{"id":306,"date":"2025-12-27T20:10:47","date_gmt":"2025-12-27T17:10:47","guid":{"rendered":"https:\/\/www.ertanerbek.com\/?p=306"},"modified":"2025-12-27T20:10:48","modified_gmt":"2025-12-27T17:10:48","slug":"13-windows-server-2025-domain-trust","status":"publish","type":"post","link":"https:\/\/www.ertanerbek.com\/?p=306","title":{"rendered":"13 Windows Server 2025 Domain Trust"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\"><strong>Network Yap\u0131s\u0131<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>netlab.lc:<\/strong> 10.200.120.0\/24<\/li>\n\n\n\n<li><strong>newlab.lc:<\/strong> 10.200.124.0\/24<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Her iki domain controller kendi network segmentinde \u00e7al\u0131\u015fmaktad\u0131r.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Yap\u0131lan \u0130\u015flemler<\/strong><\/h3>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>DNS Forwarding yap\u0131land\u0131r\u0131ld\u0131<\/strong> newlab.lc \u2192 netlab.lc netlab.lc \u2192 newlab.lc<\/li>\n\n\n\n<li><strong>Two\u2011Way External Trust olu\u015fturuldu<\/strong> Domainler birbirine kar\u015f\u0131l\u0131kl\u0131 g\u00fcvenecek \u015fekilde yap\u0131land\u0131r\u0131ld\u0131.<\/li>\n\n\n\n<li><strong>Cross\u2011Domain Login Testi<\/strong> newlab.lc taraf\u0131ndaki bir terminalden:\n<ul class=\"wp-block-list\">\n<li>newlab.lc kullan\u0131c\u0131lar\u0131 ile login<\/li>\n\n\n\n<li>netlab.lc kullan\u0131c\u0131lar\u0131 ile login i\u015flemleri yap\u0131larak trust do\u011fruland\u0131.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Bu test, Kerberos ticket\u2019lar\u0131n\u0131n do\u011fru \u015fekilde kar\u015f\u0131 domain controller\u2019a iletildi\u011fini ve DNS \u00e7\u00f6z\u00fcmlemesinin sorunsuz \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6sterir.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"13 Windows Server 2025 Domain Trust\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/_4Gyu2EdPBk?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83e\udde9 <strong>Domain Trust Nedir? Kurumsal Mimari \u0130\u00e7inde Nas\u0131l \u00c7al\u0131\u015f\u0131r? (Ayr\u0131nt\u0131l\u0131 Teknik Rehber)<\/strong><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Active Directory Domain Services (AD DS), \u00e7oklu domain veya \u00e7oklu forest yap\u0131lar\u0131nda kimlik do\u011frulama ve kaynak payla\u015f\u0131m\u0131n\u0131 g\u00fcvenli \u015fekilde y\u00f6netebilmek i\u00e7in <strong>trust (g\u00fcven ili\u015fkisi)<\/strong> mekanizmas\u0131n\u0131 kullan\u0131r. Trust, iki domain aras\u0131nda \u201cbu domainin kimlik do\u011frulamas\u0131na g\u00fcveniyorum\u201d anlam\u0131na gelen kriptografik bir ili\u015fkidir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Trust olmadan:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kerberos ticket\u2019lar\u0131 kar\u015f\u0131 domain\u2019e iletilemez<\/li>\n\n\n\n<li>SID \u00e7\u00f6z\u00fcmlemesi yap\u0131lamaz<\/li>\n\n\n\n<li>Cross-domain login \u00e7al\u0131\u015fmaz<\/li>\n\n\n\n<li>Kaynak payla\u015f\u0131m\u0131 yap\u0131lamaz<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Bu nedenle trust, \u00e7ok lokasyonlu veya \u00e7ok organizasyonlu yap\u0131larda <strong>kimlik federasyonunun temelidir<\/strong>.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><strong>Domain Trust T\u00fcrleri (En Derin Teknik Seviyede)<\/strong><\/h1>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>A) Trust Y\u00f6n\u00fc (Direction)<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>One-Way Trust<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Domain A \u2192 Domain B\u2019ye g\u00fcvenir<\/li>\n\n\n\n<li>Domain B \u2192 Domain A\u2019ya g\u00fcvenmez<\/li>\n\n\n\n<li>Kullan\u0131c\u0131 ak\u0131\u015f\u0131 tek y\u00f6nl\u00fcd\u00fcr<\/li>\n\n\n\n<li>G\u00fcvenlik s\u0131n\u0131rlar\u0131n\u0131 s\u0131k\u0131 tutmak i\u00e7in kullan\u0131l\u0131r<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Two-Way Trust<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Her iki domain de birbirine g\u00fcvenir<\/li>\n\n\n\n<li>Cross-domain authentication \u00e7ift y\u00f6nl\u00fcd\u00fcr<\/li>\n\n\n\n<li>En yayg\u0131n senaryodur<\/li>\n\n\n\n<li>Forest i\u00e7i domainlerde otomatik olarak two-way transitive trust vard\u0131r<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>B) Trust Kapsam\u0131 (Scope)<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1) External Trust<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Farkl\u0131 forest\u2019lar aras\u0131nda kurulur<\/li>\n\n\n\n<li><strong>Non-transitive<\/strong> (ge\u00e7i\u015fsiz)<\/li>\n\n\n\n<li>Sadece iki domain aras\u0131nda ge\u00e7erlidir<\/li>\n\n\n\n<li>Senin senaryon (netlab.lc \u2194 newlab.lc) buna \u00f6rnektir<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2) Forest Trust<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u0130ki forest aras\u0131nda kurulur<\/li>\n\n\n\n<li><strong>Transitive<\/strong> olabilir<\/li>\n\n\n\n<li>Forest-wide authentication destekler<\/li>\n\n\n\n<li>B\u00fcy\u00fck organizasyon birle\u015fmelerinde kullan\u0131l\u0131r<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>3) Realm Trust<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AD DS \u2194 Kerberos tabanl\u0131 UNIX\/Linux realm\u2019leri aras\u0131nda<\/li>\n\n\n\n<li>Cross-platform kimlik do\u011frulama sa\u011flar<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>4) Shortcut Trust<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>B\u00fcy\u00fck forest yap\u0131lar\u0131nda authentication s\u00fcresini k\u0131saltmak i\u00e7in<\/li>\n\n\n\n<li>\u00d6zellikle \u00e7ok katmanl\u0131 OU\/domain hiyerar\u015filerinde kullan\u0131l\u0131r<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>C) Authentication Seviyeleri<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1) Forest-Wide Authentication<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kar\u015f\u0131 forest\u2019taki t\u00fcm kullan\u0131c\u0131lar kimlik do\u011frulayabilir<\/li>\n\n\n\n<li>En geni\u015f eri\u015fim modelidir<\/li>\n\n\n\n<li>G\u00fcvenlik a\u00e7\u0131s\u0131ndan daha gev\u015fektir<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>2) Selective Authentication<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sadece izin verilen kullan\u0131c\u0131lar kar\u015f\u0131 forest\u2019a eri\u015febilir<\/li>\n\n\n\n<li>Zero-trust yakla\u015f\u0131m\u0131na daha uygundur<\/li>\n\n\n\n<li>G\u00fcvenlik seviyesi y\u00fcksektir<\/li>\n\n\n\n<li>B\u00fcy\u00fck \u015firketlerde tercih edilir<\/li>\n<\/ul>\n\n\n\n<h1 class=\"wp-block-heading\"><strong>Trust\u2019\u0131n \u00c7al\u0131\u015fmas\u0131 \u0130\u00e7in Gereken Temel Bile\u015fenler<\/strong><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Trust\u2019\u0131n \u00e7al\u0131\u015fmas\u0131 i\u00e7in \u00fc\u00e7 kritik bile\u015fen vard\u0131r:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>A) DNS \u00c7\u00f6z\u00fcmlemesi<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Trust\u2019\u0131n %80\u2019i DNS\u2019tir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Her domain, di\u011fer domainin:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SRV kay\u0131tlar\u0131n\u0131<\/li>\n\n\n\n<li>DC IP adreslerini<\/li>\n\n\n\n<li>Kerberos endpoint\u2019lerini<\/li>\n\n\n\n<li>LDAP\/GC servislerini<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u00e7\u00f6zebilmelidir.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bu nedenle genelde \u015fu y\u00f6ntemler kullan\u0131l\u0131r:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Conditional Forwarder<\/li>\n\n\n\n<li>Stub Zone<\/li>\n\n\n\n<li>Secondary Zone<\/li>\n\n\n\n<li>DNS Forwarding<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Senin senaryonda <strong>DNS forwarding<\/strong> kullan\u0131lm\u0131\u015ft\u0131r.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>B) Kerberos Zaman Senkronizasyonu<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kerberos\u2019un en kat\u0131 kural\u0131:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Client\u2013DC zaman fark\u0131 5 dakikay\u0131 ge\u00e7erse authentication reddedilir.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Bu nedenle:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Her iki domainin PDC Emulator\u2019lar\u0131 ayn\u0131 zaman kayna\u011f\u0131ndan beslenmelidir<\/li>\n\n\n\n<li>Hyper-V\/VMware host time sync DC\u2019lerde kapal\u0131 olmal\u0131d\u0131r<\/li>\n\n\n\n<li>NTP portu (UDP 123) a\u00e7\u0131k olmal\u0131d\u0131r<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Trust\u2019\u0131n \u00e7al\u0131\u015fmamas\u0131n\u0131n en yayg\u0131n nedeni <strong>time skew<\/strong>\u2019d\u00fcr.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>C) G\u00fcvenlik Duvar\u0131 ve Portlar<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Trust i\u00e7in gerekli ba\u015fl\u0131ca portlar:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TCP\/UDP 88 (Kerberos)<\/li>\n\n\n\n<li>TCP\/UDP 389 (LDAP)<\/li>\n\n\n\n<li>TCP 636 (LDAPS)<\/li>\n\n\n\n<li>TCP 3268\/3269 (GC)<\/li>\n\n\n\n<li>TCP 445 (SMB)<\/li>\n\n\n\n<li>TCP\/UDP 53 (DNS)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Bu portlardan biri bile kapal\u0131ysa trust bozulur.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><strong>Trust Tasar\u0131m\u0131nda Dikkat Edilmesi Gerekenler<\/strong><\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">\u2714 Zaman senkronizasyonu tek zincir olmal\u0131<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">\u2714 DNS \u00e7\u00f6z\u00fcmlemesi \u00e7ift y\u00f6nl\u00fc olmal\u0131<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">\u2714 DC\u2019ler aras\u0131nda firewall engeli olmamal\u0131<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">\u2714 Selective Authentication gerekiyorsa \u00f6nceden planlanmal\u0131<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">\u2714 SID filtering davran\u0131\u015f\u0131 bilinmeli<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">\u2714 Trust password d\u00fczenli olarak yenilenmeli (varsay\u0131lan 30 g\u00fcn)<\/h3>\n","protected":false},"excerpt":{"rendered":"<p>Network Yap\u0131s\u0131 Her iki domain controller kendi network segmentinde \u00e7al\u0131\u015fmaktad\u0131r. Yap\u0131lan \u0130\u015flemler Bu test, Kerberos&#8230;<\/p>\n","protected":false},"author":1,"featured_media":107,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,19,18],"tags":[84,240,87,236,239,237,238,241,120,96,242,95,91,243,93,86,235,134,149],"class_list":["post-306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-system","category-windows-system","category-windows","tag-activedirectory","tag-authentication","tag-dns","tag-domain","tag-external","tag-forest","tag-forwarder","tag-identity","tag-infrastructure","tag-kerberos","tag-management","tag-network","tag-replication","tag-security","tag-server","tag-sysadmin","tag-trust","tag-virtualization","tag-windows"],"_links":{"self":[{"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/posts\/306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=306"}],"version-history":[{"count":1,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/posts\/306\/revisions"}],"predecessor-version":[{"id":307,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/posts\/306\/revisions\/307"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=\/wp\/v2\/media\/107"}],"wp:attachment":[{"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ertanerbek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}