{"id":5764,"date":"2026-09-26T14:29:48","date_gmt":"2026-09-26T11:29:48","guid":{"rendered":"https:\/\/www.dchost.com\/blog\/?p=5764"},"modified":"2026-09-26T06:26:55","modified_gmt":"2026-09-26T03:26:55","slug":"ssh-agent-forwarding-vps-guvenli-git-erisimi","status":"publish","type":"post","link":"https:\/\/www.dchost.com\/blog\/ssh-agent-forwarding-vps-guvenli-git-erisimi\/","title":{"rendered":"SSH Agent Forwarding: VPS&#8217;te G\u00fcvenli Git Eri\u015fimi"},"content":{"rendered":"<div class=\"dchost-blog-content-wrapper\"><div class=\"aiw-summary\">\n<p class=\"aiw-box-title\">H\u0131zl\u0131 \u00f6zet<\/p>\n<p>\u00d6zel SSH anahtar\u0131n\u0131z\u0131 VPS&#8217;e kopyalamadan sunucunun \u00f6zel Git deposuna eri\u015fmesini istiyorsan\u0131z SSH agent forwarding kullan\u0131labilir. Bu y\u00f6ntemde imzalama i\u015flemi yerel bilgisayar\u0131n\u0131zdaki SSH agent \u00fczerinde kal\u0131r; ancak ba\u011fland\u0131\u011f\u0131n\u0131z VPS g\u00fcvenilir de\u011filse agent \u00fczerinden sizin ad\u0131n\u0131za i\u015flem ba\u015flatabilir.<\/p>\n<ul>\n<li>\u00d6zel anahtar dosyas\u0131 VPS&#8217;e aktar\u0131lmaz; y\u00f6nlendirilmi\u015f agent soketine eri\u015fen s\u00fcre\u00e7ler anahtarla imza iste\u011fi g\u00f6nderebilir.<\/li>\n<li><code>ForwardAgent<\/code> ayar\u0131n\u0131 yaln\u0131zca ihtiya\u00e7 duydu\u011funuz tek bir sunucu takma ad\u0131na uygulay\u0131n.<\/li>\n<li>Sunucunun yaln\u0131zca arac\u0131 olarak kullan\u0131laca\u011f\u0131 durumda <code>ProxyJump<\/code>, agent forwarding&#8217;e g\u00f6re daha dar bir eri\u015fim modeli sunar.<\/li>\n<li>Git ba\u011flant\u0131s\u0131n\u0131 \u00f6nce SSH ile, sonra <code>git ls-remote<\/code> ile do\u011frulay\u0131n; ba\u015far\u0131s\u0131zl\u0131\u011f\u0131 do\u011frudan anahtar kopyalayarak \u00e7\u00f6zmeye \u00e7al\u0131\u015fmay\u0131n.<\/li>\n<\/ul>\n<\/div>\n<p>VPS \u00fczerinde \u00e7al\u0131\u015fan bir deploy beti\u011fi \u00f6zel Git deposundan kod \u00e7ekemiyor olabilir. \u0130lk akla gelen \u00e7\u00f6z\u00fcm, yerel \u00f6zel SSH anahtar\u0131n\u0131 sunucuya kopyalamakt\u0131r. Bu yakla\u015f\u0131m \u00e7al\u0131\u015fsa bile anahtar\u0131n yede\u011fi, izinleri, rotasyonu ve sunucu ele ge\u00e7irilirse olu\u015fturaca\u011f\u0131 risk sizin sorumlulu\u011funuzda kal\u0131r.<\/p>\n<p>SSH agent forwarding farkl\u0131 bir yol sunar: SSH istemciniz, yerel makinede \u00e7al\u0131\u015fan agent&#8217;a ait soketi oturum \u00fczerinden VPS&#8217;e y\u00f6nlendirir. VPS, \u00f6zel anahtar\u0131n i\u00e7eri\u011fini g\u00f6rmeden imzalama iste\u011fini bu agent&#8217;a iletebilir. Bu y\u00f6ntem anahtar\u0131 kopyalamama hedefini kar\u015f\u0131lar; VPS&#8217;i otomatik olarak g\u00fcvenilir hale getirmez.<\/p>\n<div id=\"toc_container\" role=\"navigation\" aria-label=\"Table of Contents\" data-nosnippet class=\"toc_transparent no_bullets toc_numbered toc_title_center\"><p class=\"toc_title\">\u0130\u00e7indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#SSH_agent_forwarding_nasil_calisir\"><span class=\"toc_number toc_depth_1\">1.<\/span> SSH agent forwarding nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/a><\/li><li><a href=\"#Hangi_erisim_modelini_secmelisiniz\"><span class=\"toc_number toc_depth_1\">2.<\/span> Hangi eri\u015fim modelini se\u00e7melisiniz?<\/a><ul><li><a href=\"#ProxyJump_ne_zaman_daha_uygundur\"><span class=\"toc_number toc_depth_2\">2.1.<\/span> ProxyJump ne zaman daha uygundur?<\/a><\/li><\/ul><\/li><li><a href=\"#Agent_forwarding_icin_on_kosullar\"><span class=\"toc_number toc_depth_1\">3.<\/span> Agent forwarding i\u00e7in \u00f6n ko\u015fullar<\/a><ul><li><a href=\"#Yerel_agent_ve_anahtar_kontrolu\"><span class=\"toc_number toc_depth_2\">3.1.<\/span> Yerel agent ve anahtar kontrol\u00fc<\/a><\/li><li><a href=\"#Yalnizca_hedef_VPS_icin_yapilandirma\"><span class=\"toc_number toc_depth_2\">3.2.<\/span> Yaln\u0131zca hedef VPS i\u00e7in yap\u0131land\u0131rma<\/a><\/li><\/ul><\/li><li><a href=\"#VPS_uzerinde_teshis_ve_dar_kapsamli_cozum\"><span class=\"toc_number toc_depth_1\">4.<\/span> VPS \u00fczerinde te\u015fhis ve dar kapsaml\u0131 \u00e7\u00f6z\u00fcm<\/a><ul><li><a href=\"#Git8217in_farkli_SSH_ayari_kullanmasini_engelleme\"><span class=\"toc_number toc_depth_2\">4.1.<\/span> Git&#8217;in farkl\u0131 SSH ayar\u0131 kullanmas\u0131n\u0131 engelleme<\/a><\/li><\/ul><\/li><li><a href=\"#Guvenlik_sinirlari_ve_risk_azaltma\"><span class=\"toc_number toc_depth_1\">5.<\/span> G\u00fcvenlik s\u0131n\u0131rlar\u0131 ve risk azaltma<\/a><\/li><li><a href=\"#Agent_forwarding_calismadiginda_kontrol_sirasi\"><span class=\"toc_number toc_depth_1\">6.<\/span> Agent forwarding \u00e7al\u0131\u015fmad\u0131\u011f\u0131nda kontrol s\u0131ras\u0131<\/a><\/li><li><a href=\"#Sik_Sorulan_Sorular\"><span class=\"toc_number toc_depth_1\">7.<\/span> S\u0131k Sorulan Sorular<\/a><ul><li><a href=\"#SSH_agent_forwarding_ozel_anahtari_VPS8217te_saklar_mi\"><span class=\"toc_number toc_depth_2\">7.1.<\/span> SSH agent forwarding \u00f6zel anahtar\u0131 VPS&#8217;te saklar m\u0131?<\/a><\/li><li><a href=\"#ForwardAgent_yes_ayari_tum_sunucular_icin_mi_gecerlidir\"><span class=\"toc_number toc_depth_2\">7.2.<\/span> ForwardAgent yes ayar\u0131 t\u00fcm sunucular i\u00e7in mi ge\u00e7erlidir?<\/a><\/li><li><a href=\"#VPS_uzerinde_calisan_cron_agent_forwarding_kullanabilir_mi\"><span class=\"toc_number toc_depth_2\">7.3.<\/span> VPS \u00fczerinde \u00e7al\u0131\u015fan cron agent forwarding kullanabilir mi?<\/a><\/li><li><a href=\"#ProxyJump_kullanirsam_VPS_uzerinde_git_clone_calisir_mi\"><span class=\"toc_number toc_depth_2\">7.4.<\/span> ProxyJump kullan\u0131rsam VPS \u00fczerinde git clone \u00e7al\u0131\u015f\u0131r m\u0131?<\/a><\/li><\/ul><\/li><li><a href=\"#Uygulanabilir_kontrol_listesi\"><span class=\"toc_number toc_depth_1\">8.<\/span> Uygulanabilir kontrol listesi<\/a><\/li><\/ul><\/div>\n<h2><span id=\"SSH_agent_forwarding_nasil_calisir\">SSH agent forwarding nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/span><\/h2>\n<p>SSH agent, \u00f6zel anahtar dosyas\u0131n\u0131 do\u011frudan kullanan de\u011fil, bu anahtarla yap\u0131lacak kriptografik imzalama i\u015flemlerini y\u00f6neten bir arka plan s\u00fcrecidir. Anahtar\u0131n\u0131z yerel bilgisayar\u0131n\u0131zdaki agent&#8217;a eklendi\u011finde SSH istemcisi, uzak ba\u011flant\u0131 i\u00e7in gereken imzalama taleplerini agent&#8217;a g\u00f6nderir.<\/p>\n<p>Forwarding etkin oldu\u011funda uzak oturumda genellikle <code>SSH_AUTH_SOCK<\/code> adl\u0131 ortam de\u011fi\u015fkeni g\u00f6r\u00fcn\u00fcr. Bu de\u011fi\u015fken, uzak sistemdeki ge\u00e7ici bir Unix soketini g\u00f6sterir. Soket \u00fczerinden g\u00f6nderilen imzalama talebi SSH ba\u011flant\u0131s\u0131 arac\u0131l\u0131\u011f\u0131yla yerel agent&#8217;a ta\u015f\u0131n\u0131r; imzal\u0131 yan\u0131t VPS&#8217;e d\u00f6ner.<\/p>\n<p>Bu ak\u0131\u015fta \u00f6zel anahtar\u0131n kendisi VPS&#8217;e kopyalanmaz. Ancak ele ge\u00e7irilmi\u015f veya k\u00f6t\u00fc ama\u00e7l\u0131 bir VPS, a\u00e7\u0131k SSH oturumu boyunca agent&#8217;a imzalama talepleri g\u00f6nderebilir. Anahtar\u0131 okuyamasa bile anahtar\u0131n\u0131z\u0131n yetkili oldu\u011fu Git hesab\u0131 ya da ba\u015fka bir servis ad\u0131na baz\u0131 i\u015flemleri tetiklemeye \u00e7al\u0131\u015fabilir.<\/p>\n<div class=\"aiw-note aiw-note-warning\">\n<p class=\"aiw-box-title\">Dikkat<\/p>\n<p>Agent forwarding, g\u00fcvenilmeyen sunucuya \u00f6zel anahtar vermemenizi sa\u011flar; g\u00fcvenilmeyen sunucudan g\u00fcvenli \u015fekilde i\u015flem yapman\u0131z\u0131 garanti etmez. Yaln\u0131zca y\u00f6netti\u011finiz, g\u00fcncel tuttu\u011funuz ve eri\u015fim s\u0131n\u0131rlar\u0131n\u0131 bildi\u011finiz VPS&#8217;lerde kullan\u0131n.<\/p>\n<\/div>\n<h2><span id=\"Hangi_erisim_modelini_secmelisiniz\">Hangi eri\u015fim modelini se\u00e7melisiniz?<\/span><\/h2>\n<p>Karar, Git i\u015fleminin nerede \u00e7al\u0131\u015faca\u011f\u0131na ba\u011fl\u0131d\u0131r. VPS yaln\u0131zca ba\u011flant\u0131 i\u00e7in bir s\u0131\u00e7rama noktas\u0131ysa <code>ProxyJump<\/code> \u00e7o\u011fu zaman daha dar bir modeldir. Git komutunu kendi bilgisayar\u0131n\u0131zda \u00e7al\u0131\u015ft\u0131r\u0131rs\u0131n\u0131z; SSH ba\u011flant\u0131s\u0131 VPS \u00fczerinden hedef Git sunucusuna ula\u015f\u0131r. VPS&#8217;e agent soketi a\u00e7\u0131lmaz ve VPS&#8217;in Git hesab\u0131n\u0131z ad\u0131na imza istemesi gerekmez.<\/p>\n<p>Git komutu ger\u00e7ekten VPS \u00fczerinde \u00e7al\u0131\u015facaksa, \u00f6rne\u011fin sunucudaki bir deploy beti\u011fi <code>git fetch<\/code> veya <code>git clone<\/code> \u00e7al\u0131\u015ft\u0131r\u0131yorsa, iki yayg\u0131n se\u00e7enek vard\u0131r:<\/p>\n<ul>\n<li><strong>Agent forwarding:<\/strong> Yerel agent ge\u00e7ici olarak kullan\u0131l\u0131r. \u00d6zel anahtar VPS&#8217;e konmaz; buna kar\u015f\u0131l\u0131k a\u00e7\u0131k oturum s\u00fcresince forwarding tehdidi kabul edilir.<\/li>\n<li><strong>Deploy key veya ayr\u0131 makine kimli\u011fi:<\/strong> VPS i\u00e7in ayr\u0131 ve s\u0131n\u0131rl\u0131 yetkili bir anahtar olu\u015fturulur. Kimlik sunucuda saklan\u0131r; eri\u015fim kapsam\u0131 ve rotasyonu ayr\u0131ca y\u00f6netilir.<\/li>\n<\/ul>\n<p>Tek seferlik bak\u0131m veya kontroll\u00fc bir da\u011f\u0131t\u0131m oturumunda agent forwarding pratik olabilir. S\u00fcrekli \u00e7al\u0131\u015fan otomasyonlarda ise ki\u015fisel anahtar\u0131n\u0131z\u0131 y\u00f6nlendirmek yerine yaln\u0131zca ilgili depo i\u00e7in s\u0131n\u0131rland\u0131r\u0131lm\u0131\u015f bir makine kimli\u011fi daha \u00f6ng\u00f6r\u00fclebilir bir modeldir. Kullanaca\u011f\u0131n\u0131z Git hizmetinin salt okunur veya depo kapsaml\u0131 anahtar se\u00e7eneklerini kendi belgelerinden do\u011frulay\u0131n.<\/p>\n<p>Ekipte birden fazla ki\u015finin eri\u015fti\u011fi sistemlerde <strong>SSH Anahtar Y\u00f6netimi ve Yetki Payla\u015f\u0131m\u0131<\/strong> yakla\u015f\u0131m\u0131n\u0131 ayr\u0131ca de\u011ferlendirin. Buradaki <strong><a href=\"https:\/\/www.dchost.com\/blog\/ssh-anahtar-yonetimi-ve-yetki-paylasimi-kucuk-ekipler-icin-guvenli-vps-erisimi\/\">anahtar y\u00f6netimi ve yetki payla\u015f\u0131m\u0131<\/a><\/strong> yakla\u015f\u0131m\u0131, eri\u015fimin ki\u015fisel anahtarlar ve payla\u015f\u0131lan hesaplar yerine kimlik, kapsam ve rotasyon kurallar\u0131yla tasarlanmas\u0131na yard\u0131mc\u0131 olur.<\/p>\n<h3><span id=\"ProxyJump_ne_zaman_daha_uygundur\">ProxyJump ne zaman daha uygundur?<\/span><\/h3>\n<p>Yerel bilgisayar\u0131n\u0131zdaki Git istemcisi hedef depoya ba\u011flanabiliyorsa, SSH yap\u0131land\u0131rmas\u0131nda <code>ProxyJump<\/code> kullanarak VPS&#8217;i yaln\u0131zca a\u011f ge\u00e7idi yapabilirsiniz. <code>ProxyJump<\/code>, OpenSSH istemcisinin destekledi\u011fi bir \u00f6zelliktir; istemci s\u00fcr\u00fcm\u00fcn\u00fcz\u00fc <code>ssh -V<\/code> ile kontrol edin. \u00d6rnek olarak yerel <code>~\/.ssh\/config<\/code> dosyan\u0131zda \u015fu yap\u0131 bulunabilir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">Host vps-bastion\n    HostName vps.example.net\n    User deploy\n    IdentityFile ~\/.ssh\/id_ed25519\n    IdentitiesOnly yes\n\nHost git-through-vps\n    HostName git.example.com\n    User git\n    ProxyJump vps-bastion\n    IdentityFile ~\/.ssh\/id_ed25519\n    IdentitiesOnly yes<\/code><\/pre>\n<p>Burada <code>git-through-vps<\/code> takma ad\u0131 yerel Git istemcisi taraf\u0131ndan kullan\u0131labilir. Git i\u015flemi VPS \u00fczerinde de\u011fil, sizin bilgisayar\u0131n\u0131zda ger\u00e7ekle\u015fir. <code>ProxyJump<\/code> ba\u011flant\u0131 yolunu de\u011fi\u015ftirir; tek ba\u015f\u0131na uzak VPS shell&#8217;ine agent soketi sunmaz.<\/p>\n<p>Bu y\u00f6ntemi kullan\u0131rken hedef Git sunucusunun host anahtar\u0131n\u0131 yerel <code>known_hosts<\/code> dosyan\u0131zda do\u011frulay\u0131n. Arac\u0131 VPS&#8217;in host anahtar\u0131n\u0131 do\u011frulamak, hedef Git sunucusunun kimli\u011fini do\u011frulad\u0131\u011f\u0131n\u0131z anlam\u0131na gelmez.<\/p>\n<h2><span id=\"Agent_forwarding_icin_on_kosullar\">Agent forwarding i\u00e7in \u00f6n ko\u015fullar<\/span><\/h2>\n<p>Kuruluma ba\u015flamadan \u00f6nce \u00fc\u00e7 noktay\u0131 kontrol edin: yerel agent \u00e7al\u0131\u015f\u0131yor mu, do\u011fru anahtar agent&#8217;a ekli mi ve SSH istemcisi yaln\u0131zca hedef VPS i\u00e7in forwarding yap\u0131yor mu? OpenSSH istemcisi ile sunucusunun s\u00fcr\u00fcm\u00fcn\u00fc de kontrol edin; desteklenen yap\u0131land\u0131rma se\u00e7enekleri da\u011f\u0131t\u0131ma ve s\u00fcr\u00fcme g\u00f6re de\u011fi\u015febilir.<\/p>\n<h3><span id=\"Yerel_agent_ve_anahtar_kontrolu\">Yerel agent ve anahtar kontrol\u00fc<\/span><\/h3>\n<p>Linux veya macOS \u00fczerinde mevcut agent soketini ve y\u00fckl\u00fc kimlikleri \u015fu komutlarla kontrol edebilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh -V\necho &quot;$SSH_AUTH_SOCK&quot;\nssh-add -l<\/code><\/pre>\n<p><code>ssh-add -l<\/code> bir anahtar listesi d\u00f6nd\u00fcr\u00fcyorsa agent&#8217;a en az bir kimlik y\u00fcklenmi\u015ftir. Liste bo\u015fsa, kullanaca\u011f\u0131n\u0131z anahtar\u0131 agent&#8217;a ekleyin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh-add ~\/.ssh\/id_ed25519\nssh-add -l<\/code><\/pre>\n<p>Dosya ad\u0131n\u0131 kendi anahtar\u0131n\u0131zla de\u011fi\u015ftirin. Komut \u00f6zel anahtar\u0131n i\u00e7eri\u011fini ekrana yazd\u0131rmaz; i\u015fletim sisteminiz veya anahtar\u0131n\u0131z parola korumal\u0131ysa sizden bu parolay\u0131 isteyebilir. Windows&#8217;ta OpenSSH agent, WSL veya kulland\u0131\u011f\u0131n\u0131z SSH istemcisinin agent uygulamas\u0131 farkl\u0131 \u00e7al\u0131\u015fabilir. Ayn\u0131 kontrol\u00fcn kar\u015f\u0131l\u0131\u011f\u0131n\u0131 kulland\u0131\u011f\u0131n\u0131z ortam\u0131n terminalinde yap\u0131n.<\/p>\n<p>Agent&#8217;ta \u00e7ok say\u0131da kimlik varsa SSH sunucusu gere\u011finden fazla anahtar deneyebilir ve Git hizmetinin kimlik do\u011frulama s\u0131n\u0131rlar\u0131na tak\u0131labilir. Bu durumda SSH yap\u0131land\u0131rmas\u0131nda <code>IdentitiesOnly yes<\/code> kullanmak, ilgili ba\u011flant\u0131daki kimlik se\u00e7imini daralt\u0131r; agent forwarding&#8217;i kapatmaz.<\/p>\n<h3><span id=\"Yalnizca_hedef_VPS_icin_yapilandirma\">Yaln\u0131zca hedef VPS i\u00e7in yap\u0131land\u0131rma<\/span><\/h3>\n<p>Forwarding&#8217;i t\u00fcm SSH ba\u011flant\u0131lar\u0131na a\u00e7mak yerine belirli bir host takma ad\u0131na ba\u011flay\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">Host git-deploy-vps\n    HostName vps.example.net\n    User deploy\n    ForwardAgent yes\n    IdentityFile ~\/.ssh\/id_ed25519\n    IdentitiesOnly yes<\/code><\/pre>\n<p>Bu \u00f6rnekte <code>git-deploy-vps<\/code> yaln\u0131zca bir SSH takma ad\u0131d\u0131r. <code>Host *<\/code> alt\u0131nda <code>ForwardAgent yes<\/code> tan\u0131mlamak, yanl\u0131\u015fl\u0131kla ba\u011fland\u0131\u011f\u0131n\u0131z her sunucuya agent soketini a\u00e7abilir. Mevcut ayarlar\u0131n hangi s\u0131rayla uyguland\u0131\u011f\u0131n\u0131 g\u00f6rmek i\u00e7in yerel bilgisayar\u0131n\u0131zda \u015fu te\u015fhis komutunu kullan\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh -G git-deploy-vps | grep -Ei &#039;forwardagent|hostname|user|identityfile|identitiesonly&#039;<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131da <code>forwardagent yes<\/code>, bekledi\u011finiz host ad\u0131, kullan\u0131c\u0131 ve kimlik ayarlar\u0131n\u0131 g\u00f6rmelisiniz. Bu komut ba\u011flant\u0131 kurmaz ve ayarlar\u0131 de\u011fi\u015ftirmez.<\/p>\n<div class=\"aiw-note aiw-note-example\">\n<p class=\"aiw-box-title\">\u00d6rnek senaryo<\/p>\n<p>Varsayal\u0131m yerel geli\u015ftirici bilgisayar\u0131n\u0131zda <code>~\/.ssh\/id_ed25519_work<\/code> adl\u0131, yaln\u0131zca \u015firket deposuna eri\u015fen bir anahtar var ve <code>deploy<\/code> kullan\u0131c\u0131l\u0131 VPS her da\u011f\u0131t\u0131mda kodu \u00e7ekiyor. Bu senaryoda forwarding yaln\u0131zca <code>git-deploy-vps<\/code> takma ad\u0131na a\u00e7\u0131l\u0131r; ki\u015fisel anahtar\u0131n tamam\u0131 VPS&#8217;e kopyalanmaz ve ba\u015fka sunuculara ba\u011flan\u0131rken forwarding devreye girmez.<\/p>\n<\/div>\n<h2><span id=\"VPS_uzerinde_teshis_ve_dar_kapsamli_cozum\">VPS \u00fczerinde te\u015fhis ve dar kapsaml\u0131 \u00e7\u00f6z\u00fcm<\/span><\/h2>\n<p>\u00d6n ko\u015fullar sa\u011fland\u0131ktan sonra VPS&#8217;e takma ad \u00fczerinden ba\u011flan\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh git-deploy-vps<\/code><\/pre>\n<p>\u0130lk te\u015fhis, uzak oturumda agent soketinin g\u00f6r\u00fcn\u00fcp g\u00f6r\u00fcnmedi\u011fini kontrol etmektir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">printf &#039;%s\\n&#039; &quot;$SSH_AUTH_SOCK&quot;\nssh-add -l<\/code><\/pre>\n<p><code>SSH_AUTH_SOCK<\/code> bo\u015fsa veya <code>ssh-add -l<\/code> agent&#8217;a ba\u011flanamad\u0131\u011f\u0131n\u0131 bildiriyorsa forwarding etkin de\u011fildir, SSH ba\u011flant\u0131s\u0131 forwarding&#8217;i kabul etmemi\u015ftir ya da uzak oturumun ortam\u0131 soketi ta\u015f\u0131mam\u0131\u015ft\u0131r. Bu a\u015famada sunucuya anahtar kopyalamay\u0131n. \u00d6nce yerel yap\u0131land\u0131rmay\u0131 ve sunucunun SSH daemon ayar\u0131n\u0131 kontrol edin.<\/p>\n<p>Sunucuda SSH daemon yap\u0131land\u0131rmas\u0131nda <code>AllowAgentForwarding<\/code> de\u011ferinin forwarding&#8217;i engellemedi\u011fini yetkili y\u00f6netici kontrol etmelidir. De\u011fi\u015fiklik yapman\u0131z gerekiyorsa \u00f6nce mevcut dosyan\u0131n yede\u011fini al\u0131n ve geri d\u00f6n\u00fc\u015f komutunu belirleyin. \u00d6rne\u011fin Linux sistemlerde de\u011fi\u015fiklikten sonra, da\u011f\u0131t\u0131m\u0131n\u0131z\u0131n kulland\u0131\u011f\u0131 dosyay\u0131 belirterek yap\u0131land\u0131rmay\u0131 test edebilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">sudo sshd -t -f \/etc\/ssh\/sshd_config<\/code><\/pre>\n<p>Test ba\u015far\u0131l\u0131 olmadan SSH servisini yeniden y\u00fcklemeyin. Yeniden y\u00fckleme y\u00f6ntemi da\u011f\u0131t\u0131ma ve servis y\u00f6neticisine g\u00f6re de\u011fi\u015febilece\u011fi i\u00e7in sisteminizin belgelenen komutunu kullan\u0131n. De\u011fi\u015fiklik ba\u011flant\u0131y\u0131 bozarsa mevcut dosyay\u0131 yede\u011finden geri y\u00fckleyip servis yap\u0131land\u0131rmas\u0131n\u0131 yeniden test edin. \u0130htiya\u00e7 yoksa ba\u015fka kimlik do\u011frulama veya a\u011f ayarlar\u0131n\u0131 ayn\u0131 de\u011fi\u015fiklikte de\u011fi\u015ftirmeyin.<\/p>\n<p>Forwarding sunucuda g\u00f6r\u00fcn\u00fcr hale geldikten sonra Git kimlik do\u011frulamas\u0131n\u0131 SSH katman\u0131nda test edin. \u00d6rne\u011fin hedef Git hizmetinizin SSH kullan\u0131c\u0131 ad\u0131 <code>git<\/code> ve host ad\u0131 <code>git.example.com<\/code> ise:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh -T git&#64;git.example.com<\/code><\/pre>\n<p>\u0130lk ba\u011flant\u0131da host anahtar\u0131 do\u011frulamas\u0131 istenebilir. Parmak izini ba\u011f\u0131ms\u0131z ve g\u00fcvenilir bir kanaldan do\u011frulamadan kabul etmeyin. Ba\u015far\u0131l\u0131 kimlik do\u011frulama mesaj\u0131 servis sa\u011flay\u0131c\u0131ya g\u00f6re de\u011fi\u015fir; shell a\u00e7\u0131lmamas\u0131 tek ba\u015f\u0131na ba\u015far\u0131s\u0131zl\u0131k anlam\u0131na gelmeyebilir.<\/p>\n<p>Sonra belirli bir deponun eri\u015fimini, veri indirmeden metadata sorgulayarak test edin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">git ls-remote git&#64;git.example.com:ekip\/proje.git<\/code><\/pre>\n<p>Bu komut referanslar\u0131 listeler. Ba\u015far\u0131l\u0131 olursa SSH kimli\u011fi, depo yolu ve eri\u015fim yetkisi birlikte \u00e7al\u0131\u015f\u0131yor demektir. <code>Permission denied (publickey)<\/code> al\u0131rsan\u0131z \u00f6nce hangi anahtarlar\u0131n denendi\u011fini ayr\u0131nt\u0131l\u0131 SSH \u00e7\u0131kt\u0131s\u0131yla inceleyin:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh -vT git&#64;git.example.com<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131da \u00f6zel anahtar i\u00e7eri\u011fi g\u00f6r\u00fcnmez; fakat sunucunun agent kullan\u0131p kullanmad\u0131\u011f\u0131 ve kimlik do\u011frulama ad\u0131mlar\u0131 hakk\u0131nda bilgi bulunabilir. Sorun \u00e7\u00f6z\u00fcld\u00fckten sonra ayr\u0131nt\u0131l\u0131 g\u00fcnl\u00fckleri payla\u015f\u0131rken kullan\u0131c\u0131 adlar\u0131n\u0131, host adlar\u0131n\u0131 ve yol bilgilerini gereksiz yere a\u00e7\u0131k etmeyin.<\/p>\n<h3><span id=\"Git8217in_farkli_SSH_ayari_kullanmasini_engelleme\">Git&#8217;in farkl\u0131 SSH ayar\u0131 kullanmas\u0131n\u0131 engelleme<\/span><\/h3>\n<p>Shell \u00fczerinde <code>ssh<\/code> komutu ba\u015far\u0131l\u0131yken Git ba\u015far\u0131s\u0131zsa Git&#8217;in farkl\u0131 bir istemci veya yap\u0131land\u0131rma kulland\u0131\u011f\u0131n\u0131 kontrol edin. Bu kontrol\u00fc <code>git<\/code> komutunun \u00e7al\u0131\u015ft\u0131\u011f\u0131 ortamda, yani \u00f6rne\u011fin VPS \u00fczerindeki depo dizininde yap\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">git config --show-origin --get core.sshCommand\nenv | grep &#039;^GIT_SSH&#039;<\/code><\/pre>\n<p>Tan\u0131ml\u0131 bir <code>core.sshCommand<\/code> varsa forwarding&#8217;i devre d\u0131\u015f\u0131 b\u0131rakan ayr\u0131 bir ayar kullan\u0131yor olabilir. En dar d\u00fczeltme, yaln\u0131zca ilgili depo i\u00e7in do\u011fru SSH komutunu se\u00e7mektir. \u00d6rne\u011fin Git i\u015flemi VPS \u00fczerinde \u00e7al\u0131\u015f\u0131yorsa, VPS \u00fczerindeki depo dizininde \u015fu ayar kullan\u0131labilir:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">git config core.sshCommand &quot;ssh -F ~\/.ssh\/config&quot;<\/code><\/pre>\n<p>Bu komut, Git&#8217;in ilgili ortamda kullan\u0131lan standart SSH yap\u0131land\u0131rma dosyas\u0131n\u0131 se\u00e7mesini sa\u011flar. Kurumunuzda farkl\u0131 bir SSH istemcisi gerekiyorsa bu de\u011feri rastgele silmek yerine mevcut standarda g\u00f6re d\u00fczenleyin. De\u011fi\u015fiklikten sonra ayn\u0131 depo i\u00e7inde <code>git ls-remote<\/code> komutunu yeniden \u00e7al\u0131\u015ft\u0131rarak sonucu do\u011frulay\u0131n.<\/p>\n<h2><span id=\"Guvenlik_sinirlari_ve_risk_azaltma\">G\u00fcvenlik s\u0131n\u0131rlar\u0131 ve risk azaltma<\/span><\/h2>\n<p>Agent forwarding&#8217;in temel riski, \u00f6zel anahtar\u0131n okunmas\u0131 de\u011fil, agent&#8217;\u0131n imza yetkisinin oturum s\u00fcresince kullan\u0131labilmesidir. K\u00f6t\u00fc ama\u00e7l\u0131 bir s\u00fcre\u00e7, VPS&#8217;teki <code>SSH_AUTH_SOCK<\/code> de\u011ferini kullanarak agent&#8217;a imza talepleri g\u00f6nderebilir. Bunun etkisi anahtar\u0131n yetkilerine, Git hesab\u0131n\u0131n eri\u015fim kapsam\u0131na ve ba\u011flant\u0131n\u0131n a\u00e7\u0131k kald\u0131\u011f\u0131 s\u00fcreye ba\u011fl\u0131d\u0131r.<\/p>\n<p>Bu nedenle ki\u015fisel, geni\u015f yetkili veya birden fazla \u00fcretim sistemine eri\u015fen anahtarlar\u0131 forwarding ile kullanmay\u0131n. \u0130\u015f i\u00e7in ayr\u0131 bir anahtar olu\u015fturun, m\u00fcmk\u00fcnse yaln\u0131zca gerekli depo veya ortama yetki verin ve i\u015f bitti\u011finde agent&#8217;tan kald\u0131r\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">ssh-add -d ~\/.ssh\/id_ed25519_work\nssh-add -l<\/code><\/pre>\n<p>Agent&#8217;taki t\u00fcm kimlikleri kald\u0131rmak gerekiyorsa <code>ssh-add -D<\/code> komutu kullan\u0131labilir; bu komut di\u011fer projelerin kimliklerini de kald\u0131r\u0131r. Bu y\u00fczden payla\u015f\u0131lan \u00e7al\u0131\u015fma ortamlar\u0131nda komutu uygulamadan \u00f6nce aktif oturumlar\u0131n etkilenip etkilenmeyece\u011fini kontrol edin.<\/p>\n<p>Yeni OpenSSH s\u00fcr\u00fcmleri, desteklenen agent uygulamalar\u0131nda hedef k\u0131s\u0131tlamalar\u0131 gibi daha geli\u015fmi\u015f kontroller sunabilir. Bu \u00f6zelliklerin istemci, agent ve anahtar t\u00fcr\u00fc taraf\u0131ndan desteklendi\u011fini do\u011frulamadan g\u00fcvenlik s\u0131n\u0131r\u0131 olarak kabul etmeyin. Daha temel ve ta\u015f\u0131nabilir \u00f6nlem, forwarding&#8217;i tek host ile s\u0131n\u0131rlamak ve ayr\u0131, d\u00fc\u015f\u00fck yetkili bir anahtar kullanmakt\u0131r.<\/p>\n<p>SSH anahtarlar\u0131n\u0131n rotasyonu, dosya izinleri ve ekip eri\u015fimleri i\u00e7in <strong><a href=\"https:\/\/www.dchost.com\/blog\/vpste-ssh-guvenligi-nasil-saglamlasir-fido2-anahtarlari-ssh-ca\/\">VPS SSH g\u00fcvenli\u011fi<\/a><\/strong> ba\u015fl\u0131\u011f\u0131ndaki FIDO2, SSH CA ve rotasyon se\u00e7eneklerini de inceleyebilirsiniz. Agent forwarding, anahtar y\u00f6netiminin yerini tutmaz; yaln\u0131zca \u00f6zel anahtar\u0131 belirli bir ba\u011flant\u0131da sunucuya kopyalamadan kullanma y\u00f6ntemidir.<\/p>\n<div class=\"aiw-note aiw-note-tip\">\n<p class=\"aiw-box-title\">\u0130pucu<\/p>\n<p>Da\u011f\u0131t\u0131m beti\u011fini elle ba\u015flatt\u0131\u011f\u0131n\u0131z SSH oturumundan ay\u0131r\u0131n. S\u00fcrekli otomasyonun yerel agent&#8217;a ve geli\u015ftiricinin a\u00e7\u0131k ba\u011flant\u0131s\u0131na ba\u011fl\u0131 kalmas\u0131, oturum kapand\u0131\u011f\u0131nda da\u011f\u0131t\u0131m\u0131n \u00e7al\u0131\u015fmamas\u0131 gibi operasyonel bir sorun olu\u015fturur. Kal\u0131c\u0131 ak\u0131\u015f i\u00e7in ayr\u0131 makine kimli\u011fi, CI\/CD secret mekanizmas\u0131 veya depo kapsaml\u0131 deploy anahtar\u0131 de\u011ferlendirin.<\/p>\n<\/div>\n<h2><span id=\"Agent_forwarding_calismadiginda_kontrol_sirasi\">Agent forwarding \u00e7al\u0131\u015fmad\u0131\u011f\u0131nda kontrol s\u0131ras\u0131<\/span><\/h2>\n<ol>\n<li><strong>Yereli kontrol edin:<\/strong> <code>ssh-add -l<\/code> ile do\u011fru anahtar\u0131n agent&#8217;ta oldu\u011funu ve <code>echo \"$SSH_AUTH_SOCK\"<\/code> ile yerel soketin bulundu\u011funu do\u011frulay\u0131n.<\/li>\n<li><strong>SSH ayar\u0131n\u0131 kontrol edin:<\/strong> <code>ssh -G git-deploy-vps<\/code> \u00e7\u0131kt\u0131s\u0131nda <code>ForwardAgent yes<\/code>, do\u011fru kullan\u0131c\u0131 ve do\u011fru host ad\u0131n\u0131 aray\u0131n.<\/li>\n<li><strong>Uzak soketi kontrol edin:<\/strong> VPS oturumunda <code>SSH_AUTH_SOCK<\/code> bo\u015f mu, <code>ssh-add -l<\/code> agent&#8217;a eri\u015febiliyor mu bak\u0131n.<\/li>\n<li><strong>Host anahtar\u0131n\u0131 ay\u0131r\u0131n:<\/strong> Git hizmetinin host anahtar\u0131 <code>known_hosts<\/code> i\u00e7inde do\u011frulanm\u0131\u015f m\u0131 kontrol edin.<\/li>\n<li><strong>SSH katman\u0131n\u0131 test edin:<\/strong> <code>ssh -vT<\/code> ile kimlik do\u011frulama ak\u0131\u015f\u0131n\u0131 inceleyin; ard\u0131ndan <code>git ls-remote<\/code> ile depo yetkisini s\u0131nay\u0131n.<\/li>\n<li><strong>Git ayar\u0131n\u0131 inceleyin:<\/strong> <code>core.sshCommand<\/code> veya <code>GIT_SSH<\/code> de\u011fi\u015fkeninin beklenmeyen bir istemci ve config kullanmad\u0131\u011f\u0131ndan emin olun.<\/li>\n<\/ol>\n<p>Sunucuda agent soketi g\u00f6r\u00fcnm\u00fcyorsa ve sunucu yap\u0131land\u0131rmas\u0131n\u0131 de\u011fi\u015ftirme yetkiniz yoksa forwarding&#8217;i zorlamak yerine sistem y\u00f6neticisinden <code>AllowAgentForwarding<\/code> politikas\u0131n\u0131 do\u011frulamas\u0131n\u0131 isteyin. Ba\u015far\u0131s\u0131z denemeler s\u0131ras\u0131nda anahtar\u0131 sunucuya kopyalamak, te\u015fhis edilmemi\u015f yap\u0131land\u0131rma sorununu kal\u0131c\u0131 bir gizli anahtar riskine d\u00f6n\u00fc\u015ft\u00fcr\u00fcr.<\/p>\n<h2><span id=\"Sik_Sorulan_Sorular\">S\u0131k Sorulan Sorular<\/span><\/h2>\n<h3><span id=\"SSH_agent_forwarding_ozel_anahtari_VPS8217te_saklar_mi\">SSH agent forwarding \u00f6zel anahtar\u0131 VPS&#8217;te saklar m\u0131?<\/span><\/h3>\n<p>Hay\u0131r. Normal ak\u0131\u015fta \u00f6zel anahtar dosyas\u0131 VPS&#8217;e aktar\u0131lmaz. Ancak VPS, a\u00e7\u0131k forwarding oturumu s\u0131ras\u0131nda agent&#8217;a imza iste\u011fi g\u00f6nderebilir; bu y\u00fczden y\u00f6ntem g\u00fcvenilmeyen sunucular i\u00e7in uygun de\u011fildir.<\/p>\n<h3><span id=\"ForwardAgent_yes_ayari_tum_sunucular_icin_mi_gecerlidir\">ForwardAgent yes ayar\u0131 t\u00fcm sunucular i\u00e7in mi ge\u00e7erlidir?<\/span><\/h3>\n<p>Yaln\u0131zca tan\u0131mland\u0131\u011f\u0131 host kapsam\u0131na uygulan\u0131r. <code>Host *<\/code> alt\u0131nda kullan\u0131rsan\u0131z kapsam geni\u015fler. Daha g\u00fcvenli tercih, forwarding&#8217;i belirli bir takma ad\u0131n alt\u0131nda tan\u0131mlamakt\u0131r.<\/p>\n<h3><span id=\"VPS_uzerinde_calisan_cron_agent_forwarding_kullanabilir_mi\">VPS \u00fczerinde \u00e7al\u0131\u015fan cron agent forwarding kullanabilir mi?<\/span><\/h3>\n<p>Genellikle hay\u0131r. Cron, etkile\u015fimli SSH oturumunun ortam\u0131n\u0131 ve agent soketini kendili\u011finden devralmaz. Ayr\u0131ca cron ile \u00e7al\u0131\u015fan CLI i\u015fi, PHP-FPM web i\u015f\u00e7ilerinden ayr\u0131 bir s\u00fcre\u00e7tir; agent soketi a\u00e7\u0131k oturumdan ayr\u0131ca aktar\u0131lmad\u0131k\u00e7a bu i\u015fin forwarding&#8217;e eri\u015fimi olmaz. S\u00fcrekli bir i\u015f i\u00e7in yerel bilgisayar\u0131n a\u00e7\u0131k oturumuna ba\u011f\u0131ml\u0131 olmak da g\u00fcvenilir de\u011fildir. Otomasyon i\u00e7in ayr\u0131 bir makine kimli\u011fi tasarlay\u0131n.<\/p>\n<h3><span id=\"ProxyJump_kullanirsam_VPS_uzerinde_git_clone_calisir_mi\">ProxyJump kullan\u0131rsam VPS \u00fczerinde git clone \u00e7al\u0131\u015f\u0131r m\u0131?<\/span><\/h3>\n<p>Hay\u0131r. <code>ProxyJump<\/code>, yerel SSH istemcinizin hedefe VPS \u00fczerinden ula\u015fmas\u0131n\u0131 sa\u011flar. <code>git clone<\/code> komutunu VPS \u00fczerinde \u00e7al\u0131\u015ft\u0131rmak istiyorsan\u0131z VPS&#8217;in kendi kimlik do\u011frulama y\u00f6ntemine ihtiya\u00e7 duyars\u0131n\u0131z.<\/p>\n<h2><span id=\"Uygulanabilir_kontrol_listesi\">Uygulanabilir kontrol listesi<\/span><\/h2>\n<ul>\n<li>Git i\u015fleminin yerelde mi, VPS \u00fczerinde mi \u00e7al\u0131\u015faca\u011f\u0131na karar verin.<\/li>\n<li>Yaln\u0131zca arac\u0131 ba\u011flant\u0131 gerekiyorsa <code>ProxyJump<\/code>&#8216;\u0131 agent forwarding&#8217;e tercih edin.<\/li>\n<li>Forwarding gerekiyorsa ayr\u0131 ve d\u00fc\u015f\u00fck yetkili bir SSH anahtar\u0131 kullan\u0131n.<\/li>\n<li><code>ForwardAgent yes<\/code> ayar\u0131n\u0131 yaln\u0131zca tek bir VPS host takma ad\u0131na yaz\u0131n.<\/li>\n<li>Yerel agent, uzak <code>SSH_AUTH_SOCK<\/code>, SSH kimlik do\u011frulamas\u0131 ve <code>git ls-remote<\/code> ad\u0131mlar\u0131n\u0131 s\u0131rayla do\u011frulay\u0131n.<\/li>\n<li>\u0130\u015f bittikten sonra ge\u00e7ici kimli\u011fi agent&#8217;tan kald\u0131r\u0131n.<\/li>\n<li>Kal\u0131c\u0131 deploy ak\u0131\u015f\u0131nda ki\u015fisel agent yerine depo kapsaml\u0131 makine kimli\u011fi veya CI\/CD secret modeli planlay\u0131n.<\/li>\n<\/ul>\n<p>Bir sonraki ad\u0131m\u0131n\u0131z, mevcut deploy komutunun nerede \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 netle\u015ftirmek olmal\u0131. Komut VPS&#8217;te \u00e7al\u0131\u015f\u0131yorsa forwarding&#8217;i k\u0131sa s\u00fcreli ve dar kapsaml\u0131 bir \u00e7\u00f6z\u00fcm olarak uygulay\u0131n; d\u00fczenli otomasyonsa anahtar kapsam\u0131n\u0131 ve rotasyonunu ayr\u0131 bir makine kimli\u011fiyle tasarlay\u0131n.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>\u00d6zel SSH anahtar\u0131n\u0131 VPS&#8217;e kopyalamadan Git deposuna eri\u015fmek i\u00e7in agent forwarding&#8217;i nas\u0131l kuraca\u011f\u0131n\u0131z\u0131, s\u0131n\u0131rlar\u0131n\u0131 ve ProxyJump alternatifini \u00f6\u011frenin.<\/p>\n","protected":false},"author":4,"featured_media":5760,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[602,601,600,227,95],"class_list":["post-5764","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nasil-yapilir","tag-agent-forwarding","tag-git","tag-ssh","tag-sunucu-guvenligi","tag-vps"],"_links":{"self":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/comments?post=5764"}],"version-history":[{"count":1,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5764\/revisions"}],"predecessor-version":[{"id":5766,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5764\/revisions\/5766"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media\/5760"}],"wp:attachment":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media?parent=5764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/categories?post=5764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/tags?post=5764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}