sudo yum install epel-release\nsudo yum install fail2ban\n<\/code><\/pre>\n\n\n\nKurulumdan sonra servis ba\u015flat\u0131l\u0131r ve sistem a\u00e7\u0131l\u0131\u015f\u0131nda otomatik olarak ba\u015flamas\u0131 sa\u011flan\u0131r:<\/p>\n\n\n\n
sudo systemctl enable fail2ban\nsudo systemctl start fail2ban\n<\/code><\/pre>\n\n\n\n<\/span>Fail2Ban Yap\u0131land\u0131rmas\u0131<\/span><\/h2>\n\n\n\nFail2Ban yap\u0131land\u0131rma dosyalar\u0131 genellikle \/etc\/fail2ban\/<\/code> dizininde yer al\u0131r. Ana yap\u0131land\u0131rma dosyas\u0131 jail.conf<\/code> olup, bu dosya do\u011frudan d\u00fczenlenmemelidir. Bunun yerine jail.local<\/code> ad\u0131nda bir kopya olu\u015fturulup \u00fczerinde \u00f6zelle\u015ftirme yap\u0131lmas\u0131 \u00f6nerilir.<\/p>\n\n\n\n\u00d6rnek jail.local<\/code> yap\u0131land\u0131rmas\u0131:<\/p>\n\n\n\n[sshd]\nenabled = true\nport = ssh\nfilter = sshd\nlogpath = \/var\/log\/auth.log\nmaxretry = 5\nbantime = 3600\nfindtime = 600\n<\/code><\/pre>\n\n\n\nBu \u00f6rnekte, SSH servisi \u00fczerinden 10 dakika i\u00e7inde 5’ten fazla ba\u015far\u0131s\u0131z giri\u015fim yapan IP adresi 1 saatli\u011fine engellenecektir.<\/p>\n\n\n\n
<\/span>S\u0131k Kullan\u0131lan Fail2Ban Komutlar\u0131<\/span><\/h2>\n\n\n\n\n- Fail2Ban servis durumu:
sudo systemctl status fail2ban<\/code><\/li>\n\n\n\n- Aktif jails listesini g\u00f6r\u00fcnt\u00fcleme:
sudo fail2ban-client status<\/code><\/li>\n\n\n\n- Belirli bir jail durumu:
sudo fail2ban-client status sshd<\/code><\/li>\n\n\n\n- IP adresini manuel olarak banlama:
sudo fail2ban-client set sshd banip 192.168.1.100<\/code><\/li>\n\n\n\n- IP adresini unban yapma:
sudo fail2ban-client set sshd unbanip 192.168.1.100<\/code><\/li>\n<\/ul>\n\n\n\n<\/span>Fail2Ban ile Hangi Servisler Korunabilir?<\/span><\/h2>\n\n\n\nFail2Ban, yap\u0131land\u0131r\u0131labilir filtre sistemi sayesinde pek \u00e7ok servisi koruyabilir:<\/p>\n\n\n\n
\n- SSH<\/li>\n\n\n\n
- FTP (vsftpd, proftpd)<\/li>\n\n\n\n
- Web sunucular\u0131 (Apache, NGINX)<\/li>\n\n\n\n
- Mail sunucular\u0131 (Postfix, Dovecot)<\/li>\n\n\n\n
- PHP, MySQL gibi uygulama loglar\u0131na \u00f6zel filtrelerle geni\u015fletme<\/li>\n<\/ul>\n\n\n\n
<\/span>Brute Force Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Fail2Ban\u2019\u0131n Avantajlar\u0131<\/span><\/h2>\n\n\n\n\n- Ger\u00e7ek zamanl\u0131 izleme ile sald\u0131r\u0131lar\u0131 an\u0131nda engelleme<\/li>\n\n\n\n
- Otomatik IP ban sistemi sayesinde y\u00f6neticinin manuel m\u00fcdahalesine gerek b\u0131rakmamas\u0131<\/li>\n\n\n\n
- Esnek filtreleme ve jail yap\u0131land\u0131rmas\u0131 ile \u00e7ok say\u0131da hizmet i\u00e7in \u00f6zelle\u015ftirilebilir koruma<\/li>\n\n\n\n
- Firewall seviyesinde engelleme ile etkili sonu\u00e7lar \u00fcretme<\/li>\n<\/ul>\n\n\n\n
<\/span>G\u00fcvenli\u011fi Art\u0131rmak \u0130\u00e7in Ekstra \u00d6nlemler<\/span><\/h2>\n\n\n\nFail2Ban tek ba\u015f\u0131na g\u00fc\u00e7l\u00fc bir \u00e7\u00f6z\u00fcmd\u00fcr ancak sistem g\u00fcvenli\u011fini art\u0131rmak i\u00e7in a\u015fa\u011f\u0131daki ad\u0131mlar da \u00f6nerilir:<\/p>\n\n\n\n
\n- SSH ba\u011flant\u0131lar\u0131n\u0131 yaln\u0131zca belirli IP adreslerine a\u00e7\u0131k hale getirmek<\/li>\n\n\n\n
- SSH portunu de\u011fi\u015ftirmek (varsay\u0131lan 22 yerine farkl\u0131 bir port)<\/li>\n\n\n\n
- Karma\u015f\u0131k ve uzun parolalar kullanmak<\/li>\n\n\n\n
- SSH anahtar tabanl\u0131 kimlik do\u011frulama kullanmak<\/li>\n\n\n\n
- Fail2Ban bantime s\u00fcresini art\u0131rmak<\/li>\n<\/ul>\n\n\n\n