BAB 12 - KEAMANAN JARINGAN

Definisi

CIA Triad dalam Konteks Jaringan

Layer Keamanan Jaringan

Defense in Depth untuk Jaringan

Memahami ancaman adalah langkah pertama untuk membangun pertahanan. Setiap serangan jaringan mengeksploitasi kelemahan dalam protokol, konfigurasi, atau manusia.

Kategori Ancaman Jaringan

Serangan Jaringan Umum

Praktik: Reconnaissance dengan Nmap

Bash - Nmap Network Scanning
# 1. Ping scan - cek host yang hidup
$ nmap -sn 192.168.1.0/24

# 2. Port scan standar
$ nmap 192.168.1.1

# 3. Service version detection
$ nmap -sV 192.168.1.1

# 4. OS detection
$ nmap -O 192.168.1.1

# 5. Aggressive scan (OS + version + scripts + traceroute)
$ nmap -A 192.168.1.1

# 6. Stealth scan (SYN scan)
$ sudo nmap -sS 192.168.1.1

# 7. UDP scan
$ sudo nmap -sU 192.168.1.1

# 8. Scan semua port
$ nmap -p- 192.168.1.1

# 9. Vulnerability scan dengan NSE scripts
$ nmap --script vuln 192.168.1.1

# 10. Output ke file
$ nmap -oN scan.txt -oX scan.xml 192.168.1.0/24

Secure network architecture adalah desain jaringan yang mengintegrasikan prinsip keamanan sejak awal. Bukan sekadar menambahkan kontrol keamanan di akhir, tapi security by design.

Prinsip Secure Architecture

Arsitektur Jaringan 3-Tier

Zero Trust Architecture

Prinsip Zero Trust:

1. Verify Explicitly - autentikasi & otorisasi berdasarkan semua data point
2. Use Least Privilege Access - batasi akses dengan JIT/JEA
3. Assume Breach - enkripsi, segmentasi, deteksi real-time

Zero Trust vs Traditional

Firewall adalah sistem keamanan jaringan yang memfilter trafik berdasarkan aturan yang telah ditentukan. Firewall adalah lini pertahanan pertama dalam arsitektur jaringan aman.

Definisi

Jenis Firewall

Praktik: iptables (Linux)

Bash - iptables Firewall Configuration
# 1. Lihat rules yang aktif
$ sudo iptables -L -n -v

# 2. Flush semua rules
$ sudo iptables -F

# 3. Set default policy
$ sudo iptables -P INPUT DROP
$ sudo iptables -P FORWARD DROP
$ sudo iptables -P OUTPUT ACCEPT

# 4. Allow loopback
$ sudo iptables -A INPUT -i lo -j ACCEPT

# 5. Allow established connections
$ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# 6. Allow SSH (port 22)
$ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# 7. Allow HTTP/HTTPS
$ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# 8. Block specific IP
$ sudo iptables -A INPUT -s 192.168.1.100 -j DROP

# 9. Rate limit SSH (anti brute force)
$ sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
$ sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

# 10. Log dropped packets
$ sudo iptables -A INPUT -j LOG --log-prefix "IPTABLES DROP: " --log-level 4

# 11. Save rules (Ubuntu/Debian)
$ sudo apt install iptables-persistent
$ sudo netfilter-persistent save

# 12. Save rules (CentOS/RHEL)
$ sudo iptables-save > /etc/sysconfig/iptables

Praktik: UFW (Uncomplicated Firewall)

Bash - UFW Simplified Firewall
# 1. Install UFW
$ sudo apt install ufw

# 2. Set default policies
$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing

# 3. Allow SSH (PENTING! sebelum enable)
$ sudo ufw allow ssh

# 4. Enable firewall
$ sudo ufw enable

# 5. Cek status
$ sudo ufw status verbose

# 6. Allow HTTP/HTTPS
$ sudo ufw allow http
$ sudo ufw allow https

# 7. Allow specific port
$ sudo ufw allow 8080/tcp

# 8. Allow from specific IP
$ sudo ufw allow from 192.168.1.100

# 9. Deny specific IP
$ sudo ufw deny from 10.0.0.5

# 10. Delete rule
$ sudo ufw status numbered
$ sudo ufw delete 3

# 11. Reset firewall
$ sudo ufw reset

# 12. Logging
$ sudo ufw logging on
$ sudo tail -f /var/log/ufw.log

Network segmentation adalah praktik membagi jaringan menjadi beberapa segmen/zona yang lebih kecil. Tujuannya: membatasi lateral movement attacker jika berhasil masuk ke satu segmen.

Mengapa Segmentasi Penting?

Jenis Segmentasi

Praktik: VLAN Configuration (Cisco)

Cisco IOS - VLAN Configuration
# 1. Create VLAN
Switch(config)# vlan 10
Switch(config-vlan)# name HR_DEPARTMENT
Switch(config-vlan)# exit

Switch(config)# vlan 20
Switch(config-vlan)# name FINANCE
Switch(config-vlan)# exit

Switch(config)# vlan 30
Switch(config-vlan)# name IT_DEPARTMENT
Switch(config-vlan)# exit

# 2. Assign port to VLAN
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit

Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# exit

# 3. Configure trunk port (antar switch)
Switch(config)# interface gigabitEthernet 0/24
Switch(config-if)# switchport mode trunk
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Switch(config-if)# exit

# 4. Verify VLAN
Switch# show vlan brief
Switch# show interfaces trunk

# 5. Inter-VLAN routing (router-on-a-stick)
Router(config)# interface gigabitEthernet 0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address 192.168.10.1 255.255.255.0

Router(config)# interface gigabitEthernet 0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address 192.168.20.1 255.255.255.0

# 6. ACL untuk batasi akses antar VLAN
Router(config)# access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.20.0 0.0.0.255
Router(config)# access-list 100 deny ip any any

Praktik: VLAN di Linux (802.1Q)

Bash - Linux VLAN Configuration
# 1. Install vlan package
$ sudo apt install vlan

# 2. Load 8021q module
$ sudo modprobe 8021q

# 3. Create VLAN interface
$ sudo ip link add link eth0 name eth0.10 type vlan id 10
$ sudo ip link add link eth0 name eth0.20 type vlan id 20

# 4. Assign IP address
$ sudo ip addr add 192.168.10.1/24 dev eth0.10
$ sudo ip addr add 192.168.20.1/24 dev eth0.20

# 5. Bring up interfaces
$ sudo ip link set eth0.10 up
$ sudo ip link set eth0.20 up

# 6. Enable IP forwarding (untuk routing antar VLAN)
$ echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

# 7. Verify
$ cat /proc/net/vlan/config
$ ip -d link show eth0.10

# 8. Persistent configuration (Ubuntu/Debian)
# Edit /etc/network/interfaces:
# auto eth0.10
# iface eth0.10 inet static
#     address 192.168.10.1
#     netmask 255.255.255.0
#     vlan-raw-device eth0

Wi-Fi adalah teknologi jaringan nirkabel yang paling umum digunakan. Namun, sifatnya yang broadcast membuatnya rentan terhadap berbagai serangan. Mengamankan Wi-Fi adalah prioritas utama.

Statistik Wi-Fi Attacks

Ancaman Wi-Fi

Best Practices Wi-Fi Security

Praktik: Wi-Fi Security Audit

Bash - Wi-Fi Security Audit (EDUKASI)
# PERINGATAN: Hanya untuk jaringan Anda sendiri!

# 1. Install aircrack-ng suite
$ sudo apt install aircrack-ng

# 2. Cek wireless interface
$ iwconfig

# 3. Put interface in monitor mode
$ sudo airmon-ng check kill
$ sudo airmon-ng start wlan0

# 4. Scan networks
$ sudo airodump-ng wlan0mon

# 5. Capture handshake (target specific AP)
$ sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# 6. Deauth attack (force client reconnect)
$ sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# 7. Crack WPA2 password
$ aircrack-ng -w wordlist.txt capture-01.cap

# 8. Stop monitor mode
$ sudo airmon-ng stop wlan0mon
$ sudo systemctl restart NetworkManager

# Tools lain:
# - Kismet: wireless network detector
# - Wireshark: packet analysis
# - Fern WiFi Cracker: GUI-based

WPA2 (Wi-Fi Protected Access 2) dan WPA3 adalah standar enkripsi untuk Wi-Fi. Memahami perbedaan dan cara kerjanya penting untuk mengamankan jaringan nirkabel.

Evolusi Wi-Fi Security

Perbedaan Utama

WPA3 Modes

Praktik: Konfigurasi WPA3

OpenWrt - WPA3 Configuration
# Edit /etc/config/wireless

config wifi-device 'radio0'
    option type 'mac80211'
    option path 'pci0000:00/0000:00:01.0'
    option channel 'auto'
    option htmode 'VHT80'

config wifi-iface 'default_radio0'
    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option ssid 'MySecureWiFi'
    
    # WPA3-Personal
    option encryption 'sae-mixed'  # WPA2/WPA3 mixed mode
    option key 'YourStrongPassword123!'
    
    # Atau WPA3-only
    # option encryption 'sae'
    # option key 'YourStrongPassword123!'
    
    # WPA3-Enterprise
    # option encryption 'owe'  # Opportunistic
    # option auth_server '192.168.1.10'
    # option auth_port '1812'
    # option auth_secret 'radius_secret'

# Restart wireless
$ wifi reload

# Verify
$ iwinfo
$ iw dev wlan0 info

VPN (Virtual Private Network) adalah teknologi yang membuat tunnel terenkripsi melalui jaringan publik (internet), memungkinkan komunikasi aman seolah-olah berada di jaringan privat.

Definisi

Jenis VPN

VPN Protocols

Praktik: OpenVPN Setup

Bash - OpenVPN Server Setup
# 1. Install OpenVPN dan EasyRSA
$ sudo apt install openvpn easy-rsa

# 2. Setup PKI (Public Key Infrastructure)
$ make-cadir ~/openvpn-ca
$ cd ~/openvpn-ca

# 3. Edit vars file
$ nano vars
# Set: set_var EASYRSA_REQ_COUNTRY "ID"
# set_var EASYRSA_REQ_PROVINCE "Lampung"
# set_var EASYRSA_REQ_ORG "MyCompany"

# 4. Build CA
$ ./easyrsa init-pki
$ ./easyrsa build-ca

# 5. Generate server certificate
$ ./easyrsa gen-req server nopass
$ ./easyrsa sign-req server server

# 6. Generate DH parameters
$ ./easyrsa gen-dh

# 7. Generate ta.key (TLS auth)
$ openvpn --genkey --secret keys/ta.key

# 8. Copy files to OpenVPN directory
$ sudo cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/dh.pem ~/openvpn-ca/keys/ta.key /etc/openvpn/

# 9. Create server.conf
$ sudo cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
$ sudo gunzip /etc/openvpn/server.conf.gz
$ sudo nano /etc/openvpn/server.conf

# 10. Generate client certificate
$ cd ~/openvpn-ca
$ ./easyrsa gen-req client1 nopass
$ ./easyrsa sign-req client client1

# 11. Start OpenVPN
$ sudo systemctl start openvpn@server
$ sudo systemctl enable openvpn@server

# 12. Check status
$ sudo systemctl status openvpn@server
$ ip addr show tun0

Praktik: WireGuard Setup

Bash - WireGuard (Modern VPN)
# 1. Install WireGuard
$ sudo apt install wireguard

# 2. Generate keys (server)
$ cd /etc/wireguard
$ umask 077
$ wg genkey | tee privatekey | wg pubkey > publickey

# 3. Create server config
$ sudo nano /etc/wireguard/wg0.conf

# [Interface]
# PrivateKey = <server-private-key>
# Address = 10.0.0.1/24
# ListenPort = 51820

# [Peer]
# PublicKey = <client-public-key>
# AllowedIPs = 10.0.0.2/32

# 4. Generate client keys
$ wg genkey | tee client-privatekey | wg pubkey > client-publickey

# 5. Start WireGuard
$ sudo wg-quick up wg0

# 6. Enable IP forwarding
$ echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
$ sudo sysctl -p

# 7. Check status
$ sudo wg show

# 8. Stop WireGuard
$ sudo wg-quick down wg0

IDS (Intrusion Detection System) dan IPS (Intrusion Prevention System) adalah sistem yang mendeteksi dan/atau mencegah aktivitas mencurigakan di jaringan. IDS hanya mendeteksi, IPS mendeteksi DAN memblokir.

Definisi

IDS vs IPS

Detection Methods

IDS/IPS Deployment Types

Praktik: Snort IDS

Bash - Snort IDS Configuration
# 1. Install Snort
$ sudo apt install snort

# 2. Configure network interface
$ sudo nano /etc/snort/snort.conf
# Set: ipvar HOME_NET [192.168.1.0/24]

# 3. Create custom rule
$ sudo nano /etc/snort/rules/local.rules

# Alert on ICMP ping
alert icmp any any -> $HOME_NET any (msg:"ICMP Ping detected"; sid:1000001; rev:1;)

# Alert on SSH login
alert tcp any any -> $HOME_NET 22 (msg:"SSH connection attempt"; sid:1000002; rev:1;)

# Alert on specific IP
alert ip 192.168.1.100 any -> $HOME_NET any (msg:"Suspicious IP detected"; sid:1000003; rev:1;)

# 4. Test configuration
$ sudo snort -T -c /etc/snort/snort.conf

# 5. Run Snort in IDS mode
$ sudo snort -A console -q -c /etc/snort/snort.conf -i eth0

# 6. Run in background with logging
$ sudo snort -D -c /etc/snort/snort.conf -i eth0 -l /var/log/snort

# 7. Check alerts
$ sudo tail -f /var/log/snort/alert

# 8. Use PulledPork for rule updates
$ sudo apt install pulledpork
$ sudo pulledpork -c /etc/pulledpork/pulledpork.conf

Praktik: Suricata IDS/IPS

Bash - Suricata IDS/IPS
# 1. Install Suricata
$ sudo apt install suricata

# 2. Update rules
$ sudo suricata-update

# 3. Configure network
$ sudo nano /etc/suricata/suricata.yaml
# Set: HOME_NET: "[192.168.1.0/24]"

# 4. Test configuration
$ sudo suricata -T -c /etc/suricata/suricata.yaml

# 5. Run Suricata
$ sudo suricata -c /etc/suricata/suricata.yaml -i eth0

# 6. Check logs
$ sudo tail -f /var/log/suricata/fast.log
$ sudo tail -f /var/log/suricata/eve.json

# 7. Enable IPS mode (inline)
# Edit suricata.yaml:
# af-packet:
#   - interface: eth0
#     ips: yes

# 8. Use with systemd
$ sudo systemctl start suricata
$ sudo systemctl enable suricata

Network monitoring adalah proses continuous monitoring trafik, performa, dan keamanan jaringan. Tujuannya: deteksi dini masalah, troubleshooting, dan memastikan ketersediaan layanan.

Tujuan Network Monitoring

Monitoring Tools

Praktik: tcpdump

Bash - tcpdump Packet Capture
# 1. Capture all traffic
$ sudo tcpdump -i eth0

# 2. Capture specific protocol
$ sudo tcpdump -i eth0 tcp
$ sudo tcpdump -i eth0 udp
$ sudo tcpdump -i eth0 icmp

# 3. Capture specific port
$ sudo tcpdump -i eth0 port 80
$ sudo tcpdump -i eth0 port 443
$ sudo tcpdump -i eth0 port 22

# 4. Capture specific IP
$ sudo tcpdump -i eth0 host 192.168.1.100
$ sudo tcpdump -i eth0 src host 192.168.1.100
$ sudo tcpdump -i eth0 dst host 192.168.1.100

# 5. Capture with verbose output
$ sudo tcpdump -i eth0 -vv -X

# 6. Save to file
$ sudo tcpdump -i eth0 -w capture.pcap

# 7. Read from file
$ tcpdump -r capture.pcap

# 8. Complex filter
$ sudo tcpdump -i eth0 'tcp port 80 and host 192.168.1.100'

# 9. Capture with packet count limit
$ sudo tcpdump -i eth0 -c 100

# 10. Capture HTTP GET requests
$ sudo tcpdump -i eth0 -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -i "GET"

Praktik: Prometheus + Grafana

Bash - Prometheus + Grafana Setup
# 1. Install Prometheus
$ sudo apt install prometheus

# 2. Configure Prometheus
$ sudo nano /etc/prometheus/prometheus.yml

# global:
#   scrape_interval: 15s

# scrape_configs:
#   - job_name: 'node'
#     static_configs:
#       - targets: ['localhost:9100']

# 3. Install node_exporter
$ sudo apt install prometheus-node-exporter

# 4. Install Grafana
$ wget -q -O - https://packages.grafana.com/gpg.key | sudo apt-key add -
$ echo "deb https://packages.grafana.com/oss/deb stable main" | sudo tee /etc/apt/sources.list.d/grafana.list
$ sudo apt update
$ sudo apt install grafana

# 5. Start services
$ sudo systemctl start prometheus
$ sudo systemctl start prometheus-node-exporter
$ sudo systemctl start grafana-server

# 6. Enable on boot
$ sudo systemctl enable prometheus
$ sudo systemctl enable grafana-server

# 7. Access Grafana
# http://localhost:3000
# Default login: admin/admin

# 8. Add Prometheus data source
# Configuration -> Data Sources -> Add data source -> Prometheus
# URL: http://localhost:9090

# 9. Import dashboard
# Dashboards -> Import -> Import ID: 1860 (Node Exporter Full)

Praktik: SNMP Monitoring

Bash - SNMP Monitoring
# 1. Install SNMP tools
$ sudo apt install snmp snmpd

# 2. Configure snmpd
$ sudo nano /etc/snmp/snmpd.conf

# sysLocation "Server Room"
# sysContact "admin@example.com"
# rocommunity public 192.168.1.0/24

# 3. Restart snmpd
$ sudo systemctl restart snmpd

# 4. Query SNMP
$ snmpwalk -v2c -c public localhost system

# 5. Get specific OID
$ snmpget -v2c -c public localhost sysDescr.0

# 6. Monitor interface traffic
$ snmpwalk -v2c -c public localhost ifInOctets
$ snmpwalk -v2c -c public localhost ifOutOctets

# 7. Monitor CPU load
$ snmpwalk -v2c -c public localhost hrProcessorLoad

Analisis network traffic adalah proses examining paket data untuk memahami pola komunikasi, mendeteksi anomali, dan mengidentifikasi ancaman. Ini adalah skill fundamental bagi security analyst.

Tujuan Analisis Traffic

Praktik: Wireshark

Wireshark - Network Analysis
# 1. Install Wireshark
$ sudo apt install wireshark

# 2. Add user to wireshark group
$ sudo usermod -aG wireshark $USER

# 3. Start Wireshark
$ wireshark

# 4. Command-line capture with tshark
$ tshark -i eth0

# 5. Capture with filter
$ tshark -i eth0 -f "port 80"

# 6. Save capture
$ tshark -i eth0 -w capture.pcap

# 7. Read capture file
$ tshark -r capture.pcap

# 8. Display filters in Wireshark:
# ip.addr == 192.168.1.100
# tcp.port == 80
# http.request.method == "GET"
# dns.qry.name contains "google"
# icmp
# tcp.flags.syn == 1

# 9. Follow TCP stream
# Right-click packet -> Follow -> TCP Stream

# 10. Export objects
# File -> Export Objects -> HTTP

Common Display Filters

Praktik: Analisis Serangan

Wireshark - Attack Analysis
# 1. Detect port scan
# Filter: tcp.flags.syn == 1 and tcp.flags.ack == 0
# Look for: many SYN packets to different ports from same source

# 2. Detect SYN flood
# Filter: tcp.flags.syn == 1
# Look for: high volume of SYN packets without corresponding ACK

# 3. Detect ARP spoofing
# Filter: arp
# Look for: multiple ARP replies with same IP but different MAC

# 4. Detect DNS tunneling
# Filter: dns and udp.port == 53
# Look for: unusually large DNS queries or high frequency

# 5. Detect cleartext credentials
# Filter: http.request.method == "POST"
# Look for: password fields in plaintext

# 6. Detect C2 communication
# Filter: tcp.flags.push == 1
# Look for: regular interval connections to suspicious IPs

# 7. Detect data exfiltration
# Filter: tcp.flags.push == 1 and frame.len > 1000
# Look for: large outbound transfers

# 8. Statistics -> Conversations
# See top talkers by bytes/packets

# 9. Statistics -> Protocol Hierarchy
# See protocol distribution

# 10. Statistics -> IO Graphs
# Visualize traffic over time

Praktik: NetFlow Analysis

Bash - NetFlow/sFlow Analysis
# 1. Install nfdump
$ sudo apt install nfdump

# 2. Install nfcapd (NetFlow collector)
$ sudo apt install nfdump-sflow

# 3. Start collector
$ sudo nfcapd -l /var/log/netflow -p 2055 -D

# 4. Read NetFlow data
$ nfdump -r /var/log/netflow/nfcapd.202609091430

# 5. Top talkers
$ nfdump -r /var/log/netflow/nfcapd.202609091430 -s srcip

# 6. Top destinations
$ nfdump -r /var/log/netflow/nfcapd.202609091430 -s dstip

# 7. Top ports
$ nfdump -r /var/log/netflow/nfcapd.202609091430 -s port

# 8. Filter by IP
$ nfdump -r /var/log/netflow/nfcapd.202609091430 "src ip 192.168.1.100"

# 9. Statistics
$ nfdump -r /var/log/netflow/nfcapd.202609091430 -s record

# 10. Use nfdump with nfprofile for long-term analysis
$ nfprofile -r /var/log/netflow/nfcapd.202609091430

Praktik: Zeek (Bro) IDS

Bash - Zeek Network Analysis
# 1. Install Zeek
$ echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | sudo tee /etc/apt/sources.list.d/zeek.list
$ sudo apt update
$ sudo apt install zeek

# 2. Configure Zeek
$ sudo nano /opt/zeek/etc/node.cfg

# [zeek]
# type=standalone
# host=localhost
# interface=eth0

# 3. Deploy Zeek
$ sudo /opt/zeek/bin/zeekctl deploy

# 4. Check status
$ sudo /opt/zeek/bin/zeekctl status

# 5. View logs
$ sudo tail -f /opt/zeek/logs/current/conn.log
$ sudo tail -f /opt/zeek/logs/current/dns.log
$ sudo tail -f /opt/zeek/logs/current/http.log

# 6. Analyze logs with zeek-cut
$ cat /opt/zeek/logs/current/conn.log | /opt/zeek/bin/zeek-cut id.orig_h id.resp_h proto

# 7. Stop Zeek
$ sudo /opt/zeek/bin/zeekctl stop

Analisis Kasus

Uji pemahaman Anda tentang Bab 12! Target minimal: 70% untuk melanjutkan ke Bab 13.