{"id":16055,"date":"2026-11-06T12:36:53","date_gmt":"2026-11-06T09:36:53","guid":{"rendered":"https:\/\/www.inetmar.com\/blog\/?p=16055"},"modified":"2026-11-06T12:36:53","modified_gmt":"2026-11-06T09:36:53","slug":"opensshde-kritik-acik-cve-2026-123158","status":"publish","type":"post","link":"https:\/\/www.inetmar.com\/blog\/opensshde-kritik-acik-cve-2026-123158\/","title":{"rendered":"OpenSSH\u2019de Kritik A\u00e7\u0131k! (CVE-2026-123158) Kimler Risk Alt\u0131nda, Nas\u0131l Korunulur?"},"content":{"rendered":"

OpenSSH sunucusunda (sshd<\/code>), belirli Linux da\u011f\u0131t\u0131mlar\u0131n\u0131 ve g\u00f6m\u00fcl\u00fc sistemleri do\u011frudan etkileyen kritik bir kimlik do\u011frulama atlatma (password authentication bypass<\/strong>) g\u00fcvenlik zafiyeti duyuruldu. Hata parola ile giri\u015f yetkisi bulunmayan veya \u015fifresi tan\u0131mlanmam\u0131\u015f hesaplara, parola bilinmeksizin tek bir ba\u011flant\u0131yla yetkisiz eri\u015fim sa\u011flanmas\u0131na yol a\u00e7\u0131yor.<\/p>\n

Hata Nas\u0131l Ortaya \u00c7\u0131k\u0131yor?<\/h2>\n

Bu zafiyet, iki farkl\u0131 mimari tercihin bir araya gelmesiyle tetikleniyor: PAM (Pluggable Authentication Modules) deste\u011fi olmadan derlenmi\u015f OpenSSH<\/strong> ve hafif sistemlerde yayg\u0131n olarak tercih edilen musl libc<\/strong> k\u00fct\u00fcphanesi.<\/p>\n

Sald\u0131r\u0131n\u0131n ger\u00e7ekle\u015fme mant\u0131\u011f\u0131 \u015fu \u00fc\u00e7 ad\u0131ma dayan\u0131r:<\/p>\n

    \n
  1. Eksik Salt De\u011ferinin \u00d6d\u00fcn\u00e7 Al\u0131nmas\u0131:<\/strong> PAM deste\u011fi olmayan sshd<\/code>, parola denetimini standart crypt()<\/code> fonksiyonu \u00fczerinden y\u00fcr\u00fct\u00fcr. \/etc\/shadow<\/code> dosyas\u0131nda parola alan\u0131 *<\/code> olan (yani \u015fifre belirlenmemi\u015f, yaln\u0131zca SSH anahtar\u0131yla girmesi planlanan) hesaplarda bir hash salt de\u011feri bulunmaz. sshd<\/code>, bu durumda sistemde ge\u00e7erli bir parolas\u0131 bulunan ba\u015fka bir kullan\u0131c\u0131n\u0131n $5$<\/code> (SHA-256) veya $6$<\/code> (SHA-512) format\u0131ndaki salt de\u011ferini ge\u00e7ici olarak \u00f6d\u00fcn\u00e7 al\u0131r.<\/li>\n
  2. musl libc’nin Hata Kodu \u00dcretmesi:<\/strong> Sald\u0131rgan, hedef hesaba oturum a\u00e7arken 256 bayttan uzun<\/strong> (genellikle 257\u20131024 bayt aras\u0131) rastgele bir parola g\u00f6nderir. musl libc<\/code> k\u00fct\u00fcphanesindeki crypt()<\/code> fonksiyonu, 256 bayt s\u0131n\u0131r\u0131n\u0131 a\u015fan girdilerde hata korumas\u0131 olarak geriye do\u011frudan *<\/code> karakterini d\u00f6nd\u00fcr\u00fcr.<\/li>\n
  3. E\u015fle\u015fmenin Sa\u011flanmas\u0131 ve Giri\u015f:<\/strong> sshd<\/code>, fonksiyondan d\u00f6nen hata karakteri (*<\/code>) ile \/etc\/shadow<\/code> dosyas\u0131nda parolas\u0131z hesab\u0131n kar\u015f\u0131s\u0131nda duran de\u011feri (*<\/code>) kar\u015f\u0131la\u015ft\u0131r\u0131r. \u0130ki de\u011fer birebir e\u015fle\u015fti\u011fi i\u00e7in sistem parolay\u0131 do\u011frulanm\u0131\u015f kabul eder ve sald\u0131rgana an\u0131nda kabuk (shell) eri\u015fimi verir.<\/li>\n<\/ol>\n

    \u0130\u015flem i\u00e7in parola tahminine ya da brute-force denemesine gerek yoktur; do\u011fru uzunluktaki bir dize ilk denemede giri\u015fi sa\u011flar.<\/p>\n

    Hangi Sistemler Risk Alt\u0131nda, Hangileri G\u00fcvende?<\/h2>\n

    A\u00e7\u0131\u011f\u0131n ortaya \u00e7\u0131kmas\u0131 i\u00e7in sistemin musl libc<\/strong> tabanl\u0131 olmas\u0131 ve sshd<\/code> servisinin PAM olmadan \u00e7al\u0131\u015fmas\u0131 gerekir.<\/p>\n

    Risk Alt\u0131ndaki Sistemler<\/h3>\n
      \n
    • Alpine Linux:<\/strong> Standart openssh-server<\/code> paketi PAM olmadan derlenir.<\/li>\n
    • G\u00f6m\u00fcl\u00fc ve Hafif Linux Sistemleri:<\/strong> musl libc<\/code> ile derlenmi\u015f OpenWrt, Buildroot, Yocto kurulumlar\u0131.<\/li>\n
    • Alpine Tabanl\u0131 Konteynerler:<\/strong> \u0130\u00e7erisinde harici eri\u015fime a\u00e7\u0131k sshd<\/code> servisi bar\u0131nd\u0131ran Docker\/Podman imajlar\u0131.<\/li>\n<\/ul>\n

      Etkilenmeyen Sistemler<\/h3>\n
        \n
      • AlmaLinux, CentOS, RHEL, Rocky Linux<\/strong><\/li>\n
      • Ubuntu, Debian<\/strong><\/li>\n
      • SUSE \/ openSUSE<\/strong><\/li>\n<\/ul>\n

        Bu da\u011f\u0131t\u0131mlar varsay\u0131lan olarak glibc<\/code> ve PAM<\/code> (UsePAM yes<\/code>) kulland\u0131\u011f\u0131ndan bu a\u00e7\u0131ktan etkilenmez.<\/p>\n

        Sunucunuzun Savunmas\u0131z Oldu\u011funu Nas\u0131l Anlars\u0131n\u0131z?<\/h2>\n

        Alpine veya musl tabanl\u0131 bir sistem y\u00f6netiyorsan\u0131z a\u015fa\u011f\u0131daki komutlarla denetim yapabilirsiniz:<\/p>\n

        # 1. Parola ile giri\u015f a\u00e7\u0131k m\u0131? (yes d\u00f6n\u00fcyorsa risk)\r\nsshd -T | grep -i passwordauthentication\r\n\r\n# 2. Risk alt\u0131ndaki parolas\u0131z (*) hesaplar\u0131 listeleyin:\r\nawk -F: '$2 == \"*\" {print $1}' \/etc\/shadow\r\n\r\n# 3. Tuz \u00f6d\u00fcn\u00e7 verilebilecek hash'li ($5$ veya $6$) ba\u015fka kullan\u0131c\u0131 var m\u0131?\r\ngrep -E ':\\$(5|6)\\$' \/etc\/shadow<\/code><\/pre>\n
        Bu \u00fc\u00e7 ko\u015ful ayn\u0131 anda sa\u011flan\u0131yorsa sunucu do\u011frudan sald\u0131r\u0131ya a\u00e7\u0131kt\u0131r.<\/p>\n
        \u00c7\u00f6z\u00fcm ve Al\u0131nmas\u0131 Gereken \u00d6nlemler<\/h2>\n
        Paket G\u00fcncellemesi ve Servis Yeniden Ba\u015flatma<\/h3>\n
        Kal\u0131c\u0131 \u00e7\u00f6z\u00fcm i\u00e7in sisteminizi g\u00fcncelleyin. Paket g\u00fcncellemesinden sonra \u00e7al\u0131\u015fan sshd<\/code> s\u00fcrecini bellekte yenilemek i\u00e7in servisi yeniden ba\u015flatmak \u015fartt\u0131r:<\/p>\n
        apk update\r\napk upgrade openssh\r\nrc-service sshd restart<\/code><\/pre>\n
        G\u00fcvenli Asgari S\u00fcr\u00fcmler:<\/strong><\/p>\n
          \n
        • Alpine v3.24:<\/strong> 10.3_p1-r2<\/code> veya \u00fczeri<\/li>\n
        • Alpine v3.23:<\/strong> 10.2_p1-r1<\/code> veya \u00fczeri<\/li>\n
        • Alpine v3.22:<\/strong> 10.0_p1-r11<\/code> veya \u00fczeri<\/li>\n
        • Alpine v3.21:<\/strong> 9.9_p2-r1<\/code> veya \u00fczeri<\/li>\n
        • Alpine Edge \/ Upstream:<\/strong> 10.6_p2-r0<\/code> (10.6p2<\/code>) veya \u00fczeri<\/li>\n<\/ul>\n
          Parola ile Giri\u015fi Kapatmak<\/h3>\n
          G\u00fcncellemeyi hemen uygulayam\u0131yorsan\u0131z ge\u00e7ici \u00e7\u00f6z\u00fcm i\u00e7in SSH parola do\u011frulamas\u0131n\u0131 tamamen kapat\u0131p yaln\u0131zca SSH anahtar\u0131 kullan\u0131m\u0131n\u0131 zorunlu k\u0131lmak zafiyeti an\u0131nda bertaraf eder:<\/p>\n
          # Drop-in yap\u0131land\u0131rma dosyas\u0131 ekleyin\r\nmkdir -p \/etc\/ssh\/sshd_config.d\r\necho 'PasswordAuthentication no' > \/etc\/ssh\/sshd_config.d\/00-no-passwords.conf\r\n\r\n# Ana yap\u0131land\u0131rma dosyas\u0131n\u0131 g\u00fcncelleyin\r\nsed -i.bak -e '1i PasswordAuthentication no' \\\r\n  -e 's\/^\\(\\s*PasswordAuthentication[^y#]*\\)yes\/\\1no\/i' \\\r\n  \/etc\/ssh\/sshd_config\r\n\r\n# Yap\u0131land\u0131rmay\u0131 test edip servisi yeniden ba\u015flat\u0131n\r\nsshd -t && rc-service sshd restart<\/code><\/pre>\n
          Uygulaman\u0131n aktifle\u015fti\u011fini sshd -T | grep -i passwordauthentication<\/code> komutuyla (passwordauthentication no<\/code> \u00e7\u0131kt\u0131s\u0131n\u0131 g\u00f6rerek) teyit edebilirsiniz.<\/p>\n
          Sald\u0131r\u0131 \u0130hlal Tespiti<\/h2>\n
          Sisteminizin bu a\u00e7\u0131ktan yararlan\u0131larak hedef al\u0131n\u0131p al\u0131nmad\u0131\u011f\u0131n\u0131 anlamak i\u00e7in \/var\/log\/messages<\/code> dosyas\u0131ndaki ba\u015far\u0131l\u0131 parola giri\u015flerini inceleyin:<\/p>\n
          grep \"Accepted password\" \/var\/log\/messages<\/code><\/pre>\n
          Parolas\u0131 olmamas\u0131 gereken (root<\/code>, alpine<\/code> veya sadece anahtarla giri\u015f yapan \u00f6zel servis hesaplar\u0131) bir kullan\u0131c\u0131 ad\u0131na verilmi\u015f Accepted password for ...<\/code> log kayd\u0131 g\u00f6r\u00fcyorsan\u0131z, sunucuya yetkisiz eri\u015fim sa\u011flanm\u0131\u015f demektir. Bu durumda yetki y\u00fckseltme ge\u00e7mi\u015fi ve \/home\/*\/.ssh\/authorized_keys<\/code> dosyalar\u0131 incelenmelidir.<\/p>\n","protected":false},"excerpt":{"rendered":"
          OpenSSH sunucusunda (sshd), belirli Linux da\u011f\u0131t\u0131mlar\u0131n\u0131 ve g\u00f6m\u00fcl\u00fc sistemleri do\u011frudan etkileyen kritik bir kimlik do\u011frulama atlatma (password authentication bypass) g\u00fcvenlik zafiyeti duyuruldu. Hata parola ile giri\u015f yetkisi bulunmayan veya \u015fifresi tan\u0131mlanmam\u0131\u015f hesaplara, parola bilinmeksizin tek bir ba\u011flant\u0131yla yetkisiz eri\u015fim sa\u011flanmas\u0131na yol a\u00e7\u0131yor. Hata Nas\u0131l Ortaya \u00c7\u0131k\u0131yor? Bu zafiyet, iki farkl\u0131 mimari tercihin bir araya gelmesiyle …<\/p>\n","protected":false},"author":2,"featured_media":16057,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[52,11],"tags":[],"class_list":["post-16055","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik","category-linux"],"_links":{"self":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/16055","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/comments?post=16055"}],"version-history":[{"count":3,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/16055\/revisions"}],"predecessor-version":[{"id":16059,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/16055\/revisions\/16059"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media\/16057"}],"wp:attachment":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media?parent=16055"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/categories?post=16055"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/tags?post=16055"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}