{"id":43345,"date":"2026-07-15T08:00:38","date_gmt":"2026-07-15T05:00:38","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=43345"},"modified":"2026-07-15T08:00:38","modified_gmt":"2026-07-15T05:00:38","slug":"ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/","title":{"rendered":"Ubuntu 16.04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma"},"content":{"rendered":"

Ubuntu 16.04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma<\/h2>\n

Sunucular\u0131n\u0131za SSH \u00fczerinden eri\u015fimin g\u00fcvenli\u011fini art\u0131rmak, g\u00fcn\u00fcm\u00fcz\u00fcn siber tehdit ortam\u0131nda kritik \u00f6neme sahiptir. Standart \u015fifre tabanl\u0131 kimlik do\u011frulama, zay\u0131f \u015fifreler, kaba kuvvet sald\u0131r\u0131lar\u0131 veya kimlik bilgisi h\u0131rs\u0131zl\u0131\u011f\u0131 gibi \u00e7e\u015fitli zafiyetlere a\u00e7\u0131kt\u0131r. \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulama (MFA), SSH eri\u015fimini \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirerek, sald\u0131rganlar\u0131n yaln\u0131zca bir \u015fifreye sahip olmalar\u0131n\u0131n yeterli olmad\u0131\u011f\u0131n\u0131 garanti eder. Bu makalede, Ubuntu 16.04 \u00fczerinde SSH i\u00e7in MFA’y\u0131 nas\u0131l kuraca\u011f\u0131n\u0131z\u0131 ad\u0131m ad\u0131m a\u00e7\u0131klayaca\u011f\u0131z. Bu s\u00fcre\u00e7te, pop\u00fcler ve g\u00fcvenilir bir MFA \u00e7\u00f6z\u00fcm\u00fc olan Google Authenticator’\u0131 (veya benzeri TOTP tabanl\u0131 uygulamalar\u0131) kullanaca\u011f\u0131z.<\/p>\n

Neden SSH’de MFA Kullanmal\u0131s\u0131n\u0131z?<\/h3>\n

SSH, sunucularla etkile\u015fim kurmak i\u00e7in en yayg\u0131n ve g\u00fc\u00e7l\u00fc protokold\u00fcr. Ancak, varsay\u0131lan olarak yaln\u0131zca kullan\u0131c\u0131 ad\u0131 ve \u015fifreye dayan\u0131r. Bu, a\u015fa\u011f\u0131daki riskleri beraberinde getirir:<\/p>\n

* Kaba Kuvvet Sald\u0131r\u0131lar\u0131:<\/strong> Sald\u0131rganlar, yayg\u0131n \u015fifreleri veya otomatik ara\u00e7lar\u0131 kullanarak tekrar tekrar giri\u015f yapmaya \u00e7al\u0131\u015fabilir.
\n* Kimlik Bilgisi H\u0131rs\u0131zl\u0131\u011f\u0131:<\/strong> Phishing veya di\u011fer y\u00f6ntemlerle ele ge\u00e7irilen \u015fifreler, yetkisiz eri\u015fime yol a\u00e7abilir.
\n* Zay\u0131f \u015eifreler:<\/strong> Kullan\u0131c\u0131lar\u0131n tahmin edilmesi kolay veya tekrar kullan\u0131lan \u015fifreler se\u00e7mesi, g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 art\u0131r\u0131r.
\n* \u0130\u00e7 Tehditler:<\/strong> Yetkilendirilmi\u015f ancak k\u00f6t\u00fc niyetli bir kullan\u0131c\u0131n\u0131n eri\u015fimini kontrol etmek zorla\u015f\u0131r.<\/p>\n

MFA, bu riskleri azaltmak i\u00e7in ikinci bir do\u011frulama katman\u0131 ekler. Bu, genellikle kullan\u0131c\u0131n\u0131n bildi\u011fi bir \u015fey (\u015fifre), sahip oldu\u011fu bir \u015fey (cep telefonu veya donan\u0131m token’\u0131) ve oldu\u011fu bir \u015fey (biyometrik) kombinasyonunu i\u00e7erir. SSH ba\u011flam\u0131nda, genellikle \u015fifreye ek olarak, zaman tabanl\u0131 tek kullan\u0131ml\u0131k \u015fifre (TOTP) \u00fcreten bir uygulama (Google Authenticator, Authy vb.) kullan\u0131l\u0131r.<\/p>\n

Gereksinimler<\/h3>\n

Bu k\u0131lavuzu takip etmek i\u00e7in a\u015fa\u011f\u0131daki gereksinimlere sahip olman\u0131z gerekir:<\/p>\n

* Ubuntu 16.04 LTS y\u00fckl\u00fc bir sunucu.
\n* Sunucuya SSH eri\u015fimi olan bir kullan\u0131c\u0131 hesab\u0131.
\n* Root veya sudo ayr\u0131cal\u0131klar\u0131 olan bir kullan\u0131c\u0131.
\n* Ak\u0131ll\u0131 telefonunuzda y\u00fckl\u00fc bir TOTP uygulamas\u0131 (Google Authenticator, Authy, FreeOTP vb.).
\n* \u0130nternet ba\u011flant\u0131s\u0131 (paket kurulumlar\u0131 i\u00e7in).<\/p>\n

Ad\u0131m 1: Gerekli Paketleri Kurma<\/h3>\n

\u0130lk ad\u0131m, SSH’nin PAM (Pluggable Authentication Modules) ile entegrasyonunu sa\u011flayacak ve Google Authenticator deste\u011fini ekleyecek gerekli paketleri kurmakt\u0131r.<\/p>\n

1. Paket Listesini G\u00fcncelleyin:<\/strong><\/p>\n

sudo apt update<\/code><\/pre>\n
2.  libpam-google-authenticator<\/code> Paketini Kurun:<\/strong>
\n    Bu paket, PAM mod\u00fcl\u00fcn\u00fc ve Google Authenticator uygulamas\u0131n\u0131 yap\u0131land\u0131rmak i\u00e7in gerekli ara\u00e7lar\u0131 sa\u011flar.<\/p>\n
sudo apt install libpam-google-authenticator<\/code><\/pre>\n
Ad\u0131m 2: Kullan\u0131c\u0131 Baz\u0131nda Google Authenticator’\u0131 Yap\u0131land\u0131rma<\/h3>\n
MFA’y\u0131 etkinle\u015ftirmek i\u00e7in, her bir kullan\u0131c\u0131 i\u00e7in Google Authenticator’\u0131 ayr\u0131 ayr\u0131 yap\u0131land\u0131rman\u0131z gerekir. Bu, kullan\u0131c\u0131n\u0131n kendi kimlik bilgileriyle etkile\u015fimde bulunmas\u0131n\u0131 sa\u011flar.<\/p>\n
1.  MFA’y\u0131 Yap\u0131land\u0131rmak \u0130stedi\u011finiz Kullan\u0131c\u0131 Olarak Oturum A\u00e7\u0131n:<\/strong>
\n    E\u011fer root olarak ba\u011flan\u0131yorsan\u0131z, MFA’y\u0131 etkinle\u015ftirmek istedi\u011finiz kullan\u0131c\u0131ya ge\u00e7i\u015f yap\u0131n.<\/p>\n
sudo su - <kullan\u0131c\u0131_ad\u0131><\/code><\/pre>\n
    <\/code> yerine ilgili kullan\u0131c\u0131 ad\u0131n\u0131 yaz\u0131n.<\/p>\n
2.  Google Authenticator’\u0131 Ba\u015flat\u0131n:<\/strong>
\n    Kullan\u0131c\u0131n\u0131n ev dizininde a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
google-authenticator<\/code><\/pre>\n
    Bu komut sizi bir dizi soruyla kar\u015f\u0131layacakt\u0131r. Her soruyu dikkatlice okuyun ve a\u015fa\u011f\u0131daki \u00f6nerilere g\u00f6re yan\u0131tlay\u0131n:<\/p>\n
    *   “Do you want authentication tokens to be time-based (y\/n)”<\/strong>: y<\/code> yazarak zaman tabanl\u0131 kimlik do\u011frulama (TOTP) istedi\u011finizi belirtin. Bu, Google Authenticator gibi uygulamalar\u0131n kulland\u0131\u011f\u0131 standart y\u00f6ntemdir.<\/p>\n
    *   QR Kodu G\u00f6r\u00fcnt\u00fcleme:<\/strong> Komut, size bir QR kodu g\u00f6sterecektir. Bu QR kodunu ak\u0131ll\u0131 telefonunuzdaki Google Authenticator (veya se\u00e7ti\u011finiz ba\u015fka bir TOTP uygulamas\u0131) ile taraman\u0131z gerekmektedir. QR kodu tarama i\u015flemi, kimlik do\u011frulama uygulaman\u0131z\u0131n sunucunuzla senkronize olmas\u0131n\u0131 sa\u011flar.<\/p>\n
    *   “Your new secret key is: [G\u0130ZL\u0130 ANAHTAR]”<\/strong>: Bu gizli anahtar, QR kodunun temsil etti\u011fi de\u011ferdir. Bu anahtar\u0131 g\u00fcvenli bir yerde saklaman\u0131z \u00f6nemlidir. E\u011fer QR kodunu tarayamazsan\u0131z, bu anahtar\u0131 manuel olarak TOTP uygulaman\u0131za ekleyebilirsiniz.<\/p>\n
    *   “Your verification code is [KOD] \/ “Your emergency scratch codes are:”<\/strong>: Komut size bir dizi kurtarma (scratch) kodu verecektir. Bu kodlar, TOTP uygulaman\u0131z\u0131n kaybolmas\u0131, silinmesi veya telefonunuzun \u00e7al\u0131nmas\u0131 gibi durumlarda SSH’ye eri\u015fiminizi sa\u011flamak i\u00e7in kullan\u0131l\u0131r. Bu kodlar\u0131 kesinlikle g\u00fcvenli ve eri\u015filebilir bir yerde (\u00f6rne\u011fin, bir \u015fifre y\u00f6neticisinde veya bas\u0131l\u0131 olarak g\u00fcvenli bir ortamda) saklay\u0131n. Her kod yaln\u0131zca bir kez kullan\u0131labilir.<\/p>\n
    *   “Do you want me to update your “\/home\/\/.google_authenticator” file? (y\/n)”<\/strong>: y<\/code> yazarak devam edin. Bu, gizli anahtar\u0131n\u0131z\u0131 ve yap\u0131land\u0131rma ayarlar\u0131n\u0131z\u0131 bu dosyaya kaydeder.<\/p>\n
    *   “Do you want to disallow multiple uses of the same authentication token?…”<\/strong>: y<\/code> yazarak devam edin. Bu, ayn\u0131 do\u011frulama kodunun birden fazla kez kullan\u0131lmas\u0131n\u0131 engelleyerek g\u00fcvenli\u011fi art\u0131r\u0131r.<\/p>\n
    *   “By default, tokens are good for 30 seconds… Do you want to enable rate-limiting?…”<\/strong>: y<\/code> yazarak devam edin. Bu, sald\u0131rganlar\u0131n ayn\u0131 kodu tekrar tekrar denemesini zorla\u015ft\u0131r\u0131r.<\/p>\n
    *   “By default, an accepted token is any token within a 30-second window… Do you want to enable time skew?…”<\/strong>: y<\/code> yazarak devam edin. Bu, sunucu ve telefon saati aras\u0131ndaki k\u00fc\u00e7\u00fck farkl\u0131l\u0131klar\u0131 tolere eder.<\/p>\n
    Bu ad\u0131mlardan sonra, <\/code> kullan\u0131c\u0131s\u0131 i\u00e7in Google Authenticator yap\u0131land\u0131rmas\u0131 tamamlanm\u0131\u015f olur. Di\u011fer kullan\u0131c\u0131lar i\u00e7in de ayn\u0131 ad\u0131mlar\u0131 tekrarlay\u0131n.<\/p>\n
Ad\u0131m 3: SSH Yap\u0131land\u0131rmas\u0131n\u0131 De\u011fi\u015ftirme<\/h3>\n
\u015eimdi, SSH’nin PAM arac\u0131l\u0131\u011f\u0131yla Google Authenticator’\u0131 kullanmas\u0131n\u0131 sa\u011flamak i\u00e7in SSH sunucu yap\u0131land\u0131rmas\u0131n\u0131 de\u011fi\u015ftirmemiz gerekiyor.<\/p>\n
1.  SSH Yap\u0131land\u0131rma Dosyas\u0131n\u0131 D\u00fczenleyin:<\/strong>
\n    SSH sunucu yap\u0131land\u0131rma dosyas\u0131n\u0131 root veya sudo ayr\u0131cal\u0131klar\u0131yla a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/ssh\/sshd_config<\/code><\/pre>\n
2.  A\u015fa\u011f\u0131daki Sat\u0131rlar\u0131 Bulun veya Ekleyin ve D\u00fczenleyin:<\/strong>
\n    Dosya i\u00e7inde a\u015fa\u011f\u0131daki sat\u0131rlar\u0131 bulun ve gerekti\u011finde a\u015fa\u011f\u0131daki gibi d\u00fczenleyin. E\u011fer yoksa, dosyan\u0131n sonuna ekleyebilirsiniz:<\/p>\n
    *   ChallengeResponseAuthentication yes<\/code><\/strong>: Bu sat\u0131r, SSH’nin PAM taraf\u0131ndan sa\u011flanan zorunlu yan\u0131t kimlik do\u011frulamas\u0131n\u0131 (challenge-response authentication) etkinle\u015ftirmesini sa\u011flar. Google Authenticator bu mekanizmay\u0131 kullan\u0131r. E\u011fer bu sat\u0131r varsa ve de\u011feri no<\/code> ise yes<\/code> olarak de\u011fi\u015ftirin. E\u011fer yoksa, ekleyin.<\/p>\n
    *   UsePAM yes<\/code><\/strong>: Bu sat\u0131r\u0131n yes<\/code> olarak ayarland\u0131\u011f\u0131ndan emin olun. Bu, SSH’nin kimlik do\u011frulama i\u00e7in PAM’\u0131 kullanmas\u0131n\u0131 sa\u011flar. Genellikle varsay\u0131lan olarak etkindir.<\/p>\n
    *   AuthenticationMethods publickey,password,keyboard-interactive<\/code><\/strong> (veya benzeri) gibi bir sat\u0131r varsa, bu sat\u0131r\u0131 d\u00fczenlemeniz gerekebilir. Baz\u0131 durumlarda, keyboard-interactive<\/code> y\u00f6ntemi Google Authenticator’\u0131 tetikler. Ancak, daha g\u00fcvenli bir yakla\u015f\u0131m, PasswordAuthentication no<\/code> ve PubkeyAuthentication yes<\/code> ile birlikte MFA’y\u0131 zorlamakt\u0131r. E\u011fer yaln\u0131zca \u015fifre ile giri\u015f yap\u0131yorsan\u0131z ve MFA ekliyorsan\u0131z, PasswordAuthentication yes<\/code> olmal\u0131d\u0131r.<\/p>\n
    \u00d6nemli Not:<\/strong> E\u011fer SSH anahtar\u0131 tabanl\u0131 kimlik do\u011frulamay\u0131 (publickey authentication) kullan\u0131yorsan\u0131z ve MFA’y\u0131 bu y\u00f6ntemle birlikte kullanmak istiyorsan\u0131z, yap\u0131land\u0131rma biraz daha karma\u015f\u0131k hale gelir. Bu makale, \u00f6ncelikle \u015fifre tabanl\u0131 kimlik do\u011frulama \u00fczerine MFA eklemeyi odaklamaktad\u0131r. Anahtar tabanl\u0131 kimlik do\u011frulama ile MFA’y\u0131 birle\u015ftirmek i\u00e7in, AuthenticationMethods<\/code> sat\u0131r\u0131n\u0131 publickey,keyboard-interactive<\/code> \u015feklinde ayarlaman\u0131z gerekebilir.<\/p>\n
    *   G\u00fcvenlik \u0130pu\u00e7lar\u0131:<\/strong>
\n        *   PasswordAuthentication no<\/code><\/strong>: E\u011fer SSH anahtar tabanl\u0131 kimlik do\u011frulamay\u0131 zaten kullan\u0131yorsan\u0131z ve MFA’y\u0131 anahtarlarla birlikte kullanmak istiyorsan\u0131z, \u015fifre tabanl\u0131 kimlik do\u011frulamay\u0131 kapatmak g\u00fcvenli\u011fi art\u0131r\u0131r. Ancak, bu k\u0131lavuzun odak noktas\u0131 \u015fifre + MFA oldu\u011fundan, bu ayar\u0131 \u015fimdilik yes<\/code> olarak b\u0131rakman\u0131z gerekebilir.
\n        *   PermitRootLogin no<\/code><\/strong>: Root hesab\u0131na do\u011frudan SSH eri\u015fimini kapatmak en iyi g\u00fcvenlik uygulamalar\u0131ndan biridir.
\n        *   AllowUsers <\/code><\/strong>: Yaln\u0131zca belirli kullan\u0131c\u0131lar\u0131n SSH ile giri\u015f yapmas\u0131na izin vermek i\u00e7in bu se\u00e7ene\u011fi kullanabilirsiniz.<\/p>\n
    De\u011fi\u015fiklikleri yapt\u0131ktan sonra dosyay\u0131 kaydedin ve kapat\u0131n (nano’da Ctrl+X<\/code>, Y<\/code>, Enter<\/code>).<\/p>\n
3.  SSH Servisini Yeniden Ba\u015flat\u0131n:<\/strong>
\n    Yap\u0131land\u0131rma de\u011fi\u015fikliklerinin etkili olmas\u0131 i\u00e7in SSH servisini yeniden ba\u015flatman\u0131z gerekir:<\/p>\n
sudo systemctl restart ssh<\/code><\/pre>\n
Ad\u0131m 4: PAM Yap\u0131land\u0131rmas\u0131n\u0131 De\u011fi\u015ftirme<\/h3>\n
\u015eimdi, SSH’nin kimlik do\u011frulama i\u015flemi s\u0131ras\u0131nda Google Authenticator PAM mod\u00fcl\u00fcn\u00fc kullanmas\u0131n\u0131 sa\u011flamak i\u00e7in PAM yap\u0131land\u0131rmas\u0131n\u0131 ayarlamam\u0131z gerekiyor.<\/p>\n
1.  SSH PAM Dosyas\u0131n\u0131 D\u00fczenleyin:<\/strong>
\n    SSH i\u00e7in PAM yap\u0131land\u0131rma dosyas\u0131n\u0131 root veya sudo ayr\u0131cal\u0131klar\u0131yla a\u00e7\u0131n:<\/p>\n
sudo nano \/etc\/pam.d\/sshd<\/code><\/pre>\n
2.  A\u015fa\u011f\u0131daki Sat\u0131r\u0131 Dosyan\u0131n Ba\u015f\u0131na Ekleyin:<\/strong>
\n    Dosyan\u0131n en \u00fcst\u00fcne a\u015fa\u011f\u0131daki sat\u0131r\u0131 ekleyin. Bu sat\u0131r, kimlik do\u011frulama i\u015fleminin ba\u015f\u0131nda Google Authenticator’\u0131 kontrol etmesini sa\u011flar.<\/p>\n
auth required pam_google_authenticator.so<\/code><\/pre>\n
    A\u00e7\u0131klama:<\/strong>
\n    *   auth<\/code>: Bu bir kimlik do\u011frulama mod\u00fcl\u00fcd\u00fcr.
\n    *   required<\/code>: Bu mod\u00fcl\u00fcn ba\u015far\u0131l\u0131 olmas\u0131 gerekmektedir. E\u011fer ba\u015far\u0131s\u0131z olursa, kullan\u0131c\u0131 yine de giri\u015f yapabilir ancak di\u011fer mod\u00fcllerin sonu\u00e7lar\u0131 dikkate al\u0131n\u0131r. Ancak, SSH ba\u011flam\u0131nda required<\/code> genellikle MFA’n\u0131n zorunlu k\u0131l\u0131nmas\u0131n\u0131 sa\u011flar.
\n    *   pam_google_authenticator.so<\/code>: Kullan\u0131lacak PAM mod\u00fcl\u00fcn\u00fcn ad\u0131d\u0131r.<\/p>\n
    Alternatif Yakla\u015f\u0131mlar (Daha Geli\u015fmi\u015f):<\/strong>
\n    *   E\u011fer MFA’y\u0131 yaln\u0131zca belirli ko\u015fullar alt\u0131nda zorunlu k\u0131lmak istiyorsan\u0131z (\u00f6rne\u011fin, yaln\u0131zca \u015fifre tabanl\u0131 kimlik do\u011frulamas\u0131 yap\u0131l\u0131yorsa), sufficient<\/code> veya optional<\/code> gibi farkl\u0131 kontrol tiplerini kullanabilirsiniz. Ancak, required<\/code> en g\u00fcvenli ve yayg\u0131n kullan\u0131lan se\u00e7enektir.
\n    *   Baz\u0131 sistemlerde, auth<\/code> yerine auth required<\/code> ile ba\u015flayan sat\u0131rlar\u0131n yan\u0131na nullok<\/code> eklenebilir. Bu, kullan\u0131c\u0131n\u0131n .google_authenticator<\/code> dosyas\u0131n\u0131n olmamas\u0131 durumunda MFA’n\u0131n atlanmas\u0131na izin verir. Ancak, bu g\u00fcvenlik a\u00e7\u0131s\u0131ndan \u00f6nerilmez. Bu makale, t\u00fcm kullan\u0131c\u0131lar i\u00e7in MFA’y\u0131 zorunlu k\u0131lmay\u0131 hedefler.<\/p>\n
3.  Dosyay\u0131 Kaydedin ve Kapat\u0131n:<\/strong>
\n    Nano’da Ctrl+X<\/code>, Y<\/code>, Enter<\/code> tu\u015flar\u0131na basarak de\u011fi\u015fiklikleri kaydedin.<\/p>\n
Ad\u0131m 5: Test Etme<\/h3>\n
Art\u0131k MFA’n\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 test etme zaman\u0131 geldi.<\/p>\n
1.  Mevcut SSH Oturumunuzu Kapat\u0131n:<\/strong>
\n    E\u011fer hala sunucuda SSH oturumundaysan\u0131z, kapat\u0131n.<\/p>\n
2.  Yeni Bir SSH Ba\u011flant\u0131s\u0131 Kurun:<\/strong>
\n    MFA’y\u0131 yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131z kullan\u0131c\u0131 ile sunucunuza tekrar SSH ile ba\u011flanmay\u0131 deneyin:<\/p>\n
ssh <kullan\u0131c\u0131_ad\u0131>@<sunucu_ip_adresi><\/code><\/pre>\n
3.  Kimlik Do\u011frulama \u0130steklerini G\u00f6zlemleyin:<\/strong>
\n    *   \u00d6nce her zamanki gibi \u015fifrenizi girmeniz istenecektir.
\n    *   \u015eifrenizi do\u011fru girdikten sonra, SSH istemciniz sizden “Verification code:” veya benzeri bir \u015fey isteyecektir.
\n    *   Bu noktada, ak\u0131ll\u0131 telefonunuzdaki Google Authenticator uygulamas\u0131nda g\u00f6r\u00fcnen g\u00fcncel 6 haneli kodu girin.<\/p>\n
    E\u011fer her \u015fey do\u011fru yap\u0131land\u0131r\u0131ld\u0131ysa, MFA kodunu do\u011fru girdi\u011finizde sunucuya ba\u015far\u0131yla giri\u015f yapman\u0131z gerekir.<\/p>\n
Sorun Giderme Senaryolar\u0131:<\/strong><\/p>\n
*   “Permission denied (publickey,password).” Hatas\u0131:<\/strong> Bu genellikle sshd_config<\/code> dosyas\u0131ndaki ChallengeResponseAuthentication yes<\/code> veya UsePAM yes<\/code> ayarlar\u0131ndan birinin eksik veya yanl\u0131\u015f olmas\u0131ndan kaynaklan\u0131r.
\n*   “Access denied” veya Ba\u015fka Bir Hata:<\/strong> PAM yap\u0131land\u0131rmas\u0131ndaki (\/etc\/pam.d\/sshd<\/code>) auth required pam_google_authenticator.so<\/code> sat\u0131r\u0131n\u0131n eksik veya yanl\u0131\u015f eklenmi\u015f olmas\u0131 muhtemeldir. Ayr\u0131ca, google-authenticator<\/code> komutunun her kullan\u0131c\u0131 i\u00e7in do\u011fru \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131\u011f\u0131ndan emin olun.
\n*   QR Kodu Taranam\u0131yor:<\/strong> QR kodunu taramak yerine, google-authenticator<\/code> komutunun g\u00f6sterdi\u011fi gizli anahtar\u0131 (secret key) manuel olarak TOTP uygulaman\u0131za ekleyebilirsiniz.
\n*   Telefon Saati Senkronizasyonu:<\/strong> TOTP uygulamalar\u0131n\u0131n do\u011fru \u00e7al\u0131\u015fmas\u0131 i\u00e7in telefonunuzun saatinin do\u011fru ve otomatik olarak senkronize edilmi\u015f olmas\u0131 \u00e7ok \u00f6nemlidir. Saatte birka\u00e7 dakikal\u0131k sapma bile kimlik do\u011frulama hatalar\u0131na yol a\u00e7abilir.
\n*   Kurtarma Kodlar\u0131:<\/strong> E\u011fer telefonunuzu kaybeder veya TOTP uygulaman\u0131z\u0131 silemezseniz, google-authenticator<\/code> komutunun ilk kurulumda verdi\u011fi kurtarma kodlar\u0131n\u0131 kullanarak sunucuya giri\u015f yapabilirsiniz. Bu kodlar\u0131 kaybetmemeniz kritik \u00f6neme sahiptir.
\n*   ~\/.google_authenticator<\/code> Dosyas\u0131:<\/strong> Her kullan\u0131c\u0131n\u0131n ev dizininde (\/home\/\/.google_authenticator<\/code>) bu dosyan\u0131n bulunmas\u0131 ve do\u011fru izinlere sahip olmas\u0131 gerekir.<\/p>\n
SSH Anahtar Tabanl\u0131 Kimlik Do\u011frulama ile MFA<\/h3>\n
E\u011fer SSH anahtar tabanl\u0131 kimlik do\u011frulamay\u0131 kullan\u0131yorsan\u0131z ve MFA’y\u0131 bu y\u00f6ntemle birle\u015ftirmek istiyorsan\u0131z, sshd_config<\/code> dosyas\u0131ndaki AuthenticationMethods<\/code> ayar\u0131n\u0131 a\u015fa\u011f\u0131daki gibi yapman\u0131z \u00f6nerilir:<\/p>\n
AuthenticationMethods publickey,keyboard-interactive<\/code><\/pre>\n
Bu ayar, \u00f6nce SSH anahtar\u0131n\u0131n do\u011frulanmas\u0131n\u0131, ard\u0131ndan ikinci bir do\u011frulama katman\u0131 olarak Google Authenticator (keyboard-interactive) do\u011frulamas\u0131n\u0131 gerektirir. PasswordAuthentication no<\/code> olarak ayarlanm\u0131\u015fsa, \u015fifre giri\u015fi istenmeyecektir.<\/p>\n
Ancak, bu yap\u0131land\u0131rmay\u0131 yaparken dikkatli olunmal\u0131d\u0131r. Yanl\u0131\u015f bir AuthenticationMethods<\/code> ayar\u0131, sunucuya eri\u015fiminizi tamamen kaybetmenize neden olabilir. Bu nedenle, de\u011fi\u015fiklikleri yapmadan \u00f6nce mutlaka bir konsol eri\u015fiminiz oldu\u011fundan emin olun veya dikkatli bir \u015fekilde test edin.<\/p>\n
Sonu\u00e7<\/h3>\n
Ubuntu 16.04 sunucular\u0131n\u0131zda SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 (MFA) kurmak, sunucular\u0131n\u0131z\u0131n g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r. Google Authenticator gibi TOTP tabanl\u0131 \u00e7\u00f6z\u00fcmler, standart \u015fifrelerin \u00f6tesinde ek bir g\u00fcvenlik katman\u0131 sa\u011flayarak yetkisiz eri\u015fim riskini azalt\u0131r. Bu makalede a\u00e7\u0131klanan ad\u0131mlar\u0131 takip ederek, sunucular\u0131n\u0131za eri\u015fimi daha g\u00fcvenli hale getirebilirsiniz. Unutmay\u0131n ki, g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve d\u00fczenli olarak g\u00f6zden ge\u00e7irilmesi ve g\u00fcncellenmesi \u00f6nemlidir. Kurtarma kodlar\u0131n\u0131z\u0131 g\u00fcvenli bir \u015fekilde saklamay\u0131 ve telefonunuzun saatini senkronize tutmay\u0131 ihmal etmeyin.<\/p>\n","protected":false},"excerpt":{"rendered":"Ubuntu 16. 04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma Sunucular\u0131n\u0131za SSH \u00fczerinden eri\u015fimin g\u00fcvenli\u011fini art\u0131rmak, g\u00fcn\u00fcm\u00fcz\u00fcn siber tehdit ortam\u0131nda kritik \u00f6neme sahiptir.","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1468],"tags":[],"class_list":{"0":"post-43345","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-ubuntu","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nUbuntu 16.04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ubuntu 16.04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma\" \/>\n<meta property=\"og:description\" content=\"Ubuntu 16. 04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma Sunucular\u0131n\u0131za SSH \u00fczerinden eri\u015fimin g\u00fcvenli\u011fini art\u0131rmak, g\u00fcn\u00fcm\u00fcz\u00fcn siber tehdit ortam\u0131nda kritik \u00f6neme sahiptir.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-15T05:00:38+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Ubuntu 16.04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma\",\"datePublished\":\"2026-07-15T05:00:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\"},\"wordCount\":2146,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Ubuntu\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\",\"name\":\"Ubuntu 16.04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-07-15T05:00:38+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ubuntu 16.04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Ubuntu 16.04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/","og_locale":"tr_TR","og_type":"article","og_title":"Ubuntu 16.04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma","og_description":"Ubuntu 16. 04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma Sunucular\u0131n\u0131za SSH \u00fczerinden eri\u015fimin g\u00fcvenli\u011fini art\u0131rmak, g\u00fcn\u00fcm\u00fcz\u00fcn siber tehdit ortam\u0131nda kritik \u00f6neme sahiptir.","og_url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-07-15T05:00:38+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"11 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Ubuntu 16.04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma","datePublished":"2026-07-15T05:00:38+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/"},"wordCount":2146,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Ubuntu"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/","url":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/","name":"Ubuntu 16.04'te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-07-15T05:00:38+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/ubuntu-16-04te-ssh-icin-cok-faktorlu-kimlik-dogrulamayi-kurma\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Ubuntu 16.04’te SSH i\u00e7in \u00c7ok Fakt\u00f6rl\u00fc Kimlik Do\u011frulamay\u0131 Kurma"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=43345"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43345\/revisions"}],"predecessor-version":[{"id":43346,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/43345\/revisions\/43346"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=43345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=43345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=43345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}