{"id":18476,"date":"2021-05-03T09:00:03","date_gmt":"2021-05-03T06:00:03","guid":{"rendered":"http:\/\/dev.profelis.net\/?p=18476"},"modified":"2023-02-01T10:57:59","modified_gmt":"2023-02-01T07:57:59","slug":"postgresql-icin-en-iyi-guvenlik-uygulamalari","status":"publish","type":"post","link":"https:\/\/profelis.com.tr\/en\/2021\/05\/03\/postgresql-icin-en-iyi-guvenlik-uygulamalari\/","title":{"rendered":"PostgreSQL i\u00e7in En \u0130yi G\u00fcvenlik Uygulamalar\u0131"},"content":{"rendered":"<p><strong style=\"color: #000000; font-size: 20px;\">1. \u00d6zet<\/strong><br \/>\n<span style=\"color: #000000;\">Bu teknik inceleme raporu, PostgreSQL veritaban\u0131n\u0131 g\u00fcvenli\u011fini sa\u011flamak ve korumak i\u00e7in bir \u00e7er\u00e7eve ve bir dizi \u00f6neri sunmaktad\u0131r. Fiziksel g\u00fcvenli\u011fi, a\u011f g\u00fcvenli\u011fini, sunucu eri\u015fim kontrol\u00fcn\u00fc, veritaban\u0131 eri\u015fim y\u00f6netimini ve veri g\u00fcvenli\u011fini ele alan katmanl\u0131 bir g\u00fcvenlik modelinden s\u00f6z etmekteyiz. Her ne kadar t\u00fcm bu \u00f6zellikler e\u015fit derecede \u00f6nemli olsa da bu raporda, PostgreSQL&#8217;e \u00f6zel olan veritaban\u0131 ve veri g\u00fcvenli\u011fi \u00f6zelliklerine odaklan\u0131lm\u0131\u015ft\u0131r. Veritaban\u0131yla ilgili belirli g\u00fcvenlik konular\u0131 ve veritaban\u0131nda y\u00f6netilen veriler hakk\u0131nda yapt\u0131\u011f\u0131m\u0131z tart\u0131\u015fmada, bilgisayar ve a\u011f g\u00fcvenli\u011fi i\u00e7in yayg\u0131n bir AAA (Kimlik Do\u011frulama, Yetkilendirme ve Denetleme) yakla\u015f\u0131m\u0131 kullanmaktay\u0131z.<\/span><\/p>\n<p style=\"color: #000000;\">Bu teknik inceleme raporundaki \u00f6nerilerin \u00e7o\u011fu PostgreSQL (topluluk s\u00fcr\u00fcm\u00fc) ve PostgreSQL&#8217;in kurumsal s\u0131n\u0131f, \u00f6zellik a\u00e7\u0131s\u0131ndan zengin ticari da\u011f\u0131t\u0131m\u0131 olan EnterpriseDB \u00ae &#8216;nin (EDBTM) EDB PostgresTM Advanced Server i\u00e7in ge\u00e7erlidir. PostgreSQL&#8217;de ayn\u0131 \u015fekilde bulunmayan Parola Profilleri, Denetleme, Veri Azaltma ve SQL Server Enjeksiyon Korumas\u0131 gibi ek g\u00fcvenlik geli\u015ftirmelerini Advanced Server sa\u011flar.<\/p>\n<p style=\"color: #000000;\">Bu belge PostgreSQL 12 ve EDB Postgres Advanced Server 12 i\u00e7in g\u00fcncellenmi\u015ftir.<\/p>\n<p><b style=\"color: #000000; font-size: 20px;\">2. Giri\u015f<\/b><br \/>\n<span style=\"color: #000000;\">G\u00fcvenli\u011fi katmanlar olarak d\u00fc\u015f\u00fcnebiliriz ve ilk f\u0131rsatta gereksiz eri\u015fimi engelleyerek herhangi bir i\u015f veya rol i\u00e7in gerekli olan en az eri\u015fimi verme stratejisini \u00f6nerebiliriz.<\/span><br \/>\n<span style=\"color: #000000;\">1- Birincisi, sunucuya fiziksel eri\u015fimi g\u00fcvenceye almakt\u0131r<\/span><br \/>\n<span style=\"color: #000000;\">2- Bir sonraki ad\u0131m kurumsal a\u011f\u0131n\u0131za genel olarak eri\u015fimi s\u0131n\u0131rland\u0131rmakt\u0131r<\/span><br \/>\n<span style=\"color: #000000;\">3- Bir sonraki ad\u0131m veritaban\u0131 sunucusuna eri\u015fimi s\u0131n\u0131rland\u0131rmakt\u0131r<\/span><br \/>\n<span style=\"color: #000000;\">4- Bir sonraki ad\u0131m veritaban\u0131 uygulamas\u0131na eri\u015fimi s\u0131n\u0131rland\u0131rmakt\u0131r<\/span><br \/>\n<span style=\"color: #000000;\">5- Bir sonraki ad\u0131m i\u00e7inde bulunan verilere eri\u015fimi s\u0131n\u0131rland\u0131rmakt\u0131r<\/span><br \/>\n<span style=\"color: #000000;\">6- Bir sonraki ad\u0131m i\u00e7inde depolanan verilerin g\u00fcvenli\u011fini sa\u011flamakt\u0131r<\/span><\/p>\n<p style=\"color: #000000;\">G\u00fcvenli\u011fi katmanlar olarak d\u00fc\u015f\u00fcnebiliriz ve en az gerekli eri\u015fimi sa\u011flama stratejisi \u00f6nerebiliriz.<\/p>\n<p><b style=\"color: #000000; font-size: 20px;\">Genel \u00d6neriler<\/b><\/p>\n<ul>\n<li><span style=\"color: #000000;\">\u0130\u015fletim sisteminizi ve veritaban\u0131n\u0131z\u0131 g\u00fcncel tutun. EDB\u2019nin destek abonelikleri, Postgres i\u00e7in uygun g\u00fcvenlik g\u00fcncellemeleri ve yamalar\u0131n zaman\u0131nda bildirimlerini sa\u011flar. yum\/dnf veya apt gibi paket y\u00f6netim sistemleriyle entegre edilebilen i\u015fletim sistemlerinin g\u00fcncellemelerini izleyebilecek bir\u00e7ok ara\u00e7 bulunmaktad\u0131r.<\/span><\/li>\n<li><span style=\"color: #000000;\">\u0130\u015fletmeniz i\u00e7in ger\u00e7ekten \u00e7ok \u00f6nem ta\u015f\u0131mad\u0131\u011f\u0131 s\u00fcrece, internete a\u00e7\u0131k postmaster port b\u0131rakmay\u0131n. Bu portu uygun \u015fekilde g\u00fcvenlik duvar\u0131 ile koruyun; e\u011fer bu m\u00fcmk\u00fcn de\u011filse, bu portta okuma-yazma veritaban\u0131 yerine yaln\u0131z okuma (read-only) standby veritaban\u0131 kullan\u0131n. T\u00fcm ba\u011flant\u0131lar\u0131 denetlenen a\u011f port y\u00f6nlendirmesi ge\u00e7erli bir di\u011fer se\u00e7enek olacakt\u0131r.<\/span><\/li>\n<li><span style=\"color: #000000;\">Alt a\u011f (subnet) olu\u015fturma veya di\u011fer tekniklerle veritaban\u0131 portunu di\u011fer a\u011f trafi\u011finden izole edin.<\/span><\/li>\n<li><span style=\"color: #000000;\">Kullan\u0131c\u0131lara i\u015flerini yapmak i\u00e7in gerekli en az eri\u015fim yetkisini verin, daha fazlas\u0131 de\u011fil; yetkili kullan\u0131c\u0131 hesaplar\u0131n\u0131n kullan\u0131m\u0131n\u0131 kesinlikle gerekli oldu\u011funda g\u00f6revler veya roller i\u00e7in saklay\u0131n.<\/span><\/li>\n<li><span style=\"color: #000000;\">Sistem y\u00f6neticilerinin yap\u0131land\u0131rma dosyalar\u0131na (postgresql.conf ve PG_hba.conf) ve g\u00fcnl\u00fck dosyalar\u0131na (PG_log) eri\u015fimini k\u0131s\u0131tlay\u0131n.<\/span><\/li>\n<li><span style=\"color: #000000;\">Veritaban\u0131 s\u00fcper kullan\u0131c\u0131 rolleri (PostgreSQL&#8217;de postgres, EDB Postgres Advanced Server&#8217;da enterprisedb) taraf\u0131ndan sunucu oturumuna izin vermeyin. Ola\u011fan\u00fcst\u00fc durumlarda yaln\u0131zca gerekti\u011finde yetkili kullan\u0131c\u0131 eri\u015fimini etkinle\u015ftirin.<\/span><\/li>\n<li><span style=\"color: #000000;\">T\u00fcm kullan\u0131c\u0131lara kendi giri\u015f bilgilerini verin; payla\u015f\u0131lan eri\u015fim bilgileri \u00f6nerilen bir uygulama de\u011fildir ve denetlemeyi daha karma\u015f\u0131k hale getirir. Se\u00e7enek olarak, uygulamalar\u0131n uygulama d\u00fczeyindeki ba\u011flant\u0131lardan kaynaklanan oturumlara daha fazla denetleme bilgisi eklemesine izin vermek i\u00e7in edb_audit_tag \u00f6zelli\u011fini (yaln\u0131zca EDB Postgres Advanced Server&#8217;da mevcuttur) kullan\u0131n.<\/span><\/li>\n<li><span style=\"color: #000000;\">Veritaban\u0131n\u0131za yetkisiz eri\u015fimi \u00f6nlemek i\u00e7in yaln\u0131zca \u00f6n y\u00fczdeki uygulaman\u0131za g\u00fcvenmeyin; veritaban\u0131 g\u00fcvenli\u011fini, LDAP\/ad veya Kerberos gibi kurumsal d\u00fczeyde kimlik do\u011frulama ve yetkilendirme modelleriyle entegre edin.<\/span><br \/>\n<span style=\"color: #000000;\">Yedeklemeleri saklay\u0131n ve test edilmi\u015f bir kurtarma plan\u0131na sahip olun. Sisteminizi ne kadar iyi g\u00fcvenceye al\u0131rsan\u0131z al\u0131n, izinsiz giri\u015f yapan bir ki\u015fi verilerinizi silebilir veya de\u011fi\u015ftirebilir. Yetkisiz eri\u015fimi \u00f6nlemek i\u00e7in yedeklelerinizin de g\u00fcvenli \u015fekilde sakland\u0131\u011f\u0131ndan emin olun.<\/span><\/li>\n<\/ul>\n<p style=\"color: #000000;\">G\u00fcvenli\u011fi, a\u011f ve bilgisayar g\u00fcvenli\u011fi i\u00e7in geli\u015ftirilen AAA modeli a\u00e7\u0131s\u0131ndan d\u00fc\u015f\u00fcnmek yararl\u0131 olabilir. AAA, Authentication (Kimlik Do\u011frulama), Authorization (Yetkilendirme) ve Auditing (Denetleme) anlam\u0131na gelir.<\/p>\n<ul>\n<li><b style=\"color: #000000;\">Kimlik Do\u011frulama:<\/b><span style=\"color: #000000;\"> Kullan\u0131c\u0131n\u0131n iddia etti\u011fi ki\u015fi oldu\u011funu do\u011frulay\u0131n.<\/span><\/li>\n<li><b style=\"color: #000000;\">Yetkilendirme:<\/b><span style=\"color: #000000;\"> Kullan\u0131c\u0131n\u0131n eri\u015fimine izin verildi\u011fini do\u011frulay\u0131n.<\/span><\/li>\n<li><b style=\"color: #000000;\">Denetleme (veya hesap verebilme):<\/b><span style=\"color: #000000;\"> Kullan\u0131c\u0131 ad\u0131 ve zaman bilgisi dahil olmak \u00fczere t\u00fcm veritaban\u0131 etkinliklerini g\u00fcnl\u00fck dosyalar\u0131na kaydedin.<\/span><\/li>\n<\/ul>\n<p style=\"color: #000000;\">T\u00fcm \u00f6zellikler bu kategorilere tam olarak uygun de\u011fildir, ancak AAA modeli bu teknik rapor i\u00e7in kullan\u0131\u015fl\u0131 bir \u00e7er\u00e7eve sunmaktad\u0131r.<\/p>\n<p><b style=\"color: #000000; font-size: 20px;\">3. Kimlik Do\u011frulama, Yetkilendirme ve Denetim \u00c7er\u00e7evesine PostgreSQL G\u00fcvenlik \u00d6zelliklerinin Uygulanmas\u0131<\/b><\/p>\n<p style=\"color: #000000;\">A\u015fa\u011f\u0131daki b\u00f6l\u00fcmlerde, Kimlik Do\u011frulama, Yetkilendirme ve Denetim (AAA) \u00c7er\u00e7evesine PostgreSQL g\u00fcvenlik \u00f6zelliklerinin nas\u0131l eklenece\u011fi hakk\u0131nda ayr\u0131nt\u0131l\u0131 bilgiler verilmektedir.<\/p>\n<p style=\"padding-left: 40px;\"><b style=\"color: #000000; font-size: 20px;\">3.1. Kimlik Do\u011frulama<\/b><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong><span style=\"color: #000000;\"> PG_hba.conf (PostgreSQL sunucu tabanl\u0131 eri\u015fim) dosyas\u0131, eri\u015fimi kullan\u0131c\u0131 ad\u0131, veritaban\u0131 ve kaynak IP adresine g\u00f6re (e\u011fer kullan\u0131c\u0131 TCP\/IP \u00fczerinden ba\u011flan\u0131yorsa) k\u0131s\u0131tlar. Kimlik do\u011frulama y\u00f6ntemleri de bu dosyada atan\u0131r. Se\u00e7ti\u011finiz kimlik do\u011frulama y\u00f6ntemi (veya y\u00f6ntemleri) kullan\u0131m senaryonuza ba\u011fl\u0131d\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong><span style=\"color: #000000;\"> Kerberos\/GSSAPI \u2014 PostgreSQL, RFC 1964&#8217;e g\u00f6re Kerberos kimlik do\u011frulamay\u0131 i\u00e7eren GSSAPI&#8217;yi destekler. GSSAPI, destekleyen sistemler i\u00e7in otomatik kimlik do\u011frulamay\u0131 (tek oturumda a\u00e7ma) sa\u011flar. Kimlik do\u011frulaman\u0131n kendisi g\u00fcvenlidir, ancak GSS veya SSL \u015fifreleme kullan\u0131lmad\u0131\u011f\u0131 s\u00fcrece veritaban\u0131 ba\u011flant\u0131s\u0131 \u00fczerinden g\u00f6nderilen veriler \u015fifrelenmez.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">SSPI \u2014 Windows sistemini kullan\u0131yorsan\u0131z ve Tek Oturumda A\u00e7ma (Single Sign-On, SSO) kimlik do\u011frulamas\u0131 uygulamak istiyorsan\u0131z bu \u00f6zelli\u011fi kullan\u0131n.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">LDAP yaln\u0131zca -hem SSPI hem de GSSAPI i\u00e7eren- Kerberos s\u00f6z konusu de\u011filse kullan\u0131lmal\u0131d\u0131r. LDAP daha az g\u00fcvenlidir, \u00e7\u00fcnk\u00fc parolalar LDAP sunucusuna iletilir ve g\u00fcvenli olmayan \u015fekilde kolayca ayarlanabilir.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">LDAP ve RADIUS \u2014 LDAP ve RADIUS, \u00e7ok say\u0131da kullan\u0131c\u0131n\u0131z ve parolalar\u0131 merkezi bir konumdan y\u00f6netmeniz gereken durumlar oldu\u011funda yararl\u0131d\u0131r. Bu merkezile\u015ftirmenin avantaj\u0131 pg_hba.conf dosyan\u0131z\u0131 k\u00fc\u00e7\u00fck ve y\u00f6netilebilir tutmakt\u0131r ve merkezile\u015ftirmeyle kullan\u0131c\u0131lar\u0131n\u0131za altyap\u0131n\u0131zda \u201cbirle\u015ftirilmi\u015f parola deneyimi\u201d sa\u011flanabilir., Veritaban\u0131n\u0131za eri\u015firken bu hizmete ve ba\u011flant\u0131ya g\u00fcvenece\u011finiz i\u00e7in Hem LDAP hem de RADIUS i\u00e7in sa\u011flam bir altyap\u0131 gerekmektedir.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">RADIUS \u2014 \u015fifrelemesi zayuf oldu\u011fundan ve kimlik bilgileri i\u00e7in md5 hashinge sahip oldu\u011fundan kullan\u0131lmamal\u0131d\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">Cert \u2014 TLS sertifikas\u0131 kimlik do\u011frulamas\u0131 (bazen SSL olarak da adland\u0131r\u0131l\u0131r), kablo \u00fczerindeki trafi\u011fi \u015fifrelemek ve kimlik do\u011frulama i\u00e7in kullan\u0131labilir. Sertifikalar genellikle makineden makineye ileti\u015fimde kullan\u0131l\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">md5 \u2014 md5 kullan\u0131c\u0131 ad\u0131 ve parola bilgilerini veritaban\u0131nda saklar; \u00e7ok az say\u0131da kullan\u0131c\u0131n\u0131z varsa uygun bir alternatif olabilir. Parolalar g\u00fcvenli \u015fekilde karma oldu\u011fundan md5&#8217;e g\u00f6re SCRAM tercih edilir.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">Scarm \u2014 \u00e7ok az say\u0131da g\u00fcvenilir kullan\u0131c\u0131n\u0131z varsa, scram-sha-256 kimlik do\u011frulamas\u0131n\u0131 kullanabilirsiniz. Parolalar g\u00fcvenli \u015fekilde karma oldu\u011fundan md5&#8217;e g\u00f6re SCRAM tercih edilir.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">Reject (Reddet) \u2014 belirli kullan\u0131c\u0131lar\u0131, belirli veritabanlar\u0131na ba\u011flant\u0131lar\u0131 ve\/veya belirli kaynak IP adreslerini reddetmek i\u00e7in bu y\u00f6ntemi kullan\u0131n.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000;\">&#8212;<\/strong> <span style=\"font-weight: 400; color: #000000;\">Trust (G\u00fcven) \u2014 g\u00fcvenilir kimlik do\u011frulama, e\u015fle\u015fen bir istemcinin ba\u015fka bir kimlik do\u011frulamas\u0131 olmadan sunucuya ba\u011flanmas\u0131n\u0131 sa\u011flad\u0131\u011f\u0131 i\u00e7in, yaln\u0131zca istisnai durumlarda kullan\u0131lmal\u0131d\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">B\u00fct\u00fcn kimlik do\u011frulama y\u00f6ntemlerinin sonu\u00e7lar\u0131n\u0131 tam olarak bilmeniz gereklidir. Yukar\u0131da verilenler ve di\u011fer kimlik do\u011frulama y\u00f6ntemleri hakk\u0131nda daha ayr\u0131nt\u0131l\u0131 ara\u015ft\u0131rma i\u00e7in PostgreSQL belgelerini inceleyebilirsiniz.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Tan\u0131t\u0131m b\u00f6l\u00fcm\u00fcnde belirtildi\u011fi gibi, pg_hba.conf dosyas\u0131 eri\u015fimi sistem y\u00f6neticileri i\u00e7in s\u0131n\u0131rl\u0131 olmal\u0131d\u0131r. Bu dosyay\u0131 d\u00fczg\u00fcn \u015fekilde k\u0131s\u0131tl\u0131 tutmaya \u00e7al\u0131\u015f\u0131n; daha b\u00fcy\u00fck, daha karma\u015f\u0131k dosyalar\u0131n bak\u0131m\u0131 daha zordur ve yanl\u0131\u015f ya da eski kay\u0131tlar\u0131 i\u00e7erme olas\u0131l\u0131\u011f\u0131 daha y\u00fcksektir. Gereksiz kay\u0131tlar i\u00e7in bu dosyay\u0131 d\u00fczenli olarak inceleyin.<\/span><\/p>\n<p style=\"padding-left: 40px; font-size: 20px;\"><strong style=\"color: #000000;\">3.2. Parola Profilleri<\/strong><\/p>\n<p style=\"padding-left: 40px; color: #000000;\">Advanced Server, 9.5 s\u00fcr\u00fcm\u00fcnden ba\u015flayarak MD5 veya SCRAM kimlik do\u011frulamas\u0131 kullan\u0131larak Oracle uyumlu parola profillerini desteklemektedir. Parola profili, DBA&#8217;n\u0131n benzer kimlik do\u011frulama gereksinimlerini payla\u015fan bir grup rol\u00fc kolayca y\u00f6netmesine olanak tan\u0131yan bir parola \u00f6zellikleri k\u00fcmesidir. Her profil bir veya daha fazla kullan\u0131c\u0131yla ili\u015fkilendirilebilir. Bir kullan\u0131c\u0131 sunucuya ba\u011fland\u0131\u011f\u0131nda, sunucu oturum a\u00e7ma rol\u00fcyle ili\u015fkili profili uygular.<\/p>\n<p style=\"padding-left: 40px; color: #000000;\">Daha fazla bilgi i\u00e7in EDB\u2019s Database Compatibility for Oracle\u00ae Developer\u2019s Guide belgesinin 2.3 \u201cProfile Management\u201d B\u00f6l\u00fcm\u00fcne bakabilirsiniz..<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"color: #000000;\">Profiller a\u015fa\u011f\u0131daki i\u015flemler i\u00e7in kullan\u0131labilir:<\/span><span style=\"color: #000000;\"><br \/>\n\u2022 \u0130zin verilen ba\u015far\u0131s\u0131z oturum a\u00e7ma giri\u015fimi say\u0131s\u0131n\u0131n belirtilmesi.<\/span><span style=\"color: #000000;\"><br \/>\n\u2022 A\u015f\u0131r\u0131 ba\u015far\u0131s\u0131z oturum a\u00e7ma giri\u015fimleri nedeniyle hesab\u0131n kilitlenmesi.<\/span><span style=\"color: #000000;\"><br \/>\n\u2022 Sona ermesi i\u00e7in bir parolan\u0131n i\u015faretlenmesi.<\/span><span style=\"color: #000000;\"><br \/>\n\u2022 Parola sona erdikten sonra ek s\u00fcrenin tan\u0131mlanmas\u0131.<\/span><span style=\"color: #000000;\"><br \/>\n\u2022 Parola karma\u015f\u0131kl\u0131\u011f\u0131 i\u00e7in kurallar\u0131n tan\u0131mlanmas\u0131.<\/span><span style=\"color: #000000;\"><br \/>\n\u2022 Parolan\u0131n yeniden kullan\u0131m\u0131n\u0131 s\u0131n\u0131rlayan kurallar\u0131n tan\u0131mlanmas\u0131.<\/span><\/p>\n<p style=\"padding-left: 40px; font-size: 20px;\"><strong style=\"color: #000000;\">3.3. Yetkilendirme<\/strong><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Kullan\u0131c\u0131 uygun \u015fekilde kimlik do\u011frulad\u0131ktan sonra, verileri g\u00f6r\u00fcnt\u00fclemesi ve veritaban\u0131nda \u00e7al\u0131\u015fmas\u0131 i\u00e7in izin vermeniz gerekir. Daha \u00f6nce de belirtildi\u011fi gibi, yaln\u0131zca kullan\u0131c\u0131n\u0131n ilgili i\u015fi ger\u00e7ekle\u015ftirmesi i\u00e7in gereken ayr\u0131cal\u0131klar\u0131 verin ve payla\u015f\u0131lan (grup) oturum a\u00e7ma kimlik bilgilerine izin vermeyin. PostgreSQL&#8217;deki kullan\u0131c\u0131lar\u0131 ve gruplar\u0131, rol atamalar\u0131 arac\u0131l\u0131\u011f\u0131yla y\u00f6netin. Bir rol, bireysel bir kullan\u0131c\u0131y\u0131 veya bir grup kullan\u0131c\u0131y\u0131 ifade edebilir. Postgres&#8217;te roller, k\u00fcme (veya veritaban\u0131 sunucusu) d\u00fczeyinde olu\u015fturulur. Bu durum, rollerin k\u00fcme\/veritaban\u0131 sunucusu i\u00e7in tan\u0131mlanan t\u00fcm veritabanlar\u0131na uyguland\u0131\u011f\u0131 anlam\u0131na gelir ve rol izinlerinin uygun \u015fekilde s\u0131n\u0131rland\u0131r\u0131lmas\u0131 \u00e7ok \u00f6nemlidir. \u0130zinler veritaban\u0131 nesnelerine (tablolar, g\u00f6r\u00fcnt\u00fcler, i\u015flevler vb.), tablolar\u0131n i\u00e7indeki sat\u0131rlara ve veri azaltma politikalar\u0131na uygulanabilir.<\/span><\/p>\n<p style=\"padding-left: 80px; font-size: 20px;\"><strong style=\"color: #000000;\">3.3.1 \u2013 Veritaban\u0131 nesnelerine eri\u015fim<\/strong><\/p>\n<p style=\"padding-left: 80px;\"><span style=\"font-weight: 400; color: #000000;\">Atanan ayr\u0131cal\u0131klar ve uyar\u0131lar, PostgreSQL CREATE ROLE belgelerinde \u00f6zetlenir:<\/span><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400; color: #000000;\">T\u00fcm kullan\u0131c\u0131lar\u0131n CREATE ayr\u0131cal\u0131klar\u0131n\u0131 iptal edin ve yaln\u0131zca g\u00fcvenilir kullan\u0131c\u0131lara geri verin.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400; color: #000000;\">G\u00fcvenilmeyen prosed\u00fcr dillerinde yaz\u0131lm\u0131\u015f fonksiyonlar\u0131n veya tetikleyicilerin kullan\u0131m\u0131na izin vermeyin.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400; color: #000000;\">SECURITY DEFINER i\u015flevleri, kullan\u0131c\u0131lar\u0131n i\u015flevleri kontroll\u00fc olarak y\u00fcksek ayr\u0131cal\u0131k d\u00fczeyinde \u00e7al\u0131\u015ft\u0131rmas\u0131n\u0131 sa\u011flar ancak kazara dikkatsizce yaz\u0131lm\u0131\u015f bir i\u015flev, g\u00fcvenli\u011fi azaltabilir. Daha fazla ayr\u0131nt\u0131 i\u00e7in belgeleri inceleyin (Writing Security Definer Functions Safely of CREATE FUNCTION b\u00f6l\u00fcm\u00fc).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400; color: #000000;\">Veritaban\u0131 nesnelerine, herhangi bir uygulama kullan\u0131c\u0131s\u0131n\u0131n ba\u011flanabilece\u011fi bir rol taraf\u0131ndan de\u011fil, ideal olarak veritaban\u0131na \u00e7ok k\u0131s\u0131tl\u0131 eri\u015fimi olan (\u00f6rn. Yaln\u0131zca Unix Etki Alan\u0131 soketinden) g\u00fcvenli bir rol taraf\u0131ndan sahip olunmal\u0131d\u0131r. B\u00f6ylece sald\u0131rgan\u0131n nesneleri de\u011fi\u015ftirme veya aktarma \u015fans\u0131n\u0131 en aza indirilir. Bu, g\u00fcvenlik a\u00e7\u0131s\u0131ndan tercih edilse de, \u015femay\u0131 kendisi y\u00f6neten uygulama \u00e7er\u00e7eveleri ile sorun yaratabilir; bu t\u00fcr i\u015flevler dikkatli \u015fekilde uygulanmal\u0131d\u0131r.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"padding-left: 80px; color: #000000;\">Log_Statement \u2018ddl\u2019 veya daha y\u00fcksek bir de\u011fere ayarland\u0131\u011f\u0131nda, rol\u00fcn parolas\u0131n\u0131 ALTER ROLE komutu arac\u0131l\u0131\u011f\u0131yla de\u011fi\u015ftirmenin EDB Postgres Advanced Server 11 ve sonraki s\u00fcr\u00fcmleri d\u0131\u015f\u0131nda g\u00fcnl\u00fcklerde parolan\u0131n if\u015fas\u0131 ile sonu\u00e7lanaca\u011f\u0131na dikkat edin, burada, edb_filter_log.redakct_password_command, sunucuya g\u00fcnl\u00fck dosyas\u0131ndan tutulan parolalar\u0131 daraltma talimat\u0131n\u0131 verir. Daha fazla bilgi i\u00e7in <span style=\"color: #eb1c24;\"><a style=\"color: #eb1c24;\" href=\"https:\/\/www.enterprisedb.com\/edb-docs\/d\/edb-postgres-advanced-server\/installation-getting-started\/release-notes\/11\/EPAS_Release_Notes.1.4.html\" target=\"_blank\" rel=\"noopener noreferrer\">t\u0131klay\u0131n.<\/a><\/span><\/p>\n<p style=\"padding-left: 80px; color: #000000;\">Kimlik do\u011frulama bilgileri (\u00f6rn. Kullan\u0131c\u0131 adlar\u0131 ve parolalar) bir tabloda tutuldu\u011funda, tablo \u00f6zel olarak g\u00fcvenli olsa bile komut kay\u0131tlar\u0131n\u0131n (statement logging) kullan\u0131m\u0131 bu bilgileri a\u00e7\u0131\u011fa \u00e7\u0131karabilir. Benzer \u015fekilde, sorgularda hassas bilgiler kullan\u0131l\u0131rsa (\u00f6rne\u011fin, bir anahtar olarak ki\u015fisel tan\u0131mlay\u0131c\u0131 herhangi bir bilgi), bu parametreler komut kay\u0131tlar\u0131 ile ortaya \u00e7\u0131kar\u0131labilir.<\/p>\n<p style=\"padding-left: 80px; font-size: 20px;\"><strong style=\"color: #000000;\">3.3.2 \u2013 G\u00f6r\u00fcn\u00fcmler<\/strong><\/p>\n<p style=\"padding-left: 80px;\"><span style=\"font-weight: 400;\"><span style=\"color: #000000;\">Veritaban\u0131 nesneleri olan g\u00f6r\u00fcn\u00fcmlere eri\u015fim yukar\u0131da a\u00e7\u0131klad\u0131\u011f\u0131 bi\u00e7imde kontrol edilebilir. Bir tabloya VIEW yarat\u0131p ve bu VIEW i\u00e7in yetkilerini k\u0131s\u0131tlayarak verilerin g\u00f6r\u00fcn\u00fcrl\u00fc\u011f\u00fcn\u00fc belirli kullan\u0131c\u0131 gruplar\u0131yla s\u0131n\u0131rland\u0131rmak g\u00f6r\u00fcn\u00fcmlerin kullan\u0131m\u0131yla m\u00fcmk\u00fcn olabilir. Robert Haas&#8217;\u0131n tan\u0131mlad\u0131\u011f\u0131 gibi olas\u0131 g\u00fcvenlik sorunlar\u0131ndan ka\u00e7\u0131nmak i\u00e7in ekstra \u00f6nlem al\u0131nmas\u0131 gerekti\u011fi d\u00fc\u015f\u00fcn\u00fcld\u00fc\u011f\u00fcnden, PostgreSQL 9.2 ve sonraki s\u00fcr\u00fcmleri, CREATE VIEW WITH (security_barrier) se\u00e7ene\u011fini sunmaktad\u0131r.<\/span> <\/span><\/p>\n<p style=\"padding-left: 80px; font-size: 20px;\"><strong style=\"color: #000000;\">3.3.3 \u2013 Sat\u0131r D\u00fczeyinde G\u00fcvenlik<\/strong><\/p>\n<p style=\"padding-left: 80px;\"><span style=\"font-weight: 400; color: #000000;\">PostgreSQL, 9.5 s\u00fcr\u00fcm\u00fcnde Sat\u0131r D\u00fczeyinde G\u00fcvenli\u011fi (RLS) tan\u0131tm\u0131\u015ft\u0131r. RLS, kullan\u0131c\u0131 rol\u00fcne ba\u011fl\u0131 olarak tablo sat\u0131rlar\u0131na \u00e7ok hassas eri\u015fim sa\u011flar. Buna SELECT, UPDATE, DELETE ve INSERT i\u015flemleri dahildir. Daha fazla bilgiyi <a style=\"color: #eb1c24;\" href=\"https:\/\/www.postgresql.org\/docs\/current\/ddl-rowsecurity.html\" target=\"_blank\" rel=\"noopener noreferrer\">burada bulabilirsiniz.<\/a><\/span><\/p>\n<p style=\"padding-left: 80px; color: #000000;\">EDB Postgres Advanced Server, DBMS_RLS paketinde bu mekanizman\u0131n Oracle\u2019a uyumlu ADD_POLICY, DROP_POLICY ve UPDATE_POLICY uygulamalar\u0131n\u0131 i\u00e7erir. Daha fazla bilgi i\u00e7in <a style=\"color: #eb1c24;\" href=\"https:\/\/www.enterprisedb.com\/edb-docs\/d\/edb-postgres-advanced-server\/user-guides\/database-compatibility-for-oracle-developers-built-in-package-guide\/12\/Database_Compatibility_for_Oracle_Developers_Built-in_Package_Guide.1.31.html\" target=\"_blank\" rel=\"noopener\">t\u0131klay\u0131n.<\/a><\/p>\n<p style=\"padding-left: 80px; font-size: 20px;\"><strong style=\"color: #000000;\">3.3.4 \u2013 Veri Azalt\u0131m\u0131<\/strong><\/p>\n<p style=\"padding-left: 80px;\"><span style=\"font-weight: 400; color: #000000;\">Veri azalt\u0131m\u0131 &#8211; baz\u0131 veri \u00f6\u011felerini gizleme veya belirli kullan\u0131c\u0131 gruplar\u0131 i\u00e7in verileri se\u00e7ici olarak gizleme \u00f6zelli\u011fi, verilere eri\u015fimi y\u00f6netmek i\u00e7in kullan\u0131lan ba\u015fka bir tekniktir. EDB Postgres Advanced Server, 11 s\u00fcr\u00fcm\u00fcnde veri azalt\u0131m \u00f6zelli\u011fini sunmu\u015ftur.<\/span><\/p>\n<p style=\"padding-left: 80px; color: #000000;\">Veri azalt\u0131m\u0131, belirli veri \u00f6\u011felerine okuma eri\u015fimini vermek veya iptal etmek i\u00e7in PostgreSQL rolleriyle birlikte \u00e7al\u0131\u015fan politika bazl\u0131 bir ara\u00e7t\u0131r. \u00d6rne\u011fin, bir grup kullan\u0131c\u0131 sosyal g\u00fcvenlik numaralar\u0131n\u0131 XXX-XX-1235 olarak g\u00f6r\u00fcrken, veri y\u00f6neticisi rol\u00fcne sahip \u00fcyeler t\u00fcm ayr\u0131nt\u0131lar\u0131 g\u00f6r\u00fcr. Veri azalt\u0131m\u0131 hakk\u0131nda ek bilgiler burada bulunmaktad\u0131r.<\/p>\n<div class=\"table-1\" style=\"padding-left: 80px;\">\n<table width=\"100%\">\n<thead>\n<tr>\n<th align=\"left\"><span style=\"color: #000000;\">Sabit<\/span><\/th>\n<th align=\"left\"><span style=\"color: #000000;\">Tip<\/span><\/th>\n<th align=\"left\"><span style=\"color: #000000;\">De\u011fer<\/span><\/th>\n<th align=\"left\"><span style=\"color: #000000;\">A\u00e7\u0131klama<\/span><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td align=\"left\"><span style=\"color: #000000;\">NONE<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">INTEGER<\/span><\/td>\n<td align=\"left\"><span style=\"color: #000000;\">0<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">Azalt\u0131m yok, tabloya kar\u015f\u0131 sorgu sonucu \u00fczerinde s\u0131f\u0131r etkisi.<\/span><\/td>\n<\/tr>\n<tr>\n<td align=\"left\"><span style=\"color: #000000;\">FULL<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">INTEGER<\/span><\/td>\n<td align=\"left\"><span style=\"color: #000000;\">1<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">Tam azalt\u0131m, s\u00fctun verilerinin t\u00fcm de\u011ferleri azalt\u0131l\u0131r.<\/span><\/td>\n<\/tr>\n<tr>\n<td align=\"left\"><span style=\"color: #000000;\">PARTIAL<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">INTEGER<\/span><\/td>\n<td align=\"left\"><span style=\"color: #000000;\">2<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">K\u0131smi azalt\u0131m, s\u00fctun verilerinin bir b\u00f6l\u00fcm\u00fc azalt\u0131l\u0131r.<\/span><\/td>\n<\/tr>\n<tr>\n<td align=\"left\"><span style=\"color: #000000;\">RANDOM<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">INTEGER<\/span><\/td>\n<td align=\"left\"><span style=\"color: #000000;\">4<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">Rastgele azalt\u0131m, her sorgu s\u00fctunun veri t\u00fcr\u00fcne ba\u011fl\u0131 olarak farkl\u0131 bir rastgele de\u011ferle sonu\u00e7lan\u0131r.<\/span><\/td>\n<\/tr>\n<tr>\n<td align=\"left\"><span style=\"color: #000000;\">REGEXP<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">INTEGER<\/span><\/td>\n<td align=\"left\"><span style=\"color: #000000;\">5<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">Kurall\u0131 ifade bazl\u0131 azalt\u0131m, azalt\u0131m yap\u0131lacak veri \u015fablonunu arar.<\/span><\/td>\n<\/tr>\n<tr>\n<td align=\"left\"><span style=\"color: #000000;\">CUSTOM<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">INTEGER<\/span><\/td>\n<td align=\"left\"><span style=\"color: #000000;\">99<\/span><\/td>\n<td align=\"left\"><span style=\"font-weight: 400; color: #000000;\">\u00d6zel azalt\u0131m tipi.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div><\/div>\n<div class=\"table-1\" style=\"padding-left: 80px;\"><strong><span style=\"font-family: NonBreakingSpaceOverride, 'Hoefler Text', Garamond, 'Times New Roman', serif; font-size: revert; letter-spacing: normal;\">3.13.1 DBMS_REDACT Sabiti ve Fonksiyon Parametreleri kullan\u0131l\u0131r<\/span><\/strong><\/div>\n<p style=\"padding-left: 40px; font-size: 20px;\"><strong style=\"color: #000000;\">3.4 Denetleme<\/strong><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Advanced Server denetim raporlar\u0131 olu\u015fturma olana\u011f\u0131n\u0131 sa\u011flar. Veritaban\u0131 denetimi, veritaban\u0131 y\u00f6neticilerinin, denet\u00e7ilerin ve operat\u00f6rlerin karma\u015f\u0131k denetim gereksinimlerini desteklemek amac\u0131yla veritaban\u0131 faaliyetlerini takip edip analiz etmelerine olanak tan\u0131r. Bu denetlenen faaliyetlerini veri olu\u015fturma, de\u011fi\u015ftirme veya silme ile birlikte veritaban\u0131 eri\u015fimi ve kullan\u0131m\u0131 olu\u015fturur. Denetime sistemi, yap\u0131land\u0131rma dosyas\u0131nda tan\u0131mlanan yap\u0131land\u0131rma parametrelerine dayan\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><strong style=\"color: #000000; font-size: 20px;\">Denetleme d\u00fczeyini art\u0131rarak a\u015fa\u011f\u0131dakiler i\u00e7in denetim yapman\u0131z\u0131 \u00f6neririz:<\/strong><br \/>\n<span style=\"color: #000000;\">\u2022 Kullan\u0131c\u0131 ba\u011flant\u0131lar\u0131<\/span><br \/>\n<span style=\"color: #000000;\">\u2022 DDL de\u011fi\u015fiklikleri<\/span><br \/>\n<span style=\"color: #000000;\">\u2022 Veri de\u011fi\u015fiklikleri<\/span><br \/>\n<span style=\"color: #000000;\">\u2022 Veri g\u00f6r\u00fcnt\u00fclemeleri<\/span><\/p>\n<p style=\"padding-left: 40px; color: #000000;\">\u00c7ok ayr\u0131nt\u0131l\u0131 denetleme d\u00fczeyleri, \u00e7ok say\u0131da g\u00fcnl\u00fck kayd\u0131na neden olabilir; yaln\u0131zca ihtiyac\u0131n\u0131z olan d\u00fczeyde g\u00fcnl\u00fck kay\u0131tlar\u0131n\u0131 toplay\u0131n. Postgres ile, g\u00fcnl\u00fck d\u00fczeylerini her bir kullan\u0131c\u0131 ve her bir veritaban\u0131 i\u00e7in ayarlayabilirsiniz. Anormal hareketler i\u00e7in denetim g\u00fcnl\u00fcklerinizi s\u0131k s\u0131k g\u00f6zden ge\u00e7irin. G\u00fcnl\u00fckleriniz i\u00e7in bir g\u00f6zetim zincirini olu\u015fturun.<\/p>\n<p style=\"padding-left: 40px; color: #000000;\">Y\u00fcksek bir kay\u0131t d\u00fczeyinin, veritaban\u0131ndaki parolalar\u0131n depolanmas\u0131yla birlikte g\u00fcnl\u00fcklerde parolalar\u0131n g\u00f6r\u00fcnt\u00fclenmesine neden olabilece\u011fini unutmay\u0131n. EDB Postgres Advanced Server, sunucuya denetim g\u00fcnl\u00fc\u011f\u00fc dosyas\u0131ndan depolanan parolalar\u0131 redaksiyon talimat\u0131n\u0131 vermek amac\u0131yla s\u00fcr\u00fcm 11&#8217;de edb_filter_log.redakct_password_commands uzant\u0131s\u0131n\u0131 kullan\u0131ma sunmu\u015ftur.<\/p>\n<p style=\"padding-left: 40px; color: #000000;\">Advanced Server, veritaban\u0131 ve g\u00fcvenlik y\u00f6neticilerinin, denet\u00e7ilerin ve operat\u00f6rlerin EDB Denetim G\u00fcnl\u00fc\u011f\u00fc i\u015flevini kullanarak veritaban\u0131 etkinliklerini izleyip analiz etmelerine olanak tan\u0131r.<\/p>\n<p style=\"padding-left: 40px; font-size: 20px;\"><b style=\"color: #000000;\">3.5 Veri \u015eifreleme<\/b><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">PostgreSQL, \u00e7e\u015fitli d\u00fczeylerde \u015fifreleme sunar ve veritaban\u0131 sunucusu h\u0131rs\u0131zl\u0131\u011f\u0131, etik olmayan y\u00f6neticiler ve g\u00fcvensiz a\u011flar nedeniyle verilerin a\u00e7\u0131klanmas\u0131n\u0131 \u00f6nlemede esneklik sa\u011flar:<\/span><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-weight: 400; color: #000000;\"> Kullan\u0131c\u0131 ba\u011flant\u0131lar\u0131<\/span><\/li>\n<li><span style=\"font-weight: 400; color: #000000;\"> DDL de\u011fi\u015fiklikleri<\/span><\/li>\n<li><span style=\"font-weight: 400; color: #000000;\"> Veri de\u011fi\u015fiklikleri<\/span><\/li>\n<li><span style=\"font-weight: 400; color: #000000;\"> Veri g\u00f6r\u00fcnt\u00fcleri<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Bu se\u00e7enekler hakk\u0131nda daha fazla bilgi PostgreSQL belgelerinde bulunabilir.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Bir istemci ile veritaban\u0131 aras\u0131nda aktar\u0131m s\u0131ras\u0131nda verilerin ele ge\u00e7irilmesinden endi\u015fe duyuyorsan\u0131z, veri ele ge\u00e7irme i\u015fleminin risk olu\u015fturmad\u0131\u011f\u0131ndan emin olmad\u0131\u011f\u0131n\u0131z s\u00fcrece postgresql.conf dosyas\u0131nda SSL&#8217;yi etkinle\u015ftirin. SSL \u015fifrelemesi ek y\u00fck ekleyebilir ve sertifika y\u00f6netimi zor olabilir, ancak genel olarak bu \u00f6nerilen bir uygulamad\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Ayr\u0131ca veritaban\u0131 i\u00e7inde veya dosya sistemi d\u00fczeyinde (biri veya di\u011feriyle) verileri \u015fifreleyebilirsiniz. EDB&#8217;nin blogunda \u015eeffaf Veri \u015eifreleme (Transparent Data Encryption) hakk\u0131nda daha fazla bilgi bulabilirsiniz. Bu \u015fifreleme se\u00e7ene\u011fiyle, veri, dosya sisteminden okundu\u011fu anda \u015fifre \u00e7\u00f6z\u00fcl\u00fcr, b\u00f6ylece veritaban\u0131 y\u00f6neticileri verileri g\u00f6r\u00fcnt\u00fcleyebilir; rollerin ve ayr\u0131cal\u0131klar\u0131n kilitli olmas\u0131 zorunludur. Di\u011fer se\u00e7enekler aras\u0131nda Thales Vormetric Transparent Encryption (VTE) (Thales Vormetric \u015eeffaf \u015eifreleme) kullan\u0131m\u0131 bulunmaktad\u0131r.<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">S\u00fctun ba\u015f\u0131na veri \u015fifrelemek i\u00e7in pgcrypto \u0441ontrib mod\u00fcl\u00fcn\u00fc kullan\u0131n. Bu y\u00f6ntemin birka\u00e7 sak\u0131ncas\u0131 vard\u0131r:<\/span><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li><span style=\"font-weight: 400; color: #000000;\"> Tablonun boyutuna ba\u011fl\u0131 olarak olas\u0131 bir performans t\u0131kan\u0131kl\u0131\u011f\u0131 vard\u0131r.<\/span><\/li>\n<li><span style=\"font-weight: 400; color: #000000;\"> \u015eifrelenmi\u015f alanlarda arama yap\u0131lamaz veya dizine (indekse) al\u0131namaz.<\/span><\/li>\n<li><span style=\"font-weight: 400; color: #000000;\"> \u015eifreleme, tablo olu\u015fturma s\u0131ras\u0131nda uygulanmal\u0131d\u0131r ve ayr\u0131ca ileri planlamay\u0131 gerektirir.<\/span><\/li>\n<li><span style=\"font-weight: 400; color: #000000;\"> \u015eifreleme anahtar\u0131 y\u00f6netimi de karma\u015f\u0131k olabilir.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p style=\"padding-left: 40px;\"><span style=\"font-weight: 400; color: #000000;\">Buna ek olarak, uygulaman\u0131z \u015fifreleme\/\u015fifre \u00e7\u00f6zme i\u015flemini ger\u00e7ekle\u015ftirmesi gerekir, bu sayede veritaban\u0131ndaki her de\u011fi\u015fimin etik olmayan bir veritaban\u0131 y\u00f6neticisinin verileri g\u00f6r\u00fcnt\u00fclemesini \u00f6nlemek i\u00e7in \u015fifrelenmeyi s\u00fcrd\u00fcrmelidir.<\/span><\/p>\n<p style=\"padding-left: 40px; font-size: 20px;\"><b style=\"color: #000000;\">3.6 SQL Enjeksiyon Sald\u0131r\u0131lar\u0131<\/b><\/p>\n<p style=\"padding-left: 40px; color: #000000;\">SQL enjeksiyon sald\u0131r\u0131s\u0131, bir veritaban\u0131n\u0131n i\u00e7eri\u011fi, yap\u0131s\u0131 veya g\u00fcvenli\u011fi konusunda sald\u0131rgana ipu\u00e7lar\u0131 sa\u011flayan SQL komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131rarak veritaban\u0131n\u0131 tehlikeye atma giri\u015fimidir. SQL enjeksiyon sald\u0131r\u0131s\u0131n\u0131 engellemek, normalde uygulama geli\u015ftiricisinin sorumlulu\u011fundad\u0131r. Veritaban\u0131 y\u00f6neticilerinin potansiyel tehdit \u00fczerinde genellikle ya \u00e7ok az ya da hi\u00e7 kontrol\u00fc yoktur.<\/p>\n<p style=\"padding-left: 40px; color: #000000;\">PostgreSQL SQL enjeksiyon sald\u0131r\u0131lar\u0131n\u0131 \u00f6nlemek i\u00e7in standart y\u00f6ntem olarak parametre haline getirilmi\u015f sorgular\u0131 kullan\u0131r. EDB Postgres Advanced Server kullan\u0131yorsan\u0131z SQL enjeksiyon sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korunmak i\u00e7in SQL\/Protect mod\u00fcl\u00fcn\u00fc kullanman\u0131z\u0131 \u00f6neririz. SQL\/Protect, genel SQL profilleri i\u00e7in gelen sorgular\u0131 inceleyerek normal veritaban\u0131 g\u00fcvenlik politikalar\u0131na ek bir g\u00fcvenlik katman\u0131n\u0131 sa\u011flar. SQL\/Protect, y\u00f6neticiyi potansiyel olarak tehlikeli sorgular konusunda uyararak ve bu sorgular\u0131 engelleyerek kontrol\u00fc veritaban\u0131 y\u00f6neticisine geri verir. Daha fazla bilgi i\u00e7in<a style=\"color: #eb1c24;\" href=\"https:\/\/www.enterprisedb.com\/edb-docs\/d\/edb-postgres-advanced-server\/user-guides\/user-guide\/12\/EDB_Postgres_Advanced_Server_Guide.1.50.html#pID0E0BDD0HA\" target=\"_blank\" rel=\"noopener noreferrer\">\u00a0t\u0131klay\u0131n.<\/a><\/p>\n<p>Kaynak: <a href=\"https:\/\/info.enterprisedb.com\/white-paper_security-best-practices-postgresql.html?_ga=2.62855532.1950402146.1620022971-1640779360.1612185529\" target=\"_blank\" rel=\"noopener\">Security Best Practices for PostgreSQL<\/a><br \/>\n\u00a9 Copyright EnterpriseDB Corporation 2020 EnterpriseDB Corporation<br \/>\n34 Crosby Drive Suite 201 Bedford, MA 01730<br \/>\nEnterpriseDB and Postgres Enterprise Manager are registered trademarks of EnterpriseDB Corporation. EDB and EDB Postgres are trademarks of EnterpriseDB Corporation. Oracle is a registered trademark of Oracle, Inc. Other trademarks may be trademarks of their respective owners.<\/p>","protected":false},"excerpt":{"rendered":"<p>1. \u00d6zet Bu teknik inceleme raporu, PostgreSQL veritaban\u0131n\u0131 g\u00fcvenli\u011fini sa\u011flamak ve korumak i\u00e7in bir \u00e7er\u00e7eve ve bir dizi \u00f6neri sunmaktad\u0131r. Fiziksel g\u00fcvenli\u011fi, a\u011f g\u00fcvenli\u011fini, sunucu eri\u015fim kontrol\u00fcn\u00fc, veritaban\u0131 eri\u015fim y\u00f6netimini ve veri g\u00fcvenli\u011fini ele alan katmanl\u0131 bir g\u00fcvenlik modelinden s\u00f6z&#8230;<\/p>","protected":false},"author":16,"featured_media":22104,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[75,45],"tags":[58,48,50],"class_list":["post-18476","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-postgresql","category-yazi","tag-acikkaynak","tag-enterprisedb","tag-veritabani"],"_links":{"self":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts\/18476","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/comments?post=18476"}],"version-history":[{"count":0,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/posts\/18476\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/media\/22104"}],"wp:attachment":[{"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/media?parent=18476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/categories?post=18476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/profelis.com.tr\/en\/wp-json\/wp\/v2\/tags?post=18476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}