Linux Sunucu Güvenlik ve SSH Sertleştirme Oluşturucu

#!/usr/bin/env bash
set -euo pipefail
echo "=== Linux VDS Guvenlik Sertlestirme Baslatiliyor ==="

# 1. SSH Yapilandirmasi
sudo mkdir -p /etc/ssh/sshd_config.d
sudo tee /etc/ssh/sshd_config.d/99-hardening.conf > /dev/null << 'EOF'
# /etc/ssh/sshd_config.d/99-hardening.conf
Port 22
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
KbdInteractiveAuthentication no
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
EOF
sudo sshd -t && sudo systemctl reload ssh || sudo systemctl reload sshd

# 2. Guvenlik Duvari (UFW)
# UFW Kurulum ve Kurallari
sudo apt update && sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp comment "SSH Erisimi"
sudo ufw allow 80/tcp comment "HTTP Web"
sudo ufw allow 443/tcp comment "HTTPS Web"
sudo ufw allow 3000/tcp comment "Ozel Servis"
sudo ufw --force enable
sudo ufw status verbose

# 3. Fail2Ban Kurulumu
sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.local > /dev/null << 'EOF'
# /etc/fail2ban/jail.local
[DEFAULT]
bantime = 172800
findtime = 600
maxretry = 3
banaction = ufw
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
EOF
sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

# 4. Cekirdek (Sysctl) Sertlestirmesi
sudo tee /etc/sysctl.d/99-security.conf > /dev/null << 'EOF'
# /etc/sysctl.d/99-security.conf
# SYN Flood Korumasi
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 2

# IP Spoofing ve Paket Yonlendirme Korumasi
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# ICMP Broadcast ve Sahte Hata Mesajlarini Reddet
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1

# TCP BBR Hizlandirma ve FQ Kuyruklama
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
EOF
sudo sysctl --system

# 5. Otomatik Guvenlik Guncellemeleri
# Otomatik Guvenlik Guncellemeleri
sudo apt update && sudo apt install -y unattended-upgrades update-notifier-common
sudo dpkg-reconfigure -plow unattended-upgrades
sudo systemctl enable --now unattended-upgrades

echo "=== Guvenlik Sertlestirmesi Basariyla Tamamlandi ==="