc kimlik do\u011frulama gibi di\u011fer g\u00fcvenlik \u00f6nlemleriyle birle\u015ftirmek, sunucular\u0131n\u0131z\u0131 \u00e7ok daha sa\u011flam bir \u015fekilde koruman\u0131z\u0131 sa\u011flayacakt\u0131r. Siber g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve tehditler evrildik\u00e7e g\u00fcvenlik \u00f6nlemlerinin de g\u00fcncellenmesi ve uyarlanmas\u0131 gerekmektedir. Fail2Ban, bu s\u00fcrekli m\u00fccadelenin \u00f6nemli ve etkili bir arac\u0131d\u0131r.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131\nLinux sunucular\u0131, internete a\u00e7\u0131k olduklar\u0131 s\u00fcrece s\u00fcrekli olarak \u00e7e\u015fitli siber","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-38466","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nFail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131\" \/>\n<meta property=\"og:description\" content=\"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131 Linux sunucular\u0131, internete a\u00e7\u0131k olduklar\u0131 s\u00fcrece s\u00fcrekli olarak \u00e7e\u015fitli siber\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-31T14:40:50+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131\",\"datePublished\":\"2026-01-31T14:40:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\"},\"wordCount\":3448,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\",\"name\":\"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-01-31T14:40:50+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/","og_locale":"tr_TR","og_type":"article","og_title":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131","og_description":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131 Linux sunucular\u0131, internete a\u00e7\u0131k olduklar\u0131 s\u00fcrece s\u00fcrekli olarak \u00e7e\u015fitli siber","og_url":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-01-31T14:40:50+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"19 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131","datePublished":"2026-01-31T14:40:50+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/"},"wordCount":3448,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/","url":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/","name":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131 - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-01-31T14:40:50+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/fail2ban-linux-sunucularinda-hizmetleri-koruma-mekanizmasi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Fail2Ban: Linux Sunucular\u0131nda Hizmetleri Koruma Mekanizmas\u0131"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=38466"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38466\/revisions"}],"predecessor-version":[{"id":38467,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/38466\/revisions\/38467"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=38466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=38466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=38466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}