{"id":26,"date":"2026-10-23T08:14:55","date_gmt":"2026-10-23T08:14:55","guid":{"rendered":"https:\/\/adnancanturk.com\/blog\/paylasimli-linux-sunucu-cekirdek-sikilastirma-bes-ayar\/"},"modified":"2026-10-23T09:50:34","modified_gmt":"2026-10-23T09:50:34","slug":"paylasimli-linux-sunucu-cekirdek-sikilastirma-bes-ayar","status":"publish","type":"post","link":"https:\/\/adnancanturk.com\/blog\/paylasimli-linux-sunucu-cekirdek-sikilastirma-bes-ayar\/","title":{"rendered":"Yama beklerken payla\u015f\u0131ml\u0131 bir Linux sunucusunu s\u0131k\u0131la\u015ft\u0131ran be\u015f \u00e7ekirdek ayar\u0131"},"content":{"rendered":"<p class=\"lead\">Payla\u015f\u0131ml\u0131 bir bar\u0131nd\u0131rma sunucusunda her m\u00fc\u015fteri ayn\u0131 \u00e7ekirdek \u00fczerinde kod \u00e7al\u0131\u015ft\u0131r\u0131r. Bu y\u00fczden yerel bir yetki y\u00fckseltme hatas\u0131, ele ge\u00e7irilen herhangi bir web sitesini olas\u0131 bir root ele ge\u00e7irmesine d\u00f6n\u00fc\u015ft\u00fcr\u00fcr; Ekim 2026&#8217;n\u0131n sonunda da d\u00fczeltmeleri haz\u0131r olmayan birka\u00e7 \u00e7ekirdek hata raporu kamuya a\u00e7\u0131ld\u0131. As\u0131l \u00e7\u00f6z\u00fcm yamalar ve canl\u0131 yamalard\u0131r, ama bunlar g\u00fcnler s\u00fcrer. Aradaki s\u00fcre boyunca sunucuyu koruyan \u015fey yap\u0131land\u0131rmad\u0131r ve bunun \u00e7o\u011fu zaten kal\u0131c\u0131 olarak yerinde olmal\u0131d\u0131r.<\/p>\n<div class=\"tldr\">\n<p class=\"tldr-label\">TL;DR<\/p>\n<ul>\n<li>Be\u015f ayar, payla\u015f\u0131ml\u0131 bir sunucuda \u00e7ekirde\u011fin sald\u0131r\u0131 y\u00fczeyini daralt\u0131r: <code>user.max_user_namespaces = 0<\/code>, <code>ptrace_scope = 1<\/code>, <code>dmesg_restrict = 1<\/code>, <code>kptr_restrict = 2<\/code> ve <code>unprivileged_bpf_disabled = 1<\/code>.<\/li>\n<li>Bunlar\u0131 <code>\/etc\/sysctl.d\/99-fleet-hardening.conf<\/code> dosyas\u0131na yaz\u0131n; b\u00f6ylece CloudLinux&#8217;un varsay\u0131lanlar\u0131ndan sonra y\u00fcklenir ve yeniden ba\u015flatmadan sonra da kal\u0131rlar.<\/li>\n<li>\u00d6nce kontrol edin: mevcut de\u011ferleri kaydedin ve <code>lsns -t user<\/code> ile hi\u00e7bir m\u00fc\u015fterinin namespace kullanmad\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/li>\n<li>\u0130stisna konteyner sunucular\u0131d\u0131r, \u00e7\u00fcnk\u00fc rootless konteynerler user namespace&#8217;lere ihtiya\u00e7 duyar.<\/li>\n<li>Filomuzda on d\u00f6rt sunucunun dokuzunda namespace&#8217;ler a\u00e7\u0131kt\u0131, \u00e7\u00fcnk\u00fc de\u011fer yaln\u0131zca \u00e7al\u0131\u015fma an\u0131nda tan\u0131ml\u0131yd\u0131; bunlar\u0131 hizalamak hi\u00e7bir siteyi de\u011fi\u015ftirmedi.<\/li>\n<\/ul>\n<\/div>\n<h2>Be\u015f ayar<\/h2>\n<figure class=\"wp-block-image size-full gitm-figure\"><svg role=\"img\" aria-label=\"Tek bir sysctl dosyas\u0131nda be\u015f \u00e7ekirdek s\u0131k\u0131la\u015ft\u0131rma ayar\u0131\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 1600 730\"><rect width=\"1600\" height=\"730\" fill=\"#fff\"\/><text x=\"80\" y=\"80\" font-family=\"Arial, Helvetica, sans-serif\" font-size=\"40\" font-weight=\"700\" letter-spacing=\"-1.5\" fill=\"#171717\" text-anchor=\"start\">Be\u015f ayar, tek dosya<\/text><text x=\"80\" y=\"122\" font-family=\"Menlo, monospace\" font-size=\"18\" font-weight=\"400\" letter-spacing=\"2\" fill=\"#858585\" text-anchor=\"start\">90-CLOUDLINUX.CONF&#x27;TAN SONRA Y\u00dcKLEN\u0130R, YEN\u0130DEN BA\u015eLATMAYA DAYANIR<\/text><rect x=\"80\" y=\"170\" width=\"1440\" height=\"470\" fill=\"#f6f5f2\" stroke=\"#e8e5df\" stroke-width=\"2\"\/><text x=\"110\" y=\"215\" font-family=\"Menlo, monospace\" font-size=\"20\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#858585\" text-anchor=\"start\"># \/etc\/sysctl.d\/99-fleet-hardening.conf<\/text><text x=\"110\" y=\"290\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#f05a28\" text-anchor=\"start\">user.max_user_namespaces<\/text><text x=\"900\" y=\"290\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#f05a28\" text-anchor=\"start\">= 0<\/text><rect x=\"1080\" y=\"260\" width=\"380\" height=\"40\" fill=\"#f05a28\"\/><text x=\"1270\" y=\"287\" font-family=\"Menlo, monospace\" font-size=\"15\" font-weight=\"700\" letter-spacing=\"2\" fill=\"#fff\" text-anchor=\"middle\">\u0130\u015e\u0130N \u00c7O\u011eUNU YAPAR<\/text><text x=\"110\" y=\"364\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">kernel.yama.ptrace_scope<\/text><text x=\"900\" y=\"364\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">= 1<\/text><text x=\"110\" y=\"438\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">kernel.dmesg_restrict<\/text><text x=\"900\" y=\"438\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">= 1<\/text><text x=\"110\" y=\"512\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">kernel.kptr_restrict<\/text><text x=\"900\" y=\"512\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">= 2<\/text><text x=\"110\" y=\"586\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"400\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">kernel.unprivileged_bpf_disabled<\/text><text x=\"900\" y=\"586\" font-family=\"Menlo, monospace\" font-size=\"30\" font-weight=\"700\" letter-spacing=\"0\" fill=\"#171717\" text-anchor=\"start\">= 1<\/text><text x=\"80\" y=\"690\" font-family=\"Menlo, monospace\" font-size=\"18\" font-weight=\"400\" letter-spacing=\"1\" fill=\"#858585\" text-anchor=\"start\">DO\u011eRULAMA: sysctl --system, ard\u0131ndan unshare -Ur true ba\u015far\u0131s\u0131z olmal\u0131<\/text><\/svg><figcaption>Tek bir sysctl dosyas\u0131nda be\u015f \u00e7ekirdek s\u0131k\u0131la\u015ft\u0131rma ayar\u0131<\/figcaption><\/figure>\n<div class=\"table-wrap\">\n<table>\n<thead>\n<tr>\n<th>Ayar<\/th>\n<th>De\u011fer<\/th>\n<th>Ne yapar<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>user.max_user_namespaces<\/td>\n<td>0<\/td>\n<td>Yetkisiz kullan\u0131c\u0131lar\u0131n user namespace olu\u015fturmas\u0131n\u0131 engeller; b\u00f6ylece \u00e7ekirdek aray\u00fczlerinin b\u00fcy\u00fck bir k\u0131sm\u0131 onlar\u0131n eri\u015fiminden \u00e7\u0131kar<\/td>\n<\/tr>\n<tr>\n<td>kernel.yama.ptrace_scope<\/td>\n<td>1<\/td>\n<td>Bir s\u00fcreci yaln\u0131zca kendi \u00fcst s\u00fcreci izleyebilir; ele ge\u00e7irilen bir s\u00fcre\u00e7 ba\u015fka bir s\u00fcreci inceleyemez<\/td>\n<\/tr>\n<tr>\n<td>kernel.dmesg_restrict<\/td>\n<td>1<\/td>\n<td>\u00c7ekirdek g\u00fcnl\u00fc\u011f\u00fcn\u00fc yaln\u0131zca yetkili kullan\u0131c\u0131lar okuyabilir; bu g\u00fcnl\u00fck \u00e7o\u011fu zaman adres ve s\u00fcr\u00fcc\u00fc ayr\u0131nt\u0131lar\u0131 i\u00e7erir<\/td>\n<\/tr>\n<tr>\n<td>kernel.kptr_restrict<\/td>\n<td>2<\/td>\n<td>\u00c7ekirdek i\u015faret\u00e7ilerini <code>\/proc<\/code> ve g\u00fcnl\u00fcklerde herkesten gizler<\/td>\n<\/tr>\n<tr>\n<td>kernel.unprivileged_bpf_disabled<\/td>\n<td>1<\/td>\n<td>Yetkisiz eBPF programlar\u0131n\u0131 engeller; bu da \u00e7ekirdek hatalar\u0131 i\u00e7in s\u0131k kullan\u0131lan bir giri\u015f noktas\u0131d\u0131r<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>Y\u00fck\u00fcn \u00e7o\u011funu ilk ayar ta\u015f\u0131r. Son d\u00f6nemdeki \u00e7ekirdek yetki y\u00fckseltmelerinin bir\u00e7o\u011fu, s\u0131radan bir kullan\u0131c\u0131n\u0131n ancak kendi olu\u015fturdu\u011fu bir user namespace i\u00e7inde elde edebildi\u011fi yetkilere ihtiya\u00e7 duyar. S\u0131n\u0131r s\u0131f\u0131rken bu ad\u0131m ba\u015far\u0131s\u0131z olur ve hata, daha yamalanmadan bir bar\u0131nd\u0131rma m\u00fc\u015fterisinin ula\u015famayaca\u011f\u0131 hale gelir. Di\u011fer d\u00f6rt ayar, sald\u0131rgan\u0131n yol boyunca \u00f6\u011frenebileceklerini ve dokunabileceklerini azalt\u0131r.<\/p>\n<h2>Yeniden ba\u015flatmadan sonra da kal\u0131c\u0131 olsunlar<\/h2>\n<p><code>sysctl -w<\/code> ile verilen bir de\u011fer yaln\u0131zca bir sonraki a\u00e7\u0131l\u0131\u015fa kadar ya\u015far. Ayarlar\u0131, \u00fcreticinin varsay\u0131lanlar\u0131ndan sonra y\u00fcklenecek \u015fekilde adland\u0131r\u0131lm\u0131\u015f ayr\u0131 bir dosyaya yaz\u0131n. CloudLinux&#8217;ta \u00fcretici dosyas\u0131 <code>\/etc\/sysctl.d\/90-cloudlinux.conf<\/code> oldu\u011fu i\u00e7in <code>99-<\/code> \u00f6neki kazan\u0131r:<\/p>\n<pre><code># \/etc\/sysctl.d\/99-fleet-hardening.conf\nuser.max_user_namespaces = 0\nkernel.yama.ptrace_scope = 1\nkernel.dmesg_restrict = 1\nkernel.kptr_restrict = 2\nkernel.unprivileged_bpf_disabled = 1<\/code><\/pre>\n<p>Ayarlar\u0131 <code>sysctl --system<\/code> ile uygulay\u0131n ve her de\u011feri <code>sysctl user.max_user_namespaces<\/code> gibi komutlarla geri okuyun. Namespace s\u0131n\u0131r\u0131n\u0131 s\u0131radan bir kullan\u0131c\u0131 olarak do\u011frulamak i\u00e7in <code>unshare -Ur true<\/code> art\u0131k &#8220;No space left on device&#8221; hatas\u0131yla ba\u015far\u0131s\u0131z olmal\u0131.<\/p>\n<h2>Hi\u00e7 kullanmad\u0131\u011f\u0131n\u0131z \u00e7ekirdek mod\u00fcllerini kapat\u0131n<\/h2>\n<p>Y\u00fcklenebilir her mod\u00fcl, bir sald\u0131rgan\u0131n \u00e7ekirde\u011fe y\u00fckletmeye \u00e7al\u0131\u015fabilece\u011fi bir koddur. Payla\u015f\u0131ml\u0131 bir web sunucusu \u00e7ekirdek i\u00e7i SMB sunucusuna ya da eski a\u011f protokollerine nadiren ihtiya\u00e7 duyar; bunlar\u0131 <code>\/etc\/modprobe.d\/<\/code> alt\u0131nda engelleyin:<\/p>\n<pre><code># \/etc\/modprobe.d\/99-fleet-hardening.conf\ninstall ksmbd \/bin\/false\ninstall dccp \/bin\/false\ninstall sctp \/bin\/false\ninstall rds \/bin\/false\ninstall tipc \/bin\/false<\/code><\/pre>\n<p>\u00d6nce <code>lsmod<\/code> ile hi\u00e7birinin y\u00fckl\u00fc ya da gerekli olmad\u0131\u011f\u0131n\u0131 kontrol edin. Sunucudaki bir \u015feyin ba\u011fl\u0131 oldu\u011fu mod\u00fclleri engellemeyin; \u00f6rne\u011fin <code>esp4<\/code> ve <code>esp6<\/code> IPsec&#8217;i ta\u015f\u0131r, onlar\u0131 engellemek VPN t\u00fcnellerini bozar.<\/p>\n<p>Sunucunuz i\u00e7in iki dosyay\u0131 olu\u015fturun:<\/p>\n<div class=\"gitm-widget\" data-widget=\"sysctl\"><\/div>\n<h2>Bir \u015feyi de\u011fi\u015ftirmeden \u00f6nce sunucu nas\u0131l kontrol edilir?<\/h2>\n<p>Bu ayarlar\u0131n her biri, kendisine ba\u011fl\u0131 bir \u015feyi bozabilir; bu y\u00fczden ilk ad\u0131m salt okunurdur. Mevcut de\u011ferleri be\u015f anahtara g\u00f6re s\u00fcz\u00fclm\u00fc\u015f <code>sysctl -a<\/code> \u00e7\u0131kt\u0131s\u0131yla kaydedin ve bug\u00fcn bunlar\u0131 tan\u0131mlayan dosyalar\u0131 <code>\/etc\/sysctl.conf<\/code> ile <code>\/etc\/sysctl.d\/<\/code> \u00fczerinde <code>grep -r<\/code> \u00e7al\u0131\u015ft\u0131rarak bulun. Y\u00fcr\u00fcrl\u00fckte olan ama hi\u00e7bir dosyada g\u00f6r\u00fcnmeyen bir de\u011fer yaln\u0131zca \u00e7al\u0131\u015fma an\u0131nda tan\u0131mlanm\u0131\u015ft\u0131r ve bir sonraki yeniden ba\u015flatmada kaybolur.<\/p>\n<p>Ard\u0131ndan \u015fu anda user namespace kullanan bir \u015fey olup olmad\u0131\u011f\u0131na bak\u0131n. <code>lsns -t user<\/code> mevcut namespace&#8217;leri listeler; payla\u015f\u0131ml\u0131 bir web sunucusunda yaln\u0131zca root&#8217;a ait ilk namespace&#8217;i g\u00f6rmeyi beklersiniz. Bir m\u00fc\u015fteri hesab\u0131na ait bir namespace, o hesaptaki bir \u015feyin buna ba\u011fl\u0131 oldu\u011fu anlam\u0131na gelir ve s\u0131n\u0131r s\u0131f\u0131ra \u00e7ekilmeden \u00f6nce o hesaba bak\u0131lmas\u0131 gerekir. Son olarak kurulu konteyner ara\u00e7lar\u0131n\u0131 listeleyin: kurulu ama kullan\u0131lmayan bir konteyner \u00e7al\u0131\u015fma ortam\u0131 sorun de\u011fildir, \u00e7al\u0131\u015fan bir tanesi ise sunucuya farkl\u0131 davranmak i\u00e7in bir nedendir.<\/p>\n<h2>Her ayar\u0131n bedeli nedir?<\/h2>\n<div class=\"table-wrap\">\n<table>\n<thead>\n<tr>\n<th>Ayar<\/th>\n<th>Ne \u00e7al\u0131\u015fmay\u0131 b\u0131rakabilir<\/th>\n<th>Payla\u015f\u0131ml\u0131 bir web sunucusundaki tipik etkisi<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>user.max_user_namespaces = 0<\/td>\n<td>Rootless konteynerler, Flatpak, baz\u0131 taray\u0131c\u0131 sandbox&#8217;lar\u0131<\/td>\n<td>Hi\u00e7bir kirac\u0131 namespace kullanm\u0131yorsa yok<\/td>\n<\/tr>\n<tr>\n<td>kernel.yama.ptrace_scope = 1<\/td>\n<td>Normal bir kullan\u0131c\u0131 olarak ilgisiz bir s\u00fcrece hata ay\u0131klay\u0131c\u0131 ba\u011flamak<\/td>\n<td>Bar\u0131nd\u0131rma m\u00fc\u015fterileri i\u00e7in yok<\/td>\n<\/tr>\n<tr>\n<td>kernel.dmesg_restrict = 1<\/td>\n<td>\u00c7ekirdek g\u00fcnl\u00fc\u011f\u00fcn\u00fc yetkisiz okumak<\/td>\n<td>Yok; y\u00f6neticiler g\u00fcnl\u00fc\u011f\u00fc root olarak okumaya devam eder<\/td>\n<\/tr>\n<tr>\n<td>kernel.kptr_restrict = 2<\/td>\n<td>Profilleme ve hata ay\u0131klama ara\u00e7lar\u0131ndaki \u00e7ekirdek adresleri<\/td>\n<td>Web i\u015f y\u00fckleri i\u00e7in yok<\/td>\n<\/tr>\n<tr>\n<td>kernel.unprivileged_bpf_disabled = 1<\/td>\n<td>Yetkisiz eBPF ara\u00e7lar\u0131<\/td>\n<td>Yok; izleme ajanlar\u0131 yetkili \u00e7al\u0131\u015f\u0131r<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2>Ne zaman kullan\u0131lmamal\u0131<\/h2>\n<ul>\n<li><strong>Konteyner sunucular\u0131.<\/strong> Rootless Docker, Podman, LXC ve Flatpak user namespace&#8217;lere ihtiya\u00e7 duyar. Bunlar\u0131 \u00e7al\u0131\u015ft\u0131ran bir sunucuda kirac\u0131lar i\u00e7in s\u0131n\u0131r\u0131 ba\u015fka yollarla koruyun ya da riski yaln\u0131zca o sunucuda kabul edin.<\/li>\n<li><strong>Hata ay\u0131klama ara\u00e7lar\u0131.<\/strong> <code>ptrace_scope = 1<\/code>, ilgisiz bir s\u00fcrece hata ay\u0131klay\u0131c\u0131 ba\u011flamay\u0131 engeller; root yine yapabilir.<\/li>\n<li><strong>eBPF kullanan izleme ajanlar\u0131.<\/strong> Yetkili \u00e7al\u0131\u015ft\u0131klar\u0131 i\u00e7in \u00e7al\u0131\u015fmaya devam ederler, ama de\u011fi\u015fiklikten sonra kontrol edin. <code>unprivileged_bpf_disabled = 1<\/code> de\u011ferinin yeniden ba\u015flatma olmadan geri al\u0131namayaca\u011f\u0131n\u0131 unutmay\u0131n; bu se\u00e7ene\u011fi a\u00e7\u0131k tutmak istiyorsan\u0131z <code>2<\/code> kullan\u0131n.<\/li>\n<\/ul>\n<h2>Bir bar\u0131nd\u0131rma filosundan saha notu<\/h2>\n<p>Herhangi bir \u015feyi de\u011fi\u015ftirmeden \u00f6nce on d\u00f6rt payla\u015f\u0131ml\u0131 cPanel sunucusunu salt okunur olarak denetledik. \u00d6nceki bir incelemede s\u0131k\u0131la\u015ft\u0131r\u0131lm\u0131\u015f olarak kaydedilmelerine ra\u011fmen dokuzunda user namespace&#8217;ler a\u00e7\u0131kt\u0131: de\u011fer yaln\u0131zca \u00e7al\u0131\u015fma an\u0131nda verilmi\u015fti ve bir yeniden ba\u015flatmada kaybolmu\u015ftu. Her sunucuda \u00f6nce hi\u00e7bir m\u00fc\u015fterinin namespace kullanmad\u0131\u011f\u0131n\u0131 kontrol ettik, ilk \u00fc\u00e7 ayar\u0131, yani <code>user.max_user_namespaces<\/code>, <code>ptrace_scope<\/code> ve <code>dmesg_restrict<\/code> de\u011ferlerini <code>99-<\/code> ile ba\u015flayan bir dosya \u00fczerinden uygulad\u0131k ve kontrol panelini ve m\u00fc\u015fteri sitelerinden bir \u00f6rne\u011fi \u00f6nce ve sonra kar\u015f\u0131la\u015ft\u0131rd\u0131k. Hi\u00e7biri de\u011fi\u015fmedi. Filonun tamam\u0131 art\u0131k diske yaz\u0131lm\u0131\u015f ayn\u0131 de\u011ferlerle \u00e7al\u0131\u015f\u0131yor; i\u015faret\u00e7i ve eBPF ayarlar\u0131 bir sonraki ad\u0131m.<\/p>\n<h2>As\u0131l d\u00fczeltmeyi takip edin<\/h2>\n<ol class=\"checklist\">\n<li><strong>Canl\u0131 yaman\u0131n otomatik oldu\u011funu do\u011frulay\u0131n.<\/strong> KernelCare&#8217;de <code>\/etc\/sysconfig\/kcare\/kcare.conf<\/code> i\u00e7inde <code>AUTO_UPDATE=True<\/code> olup olmad\u0131\u011f\u0131na bak\u0131n; komut sat\u0131r\u0131ndaki durum, \u00f6zellik etkin olsa bile bo\u015f g\u00f6r\u00fcnebilir.<\/li>\n<li><strong>&#8220;Latest patch applied&#8221; ifadesini dikkatle okuyun.<\/strong> Bu, \u00e7ekirde\u011finiz i\u00e7in hen\u00fcz daha yeni bir yama olmad\u0131\u011f\u0131 anlam\u0131na gelir; belirli bir hatan\u0131n d\u00fczeltildi\u011fi anlam\u0131na gelmez.<\/li>\n<li><strong>Canl\u0131 yamalanamayan \u00e7ekirdekler i\u00e7in yeniden ba\u015flatma planlay\u0131n.<\/strong> Yeni bir \u00e7ekirdek paketi kurmak, sunucu onunla a\u00e7\u0131lana kadar hi\u00e7bir \u015fey de\u011fi\u015ftirmez.<\/li>\n<li><strong>Yamadan sonra da ayarlar\u0131 koruyun.<\/strong> Bir web sunucusunda neredeyse hi\u00e7bir maliyetleri yok ve bir sonraki hataya kar\u015f\u0131 da koruyorlar.<\/li>\n<\/ol>\n<h2>Ayarlar\u0131n yerinde kald\u0131\u011f\u0131ndan nas\u0131l emin olunur?<\/h2>\n<p>Bu b\u00f6l\u00fcm\u00fcn var olma nedeni yukar\u0131daki filo notudur: tamamland\u0131 olarak kaydedilen bir s\u0131k\u0131la\u015ft\u0131rma, bir yeniden ba\u015flatmada sessizce geri al\u0131nm\u0131\u015ft\u0131. Ayr\u0131 dosyay\u0131 yazmak anl\u0131k nedeni giderir, ama ayarlar ba\u015fka yollarla da kayar: bir paket g\u00fcncellemesi kendi dosyas\u0131n\u0131 getirdi\u011finde, biri bir de\u011feri elle ayarlad\u0131\u011f\u0131nda ya da bir sunucu daha eski bir \u015fablondan yeniden kuruldu\u011funda.<\/p>\n<p>\u00dc\u00e7 al\u0131\u015fkanl\u0131k onlar\u0131 do\u011fru tutar. Be\u015f de\u011feri her yeniden ba\u015flatmadan ve her \u00e7ekirdek ya da CloudLinux g\u00fcncellemesinden sonra kontrol edin; bunu tercihen haf\u0131zaya de\u011fil izlemeye b\u0131rak\u0131n ve beklenen de\u011ferden her sapmada uyar\u0131 \u00fcretin. Ayr\u0131 dosyay\u0131 yap\u0131land\u0131rma y\u00f6netimi alt\u0131nda ya da en az\u0131ndan s\u00fcr\u00fcmlenmi\u015f bir kopya olarak tutun ki yeniden kurulan bir sunucu ayn\u0131 dosyay\u0131 als\u0131n. Ve bu kontrol\u00fc, g\u00fcvenlik duvar\u0131 ve SSH ayarlar\u0131n\u0131n yan\u0131nda, her d\u00f6nemsel sunucu incelemesine dahil edin; \u00e7\u00fcnk\u00fc kimsenin bakmad\u0131\u011f\u0131 bir de\u011fer, de\u011fi\u015fti\u011fini de kimsenin fark etmeyece\u011fi bir de\u011ferdir.<\/p>\n<p>Be\u015f anahtar\u0131 yazd\u0131r\u0131p beklenen de\u011ferlerle kar\u015f\u0131la\u015ft\u0131ran k\u00fc\u00e7\u00fck bir betik yeterlidir. Onu cron ile \u00e7al\u0131\u015ft\u0131r\u0131n ve \u00e7\u0131kt\u0131s\u0131n\u0131 di\u011fer uyar\u0131lar\u0131n\u0131zla ayn\u0131 yere g\u00f6nderin; b\u00f6ylece kaym\u0131\u015f bir de\u011fer s\u00fcrpriz de\u011fil, bir ticket olur.<\/p>\n<h2>Bir \u015fey bozulursa nas\u0131l geri al\u0131n\u0131r?<\/h2>\n<p>Geri almay\u0131 da de\u011fi\u015fikli\u011fin kendisi kadar basit tutun. Ayr\u0131 dosyay\u0131 yazmadan \u00f6nce mevcut de\u011ferleri bir \u00e7al\u0131\u015fma dizinindeki bir dosyaya kaydedin. Sonras\u0131nda bir hizmet hata verirse, <code>\/etc\/sysctl.d\/99-fleet-hardening.conf<\/code> i\u00e7indeki sat\u0131r\u0131 silin ya da yorum sat\u0131r\u0131na \u00e7evirin ve eski de\u011feri <code>sysctl -w<\/code> ile geri verin; bu ayarlar\u0131n \u00e7o\u011fu hemen etkili olur ve yeniden ba\u015flatma gerektirmez. \u0130stisna <code>unprivileged_bpf_disabled = 1<\/code> de\u011feridir: bir sonraki a\u00e7\u0131l\u0131\u015fa kadar y\u00fcr\u00fcrl\u00fckte kal\u0131r; emin olmad\u0131\u011f\u0131n\u0131z bir sunucuda <code>2<\/code> de\u011ferinin daha g\u00fcvenli ilk ad\u0131m olmas\u0131n\u0131n nedeni budur.<\/p>\n<p>Ayn\u0131 ay\u0131n \u00e7al\u0131\u015fma ortam\u0131 taraf\u0131 i\u00e7in <a href=\"\/blog\/php2shell-yama-gunu-php-nodejs-cloudlinux-cpanel-rehberi\/\">PHP2Shell yama g\u00fcn\u00fc rehberine<\/a> ve <a href=\"\/blog\/nodejs-bind-java-ekim-2026-guvenlik-surumleri-sunucu-tarafi\/\">tek haftada Node.js, BIND ve Java yaz\u0131s\u0131na<\/a> bak\u0131n.<\/p>\n<h2>K\u0131sacas\u0131<\/h2>\n<p>Bu ayarlar\u0131n hi\u00e7biri yeni de\u011fil ve hi\u00e7biri bir \u00e7ekirdek yamas\u0131n\u0131n yerini tutmaz. De\u011fi\u015ftirdikleri \u015fey, a\u00e7\u0131klama ile d\u00fczeltme aras\u0131ndaki bo\u015fluktur; payla\u015f\u0131ml\u0131 bir sunucuda en \u00e7ok \u00f6nem ta\u015f\u0131yan d\u00f6nem de budur, \u00e7\u00fcnk\u00fc her m\u00fc\u015fterinin kodu ayn\u0131 \u00e7ekirde\u011fi payla\u015f\u0131r. Onlar\u0131 bir kez yerine koyun, diske yaz\u0131n, kaymalara kar\u015f\u0131 izleyin ve konteyner sunucusunu bilin\u00e7li tek istisna olarak ele al\u0131n. Bir dahaki sefere bir yetki y\u00fckseltme raporu d\u00fczeltmesinden \u00f6nce kamuya a\u00e7\u0131ld\u0131\u011f\u0131nda, soru sunucunun zaten a\u00e7\u0131kta olup olmad\u0131\u011f\u0131 de\u011fil, yaman\u0131n ne zaman gelece\u011fi olacakt\u0131r.<\/p>\n<h2 id=\"faq-paylasimli-linux-sunucu-cekirdek-sikilastirma\">SSS: payla\u015f\u0131ml\u0131 bir Linux sunucusu i\u00e7in \u00e7ekirdek s\u0131k\u0131la\u015ft\u0131rma<\/h2>\n<h3 id=\"faq-max-user-namespaces-cpanel-bozar-mi\">user.max_user_namespaces de\u011ferini 0 yapmak cPanel ya da CloudLinux sunucular\u0131n\u0131 bozar m\u0131?<\/h3>\n<p>Bizim deneyimimizde hay\u0131r. On d\u00f6rt payla\u015f\u0131ml\u0131 cPanel sunucusunda kontrol paneli ve \u00f6rnek m\u00fc\u015fteri siteleri de\u011fi\u015fiklikten \u00f6nce ve sonra ayn\u0131 yan\u0131tlar\u0131 verdi. \u00d6nce <code>lsns -t user<\/code> ile hi\u00e7bir m\u00fc\u015fteri hesab\u0131n\u0131n namespace kullanmad\u0131\u011f\u0131n\u0131 kontrol edin, \u00e7\u00fcnk\u00fc kullanan bir hesap bundan etkilenir.<\/p>\n<h3 id=\"faq-sysctl-dosyasi-neden-99-ile-baslar-cloudlinux\">2026&#8217;da bir CloudLinux sunucusunda sysctl ek dosyas\u0131 neden 99 ile ba\u015flamal\u0131?<\/h3>\n<p>\u00c7\u00fcnk\u00fc <code>\/etc\/sysctl.d\/<\/code> i\u00e7indeki dosyalar ad s\u0131ras\u0131na g\u00f6re y\u00fcklenir ve sonraki dosya kazan\u0131r. CloudLinux <code>90-cloudlinux.conf<\/code> dosyas\u0131yla gelir; bu y\u00fczden <code>99-<\/code> ile ba\u015flayan bir dosya ondan sonra uygulan\u0131r ve y\u00fcr\u00fcrl\u00fckte kalan de\u011ferler onun de\u011ferleridir.<\/p>\n<h3 id=\"faq-user-namespace-kapali-oldugunu-dogrulama\">User namespace&#8217;lerin s\u0131radan kullan\u0131c\u0131lar i\u00e7in ger\u00e7ekten kapal\u0131 oldu\u011funu nas\u0131l do\u011frulars\u0131n\u0131z?<\/h3>\n<p>De\u011feri <code>sysctl user.max_user_namespaces<\/code> ile okuyun, ard\u0131ndan yetkisiz bir kullan\u0131c\u0131 olarak <code>unshare -Ur true<\/code> \u00e7al\u0131\u015ft\u0131r\u0131n. S\u0131n\u0131r s\u0131f\u0131rken komut &#8220;No space left on device&#8221; hatas\u0131yla ba\u015far\u0131s\u0131z olur; ba\u015far\u0131l\u0131 olursa ayar y\u00fcr\u00fcrl\u00fckte de\u011fildir.<\/p>\n<h3 id=\"faq-ptrace-scope-1-mi-2-mi\">Payla\u015f\u0131ml\u0131 bir bar\u0131nd\u0131rma sunucusunda kernel.yama.ptrace_scope 1 mi 2 mi kullan\u0131lmal\u0131?<\/h3>\n<p>Pratik varsay\u0131lan 1 de\u011feridir: bir s\u00fcre\u00e7 yaln\u0131zca \u00fcst s\u00fcreci taraf\u0131ndan izlenebilir ve bu, ele ge\u00e7irilen bir s\u00fcrecin ba\u015fka bir s\u00fcreci incelemesini engeller. 2 de\u011feri izlemeyi yaln\u0131zca y\u00f6neticilerle s\u0131n\u0131rlar; bu daha kat\u0131d\u0131r ve me\u015fru hata ay\u0131klaman\u0131n \u00f6n\u00fcne ge\u00e7ebilir.<\/p>\n<h3 id=\"faq-kptr-restrict-1-ile-2-farki\">Bir web sunucusunda kernel.kptr_restrict 1 ile 2 aras\u0131ndaki fark nedir?<\/h3>\n<p>1 de\u011ferinde \u00e7ekirdek i\u015faret\u00e7ileri uygun yetkiye sahip olmayan kullan\u0131c\u0131lardan gizlenir; 2 de\u011ferinde ise root dahil herkesten gizlenir. Bir web sunucusu nadiren \u00e7ekirdek adreslerine ihtiya\u00e7 duyar, bu y\u00fczden 2 makul bir se\u00e7imdir.<\/p>\n<h3 id=\"faq-bpf-disabled-1-geri-alinabilir-mi\">kernel.unprivileged_bpf_disabled ayar\u0131 yeniden ba\u015flatma olmadan geri al\u0131nabilir mi?<\/h3>\n<p>1 de\u011feri, tasar\u0131m gere\u011fi bir sonraki a\u00e7\u0131l\u0131\u015fa kadar geri de\u011fi\u015ftirilemez. 2 de\u011feri de yetkisiz eBPF&#8217;i engeller ama bir y\u00f6netici taraf\u0131ndan \u00e7al\u0131\u015fma an\u0131nda gev\u015fetilebilir; bu y\u00fczden sunucunun ne \u00e7al\u0131\u015ft\u0131rd\u0131\u011f\u0131ndan emin de\u011filseniz daha g\u00fcvenli ilk ad\u0131m odur.<\/p>\n<h3 id=\"faq-konteyner-sunucusu-namespace-istisnasi\">2026&#8217;da bir konteyner sunucusu user namespace&#8217;leri kapatmak yerine ne yapmal\u0131?<\/h3>\n<p>Onu ayr\u0131 bir sunucu s\u0131n\u0131f\u0131 olarak ele al\u0131n. Rootless Docker, Podman ve LXC user namespace&#8217;lere ihtiya\u00e7 duyar; bu y\u00fczden orada a\u00e7\u0131k tutun, o sunucuyu payla\u015f\u0131ml\u0131 bar\u0131nd\u0131rma havuzunun d\u0131\u015f\u0131nda tutun ve yetki y\u00fckseltme hatalar\u0131n\u0131 kapatmak i\u00e7in h\u0131zl\u0131 \u00e7ekirdek yamalar\u0131na ve canl\u0131 yamalamaya g\u00fcvenin.<\/p>\n<h3 id=\"faq-modul-engel-listesi-esp4-esp6\">2026&#8217;da payla\u015f\u0131ml\u0131 bir web sunucusunda hangi \u00e7ekirdek mod\u00fcllerini engellemek g\u00fcvenlidir, hangileri de\u011fildir?<\/h3>\n<p>Sunucunun hi\u00e7 kullanmad\u0131\u011f\u0131 \u00f6zelliklere ait mod\u00fcller iyi adaylard\u0131r; \u00f6rne\u011fin \u00e7ekirdek i\u00e7i SMB sunucusu ve nadiren kullan\u0131lan a\u011f protokolleri. Herhangi bir IPsec t\u00fcneli varsa <code>esp4<\/code> ya da <code>esp6<\/code> mod\u00fcl\u00fcn\u00fc asla engellemeyin ve bir girdi eklemeden \u00f6nce <code>lsmod<\/code> \u00e7\u0131kt\u0131s\u0131n\u0131 kontrol edin.<\/p>\n<h3 id=\"faq-kernelcare-latest-patch-applied-anlami\">KernelCare&#8217;deki &#8220;latest patch applied&#8221; ifadesi belirli bir \u00e7ekirdek hatas\u0131n\u0131n d\u00fczeltildi\u011fi anlam\u0131na m\u0131 gelir?<\/h3>\n<p>Hay\u0131r. \u00c7al\u0131\u015fan \u00e7ekirdek i\u00e7in hen\u00fcz daha yeni bir canl\u0131 yama olmad\u0131\u011f\u0131 anlam\u0131na gelir. Belirli bir hatan\u0131n kapsan\u0131p kapsanmad\u0131\u011f\u0131n\u0131 bilmek i\u00e7in KernelCare&#8217;in yama listesine ya da o soruna ait duyurular\u0131na bak\u0131n ve d\u00fczeltme yay\u0131mland\u0131\u011f\u0131nda uygulanmas\u0131 i\u00e7in <code>AUTO_UPDATE=True<\/code> oldu\u011funu do\u011frulay\u0131n.<\/p>\n<h3 id=\"faq-yamadan-sonra-ayarlar-kalmali-mi-2026\">\u00c7ekirdek yamas\u0131 kurulduktan sonra s\u0131k\u0131la\u015ft\u0131rma ayarlar\u0131 yerinde kalmal\u0131 m\u0131?<\/h3>\n<p>Evet. Bir web sunucusunda neredeyse hi\u00e7bir maliyetleri yoktur ve bir sonraki yetki y\u00fckseltme hatas\u0131n\u0131n eri\u015fimini de, daha yamas\u0131 \u00e7\u0131kmadan azalt\u0131rlar. Onlar\u0131 ge\u00e7ici bir \u00e7\u00f6z\u00fcm olarak de\u011fil, temel yap\u0131land\u0131rma olarak g\u00f6r\u00fcn.<\/p>\n<h2>Kaynaklar<\/h2>\n<ul class=\"sources\">\n<li><a href=\"https:\/\/www.kernel.org\/doc\/html\/latest\/admin-guide\/sysctl\/user.html\" rel=\"noopener\" target=\"_blank\">\/proc\/sys\/user belgeleri<\/a>, kernel.org<\/li>\n<li><a href=\"https:\/\/www.kernel.org\/doc\/html\/latest\/admin-guide\/sysctl\/kernel.html\" rel=\"noopener\" target=\"_blank\">\/proc\/sys\/kernel belgeleri<\/a>, kernel.org<\/li>\n<li><a href=\"https:\/\/www.kernel.org\/doc\/html\/latest\/admin-guide\/LSM\/Yama.html\" rel=\"noopener\" target=\"_blank\">Yama<\/a>, kernel.org<\/li>\n<li><a href=\"https:\/\/www.phoronix.com\/news\/LKML-New-Trend-Vulnerabilities\" rel=\"noopener\" target=\"_blank\">Birka\u00e7 Linux \u00e7ekirdek a\u00e7\u0131\u011f\u0131 herkese a\u00e7\u0131k bir e-posta listesine g\u00f6nderildi<\/a>, Phoronix<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Yerel yetki y\u00fckseltme hatalar\u0131 d\u00fczeltme \u00e7\u0131kmadan kamuya a\u00e7\u0131ld\u0131\u011f\u0131nda, payla\u015f\u0131ml\u0131 bir bar\u0131nd\u0131rma sunucusu yap\u0131land\u0131rmaya g\u00fcvenmek zorunda kal\u0131r. \u00c7ekirde\u011fin sald\u0131r\u0131 y\u00fczeyini daraltan be\u015f sysctl ve mod\u00fcl ayar\u0131, bunlar\u0131n yeniden ba\u015flatmadan sonra nas\u0131l kal\u0131c\u0131 olaca\u011f\u0131, nas\u0131l do\u011frulanaca\u011f\u0131 ve ne zaman kullan\u0131lmamas\u0131 gerekti\u011fi.<\/p>\n","protected":false},"author":0,"featured_media":43,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[34,12,25,33,36,32,23,35],"class_list":["post-26","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cekirdek-sikilastirma","tag-cloudlinux","tag-kernelcare","tag-linux-cekirdegi","tag-paylasimli-barindirma","tag-sunucu-guvenligi","tag-sysctl","tag-user-namespace"],"_links":{"self":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/26","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/comments?post=26"}],"version-history":[{"count":2,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/26\/revisions"}],"predecessor-version":[{"id":51,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/posts\/26\/revisions\/51"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/media\/43"}],"wp:attachment":[{"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/media?parent=26"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/categories?post=26"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/adnancanturk.com\/blog\/wp-json\/wp\/v2\/tags?post=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}