ABDURROZAK.MY.ID // DEBIAN LINUX SERVER FUNDAMENTAL
SSH & REMOTEADMINISTRATION
Volume 08 dari seri Debian Linux Server Fundamental. Panduan komprehensif mengelola Debian Server dari jarak jauh menggunakan SSH. Setiap command dijelaskan detail dengan syntax, parameter, contoh penggunaan, dan output. Dari instalasi OpenSSH hingga hardening SSH.
VOLUME08 / 17
SUB-BAB7
BACA75 MENIT
SSH100%
ABDUR ROZAK, S.Kom.
Web Developer & System Administrator - abdurrozak.my.id
VOLUME 08 / 17
MENGELOLA DEBIAN SERVER DARI JARAK JAUH
Panduan lengkap SSH & Remote Administration di Debian Linux. 7 sub-bab mencakup instalasi OpenSSH Server, remote server menggunakan SSH, SCP dan SFTP, SSH Key Authentication, konfigurasi sshd, membatasi akses SSH, hingga basic hardening SSH. Setiap command disertai penjelasan detail dan contoh praktis.
SUB-BAB7LEVELSSH & RemoteWAKTU75 MENIT
01
SUB-BAB 01 INSTALASI
INSTALASI OPENSSH SERVER
Apa Itu OpenSSH?
OpenSSH adalah implementasi open-source dari protokol SSH (Secure Shell). SSH memungkinkan koneksi remote yang aman ke server melalui enkripsi. OpenSSH terdiri dari dua komponen: openssh-server (sshd - server daemon) dan openssh-client (ssh - client command).
Instalasi OpenSSH Server
bash
# Update package listadmin@server:~$ sudo apt update# Install OpenSSH Serveradmin@server:~$ sudo apt install openssh-serverReading package lists... DoneBuilding dependency tree... DoneThe following additional packages will be installed: ncurses-term openssh-sftp-serverSuggested packages: molly-guard monkeysphere ssh-askpassThe following NEW packages will be installed: ncurses-term openssh-server openssh-sftp-server0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.Need to get 456 kB of archives.After this operation, 1,534 kB of additional disk space will be used.Do you want to continue? [Y/n]Y# Verifikasi instalasiadmin@server:~$ systemctl status ssh● ssh.service - OpenBSD Secure Shell server Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled) Active: active (running) since Mon 2026-09-07 10:30:15 WIB; 5s ago Docs: man:sshd(8) man:sshd_config(5) Process: 1234 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS) Process: 1235 ExecStart=/usr/sbin/sshd (code=exited, status=0/SUCCESS) Main PID: 1236 (sshd)# Cek versi SSHadmin@server:~$ ssh -VOpenSSH_9.2p1 Debian-2+deb12u1, OpenSSL 3.0.11 19 Sep 2023# Cek port SSH yang listeningadmin@server:~$ ss -tuln | grep :22tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:*tcp LISTEN 0 128 [::]:22 [::]:*
# Install UFW jika belum adaadmin@server:~$ sudo apt install ufw# Allow SSH melalui firewalladmin@server:~$ sudo ufw allow sshRules updatedRules updated (v6)# Atau allow port 22 secara eksplisitadmin@server:~$ sudo ufw allow 22/tcp# Enable UFWadmin@server:~$ sudo ufw enableCommand may disrupt existing ssh connections. Proceed with operation (y|n)?yFirewall is active and enabled on system startup# Cek status UFWadmin@server:~$ sudo ufw statusStatus: activeTo Action From-- ------ ----22/tcp ALLOW Anywhere22/tcp (v6) ALLOW Anywhere (v6)# Cek status verboseadmin@server:~$ sudo ufw status verbose
PERINGATAN: Selalu allow SSH sebelum enable UFW! Jika tidak, kamu akan terkunci dari server dan harus akses secara fisik untuk recovery.
KOMPETENSI SUB-BAB 01
Mampu install OpenSSH Server
Mampu mengelola service SSH (start, stop, restart, reload)
Mampu enable/disable SSH on boot
Mampu konfigurasi firewall untuk SSH
02
SUB-BAB 02 REMOTE SSH
REMOTE SERVER MENGGUNAKAN SSH
Koneksi SSH Dasar
bash - dari client
# Koneksi SSH ke serverlocal@client:~$ ssh admin@192.168.1.10The authenticity of host '192.168.1.10 (192.168.1.10)' can't be established.ED25519 key fingerprint is SHA256:ABC123...This key is not known by any other namesAre you sure you want to continue connecting (yes/no/[fingerprint])?yesWarning: Permanently added '192.168.1.10' (ED25519) to the list of known hosts.admin@192.168.1.10's password:Linux server 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1The programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extentpermitted by applicable law.Last login: Mon Sep 7 10:30:15 2026 from 192.168.1.100admin@server:~$
# Koneksi dengan user dan port tertentulocal@client:~$ ssh -p 2222 admin@192.168.1.10# Koneksi dengan verbose mode (debug)local@client:~$ ssh -v admin@192.168.1.10# Koneksi dengan verbose mode lebih detaillocal@client:~$ ssh -vvv admin@192.168.1.10# Keluar dari SSH sessionadmin@server:~$ exitConnection to 192.168.1.10 closed.# Atau tekan Ctrl+D
Menjalankan Command Remote
bash - dari client
# Jalankan single command di serverlocal@client:~$ ssh admin@192.168.1.10 "uname -a"Linux server 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1# Jalankan multiple commandslocal@client:~$ ssh admin@192.168.1.10 "uptime && df -h" 10:30:15 up 5 days, 3:15, 1 user, load average: 0.08, 0.03, 0.01Filesystem Size Used Avail Use% Mounted on/dev/sda1 50G 10G 40G 20% /# Jalankan command dengan output ke file lokallocal@client:~$ ssh admin@192.168.1.10 "df -h" > server-disk.txt# Jalankan command dengan input dari file lokallocal@client:~$ ssh admin@192.168.1.10 "cat > remote-file.txt" < local-file.txt
SSH Config File
bash
# Edit SSH config filelocal@client:~$ nano ~/.ssh/config# Isi file config:# Server produksiHost production HostName 192.168.1.10 User admin Port 22 IdentityFile ~/.ssh/id_rsa# Server developmentHost dev HostName 192.168.1.20 User developer Port 2222 IdentityFile ~/.ssh/id_ed25519# Server dengan custom settingsHost custom HostName 10.0.0.10 User admin Port 22 IdentityFile ~/.ssh/id_rsa Compression yes ServerAliveInterval 60 ServerAliveCountMax 3# Sekarang bisa connect dengan aliaslocal@client:~$ ssh productionlocal@client:~$ ssh dev
TIPS: Gunakan SSH config file untuk menyimpan konfigurasi server yang sering diakses. Ini memudahkan koneksi dan memungkinkan custom settings per server.
KOMPETENSI SUB-BAB 02
Mampu koneksi SSH ke server
Mampu jalankan command remote
Mampu konfigurasi SSH config file
Mampu gunakan SSH dengan alias
03
SUB-BAB 03 SCP & SFTP
SCP DAN SFTP
SCP - Secure Copy
bash
# Copy file dari lokal ke serverlocal@client:~$ scp file.txt admin@192.168.1.10:/home/admin/file.txt 100% 1234 1.2MB/s 00:00# Copy file dari server ke lokallocal@client:~$ scp admin@192.168.1.10:/home/admin/file.txt ./# Copy directory secara recursivelocal@client:~$ scp -r directory/ admin@192.168.1.10:/home/admin/# Copy dengan port customlocal@client:~$ scp -P 2222 file.txt admin@192.168.1.10:/home/admin/# Copy dengan verbose modelocal@client:~$ scp -v file.txt admin@192.168.1.10:/home/admin/# Copy dengan compressionlocal@client:~$ scp -C file.txt admin@192.168.1.10:/home/admin/# Copy multiple fileslocal@client:~$ scp file1.txt file2.txt admin@192.168.1.10:/home/admin/# Copy dengan wildcardlocal@client:~$ scp *.txt admin@192.168.1.10:/home/admin/# Copy antara dua server remotelocal@client:~$ scp admin@192.168.1.10:/home/admin/file.txt admin@192.168.1.20:/home/admin/
SFTP - SSH File Transfer Protocol
bash
# Koneksi SFTP ke serverlocal@client:~$ sftp admin@192.168.1.10Connected to 192.168.1.10.sftp># Lihat directory di serversftp>lsfile1.txt file2.txt directory/# Pindah directory di serversftp>cd directory# Lihat directory lokalsftp>lls# Pindah directory lokalsftp>lcd /path/to/local# Upload filesftp>put file.txtUploading file.txt to /home/admin/file.txtfile.txt 100% 1234 1.2MB/s 00:00# Upload directorysftp>put -r directory/# Download filesftp>get file.txtFetching /home/admin/file.txt to file.txt# Download directorysftp>get -r directory/# Buat directory di serversftp>mkdir newdir# Hapus file di serversftp>rm file.txt# Hapus directory di serversftp>rmdir directory# Keluar dari SFTPsftp>exit# Atau tekan Ctrl+D
Perbedaan SCP dan SFTP
FEATURE
SCP
SFTP
Interactive
Tidak
Ya
Resume transfer
Tidak
Ya
Browse remote
Tidak
Ya
Speed
Lebih cepat
Sedikit lebih lambat
Use case
Transfer cepat
Interactive file management
TIPS: Gunakan SCP untuk transfer cepat dan sederhana. Gunakan SFTP untuk interactive file management atau ketika perlu resume transfer.
KOMPETENSI SUB-BAB 03
Mampu copy file dengan SCP
Mampu copy directory dengan SCP
Mampu gunakan SFTP interactive
Memahami perbedaan SCP dan SFTP
04
SUB-BAB 04 SSH KEY
SSH KEY AUTHENTICATION
Apa Itu SSH Key?
SSH Key Authentication menggunakan asymmetric encryption (public-private key pair) untuk autentikasi. Lebih aman daripada password karena:
Tidak bisa di-brute force
Lebih panjang dan kompleks dari password
Bisa dilindungi dengan passphrase
Tidak perlu kirim password melalui network
Generate SSH Key Pair
bash - di client
# Generate SSH key dengan RSA (4096 bit)local@client:~$ ssh-keygen -t rsa -b 4096 -C "admin@client"Generating public/private rsa key pair.Enter file in which to save the key (/home/local/.ssh/id_rsa):[Enter]Created directory '/home/local/.ssh'.Enter passphrase (empty for no passphrase):[Enter passphrase]Enter same passphrase again:[Enter passphrase]Your identification has been saved in /home/local/.ssh/id_rsaYour public key has been saved in /home/local/.ssh/id_rsa.pubThe key fingerprint is:SHA256:ABC123... admin@clientThe key's randomart image is:+---[RSA 4096]----+| || || |+----[SHA256]-----+# Generate SSH key dengan Ed25519 (lebih modern dan aman)local@client:~$ ssh-keygen -t ed25519 -C "admin@client"# Lihat public keylocal@client:~$ cat ~/.ssh/id_rsa.pubssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ... admin@client# Lihat private keylocal@client:~$ cat ~/.ssh/id_rsa-----BEGIN OPENSSH PRIVATE KEY-----...-----END OPENSSH PRIVATE KEY-----
Copy Public Key ke Server
bash - di client
# Cara 1: Gunakan ssh-copy-id (paling mudah)local@client:~$ ssh-copy-id admin@192.168.1.10/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/local/.ssh/id_rsa.pub"/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installedadmin@192.168.1.10's password:Number of key(s) added: 1Now try logging into the machine, with: "ssh 'admin@192.168.1.10'"and check to make sure that only the key(s) you wanted were added.# Cara 2: Copy manual dengan SSHlocal@client:~$ cat ~/.ssh/id_rsa.pub | ssh admin@192.168.1.10 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"# Cara 3: Copy manual dengan SCPlocal@client:~$ scp ~/.ssh/id_rsa.pub admin@192.168.1.10:~/.ssh/authorized_keys# Test koneksi dengan SSH keylocal@client:~$ ssh admin@192.168.1.10Last login: Mon Sep 7 10:30:15 2026 from 192.168.1.100admin@server:~$# Tidak perlu password!
Manage SSH Keys di Server
bash - di server
# Lihat authorized keysadmin@server:~$ cat ~/.ssh/authorized_keysssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ... admin@client# Tambah key baruadmin@server:~$ echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys# Set permission yang benaradmin@server:~$ chmod 700 ~/.sshadmin@server:~$ chmod 600 ~/.ssh/authorized_keys# Hapus key tertentuadmin@server:~$ nano ~/.ssh/authorized_keys# Hapus baris key yang tidak diinginkan# Lihat fingerprint dari authorized keysadmin@server:~$ ssh-keygen -lf ~/.ssh/authorized_keys
PERINGATAN: Jangan pernah share private key! Private key harus dijaga kerahasiaannya. Hanya public key yang boleh di-share ke server.
KOMPETENSI SUB-BAB 04
Mampu generate SSH key pair
Mampu copy public key ke server
Mampu manage authorized keys di server
Mampu koneksi SSH tanpa password
05
SUB-BAB 05 SSHD CONFIG
KONFIGURASI SSHD
File Konfigurasi sshd
File konfigurasi utama SSH server adalah /etc/ssh/sshd_config. File ini mengontrol semua aspek perilaku SSH server.
bash
# Edit file konfigurasi sshdadmin@server:~$ sudo nano /etc/ssh/sshd_config# Backup sebelum editadmin@server:~$ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup# Lihat konfigurasi saat iniadmin@server:~$ sudo cat /etc/ssh/sshd_config# Lihat konfigurasi yang aktif (tidak termasuk comment)admin@server:~$ sudo grep -v "^#" /etc/ssh/sshd_config | grep -v "^$"
Konfigurasi Penting
/etc/ssh/sshd_config
# Port SSH (default 22)Port 22# Protocol version (hanya SSH2)Protocol 2# Host keysHostKey /etc/ssh/ssh_host_rsa_keyHostKey /etc/ssh/ssh_host_ecdsa_keyHostKey /etc/ssh/ssh_host_ed25519_key# LoggingSyslogFacility AUTHLogLevel INFO# AuthenticationLoginGraceTime 2mPermitRootLogin noStrictModes yesMaxAuthTries 3MaxSessions 10# Public key authenticationPubkeyAuthentication yes# Password authenticationPasswordAuthentication yes# Empty passwordsPermitEmptyPasswords no# Challenge-response authenticationChallengeResponseAuthentication no# Use PAMUsePAM yes# Allow only specific users#AllowUsers admin user1 user2# Allow only specific groups#AllowGroups sshusers admins# X11 forwardingX11Forwarding yes# Print message of the dayPrintMotd no# Accept locale environment variablesAcceptEnv LANG LC_*# Subsystem sftpSubsystem sftp /usr/lib/openssh/sftp-server
Apply Konfigurasi
bash
# Test konfigurasi sebelum applyadmin@server:~$ sudo sshd -t# Jika tidak ada output, konfigurasi valid# Reload SSH service (tanpa disconnect)admin@server:~$ sudo systemctl reload ssh# Atau restart SSH serviceadmin@server:~$ sudo systemctl restart ssh# Cek status SSHadmin@server:~$ systemctl status ssh
PERINGATAN: Selalu test konfigurasi dengan sshd -t sebelum reload/restart. Jika ada error di konfigurasi, kamu bisa terkunci dari server!
TIPS: Buka session SSH kedua sebelum restart SSH untuk testing. Jika konfigurasi salah dan kamu terkunci, masih ada session kedua yang bisa digunakan untuk fix.
KOMPETENSI SUB-BAB 05
Mampu edit file konfigurasi sshd
Mampu test konfigurasi sebelum apply
Mampu reload/restart SSH service
Memahami konfigurasi penting sshd
06
SUB-BAB 06 BATASI AKSES
MEMBATASI AKSES SSH
Batasi User yang Bisa SSH
/etc/ssh/sshd_config
# Allow hanya user tertentuAllowUsers admin user1 user2# Allow semua user kecuali tertentuDenyUsers guest test# Allow hanya group tertentuAllowGroups sshusers admins# Deny group tertentuDenyGroups guests# Disable root loginPermitRootLogin no# Allow root login hanya dengan SSH keyPermitRootLogin prohibit-password# Allow root login dari IP tertentu sajaMatch Address 192.168.1.100 PermitRootLogin yes
Batasi IP yang Bisa SSH
/etc/ssh/sshd_config
# Allow hanya dari IP tertentuAllowUsers admin@192.168.1.100 admin@192.168.1.101# Allow dari network tertentuAllowUsers admin@192.168.1.*# Atau gunakan AllowGroups dengan MatchMatch Address 192.168.1.0/24 AllowGroups sshusers# Deny dari IP tertentuDenyUsers *@10.0.0.*
Gunakan Fail2ban
bash
# Install fail2banadmin@server:~$ sudo apt install fail2ban# Copy konfigurasi defaultadmin@server:~$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local# Edit konfigurasiadmin@server:~$ sudo nano /etc/fail2ban/jail.local# Konfigurasi untuk SSH:[sshd]enabled = trueport = sshfilter = sshdlogpath = /var/log/auth.logmaxretry = 3bantime = 3600findtime = 600# Restart fail2banadmin@server:~$ sudo systemctl restart fail2ban# Cek status fail2banadmin@server:~$ sudo fail2ban-client statusStatus|- Number of jail: 1`- Jail list: sshd# Cek status jail SSHadmin@server:~$ sudo fail2ban-client status sshdStatus for the jail: sshd|- Filter| |- Currently failed: 0| |- Total failed: 0| `- File list: /var/log/auth.log`- Actions |- Currently banned: 0 |- Total banned: 0 `- Banned IP list:# Unban IPadmin@server:~$ sudo fail2ban-client set sshd unbanip 192.168.1.100
TIPS: Fail2ban akan otomatis ban IP yang gagal login berkali-kali. Ini mencegah brute force attack.
KOMPETENSI SUB-BAB 06
Mampu batasi user yang bisa SSH
Mampu batasi IP yang bisa SSH
Mampu install dan konfigurasi fail2ban
Mampu manage fail2ban bans
07
SUB-BAB 07 HARDENING
BASIC HARDENING SSH
Konfigurasi Hardening
/etc/ssh/sshd_config
# Ganti port SSH (default 22)Port 2222# Disable root loginPermitRootLogin no# Disable password authentication (gunakan SSH key saja)PasswordAuthentication no# Disable empty passwordsPermitEmptyPasswords no# Disable challenge-response authenticationChallengeResponseAuthentication no# Disable X11 forwarding (jika tidak perlu)X11Forwarding no# Disable TCP forwarding (jika tidak perlu)AllowTcpForwarding no# Disable agent forwarding (jika tidak perlu)AllowAgentForwarding no# Limit authentication attemptsMaxAuthTries 3# Limit login grace timeLoginGraceTime 60# Limit max sessionsMaxSessions 5# Disable user environmentPermitUserEnvironment no# Use strict modesStrictModes yes# Use PAMUsePAM yes# Use only strong ciphersCiphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr# Use only strong MACsMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-256# Use only strong key exchange algorithmsKexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512# Disable unused authentication methodsHostbasedAuthentication noIgnoreRhosts yes# Log levelLogLevel VERBOSE# Client alive settingsClientAliveInterval 300ClientAliveCountMax 2# Disable unused authentication methodsHostbasedAuthentication noIgnoreRhosts yes# Log levelLogLevel VERBOSE# Client alive settingsClientAliveInterval 300ClientAliveCountMax 2# Banner (pesan sebelum login)Banner /etc/ssh/banner# Buat file banneradmin@server:~$ sudo nano /etc/ssh/banner************************************************************** WARNING: Authorized access only. All activities are ** monitored and logged. Unauthorized access is prohibited. **************************************************************
# Test konfigurasi sshdadmin@server:~$ sudo sshd -t# Jika tidak ada output, konfigurasi valid# Test koneksi dari clientlocal@client:~$ ssh -p 2222 admin@192.168.1.10************************************************************** WARNING: Authorized access only. All activities are ** monitored and logged. Unauthorized access is prohibited. **************************************************************admin@192.168.1.10's password:# Test dengan verbose mode untuk debuglocal@client:~$ ssh -vvv -p 2222 admin@192.168.1.10# Test dengan specific cipherlocal@client:~$ ssh -c aes256-gcm@openssh.com -p 2222 admin@192.168.1.10
Checklist Hardening
CONFIGURATION
RECOMMENDED
STATUS
Port
Change from 22
✓
PermitRootLogin
no
✓
PasswordAuthentication
no (use SSH keys)
✓
MaxAuthTries
3
✓
LoginGraceTime
60
✓
Ciphers
Strong ciphers only
✓
MACs
Strong MACs only
✓
KexAlgorithms
Strong KEX only
✓
Fail2ban
Installed & configured
✓
UFW
Enabled with SSH rule
✓
PERINGATAN: Sebelum apply hardening, pastikan kamu punya akses alternatif (console access) ke server. Jika konfigurasi SSH salah, kamu bisa terkunci dari server!
TIPS: Gunakan tools seperti ssh-audit untuk audit konfigurasi SSH: ssh-audit 192.168.1.10
KOMPETENSI SUB-BAB 07
Mampu konfigurasi hardening SSH
Mampu generate strong host keys
Mampu test konfigurasi SSH
Memahami checklist hardening SSH
VOLUME 08 SELESAI
SELAMAT!
Kamu telah menyelesaikan Volume 08 - SSH & Remote Administration. Dari instalasi OpenSSH Server, remote server menggunakan SSH, SCP dan SFTP, SSH Key Authentication, konfigurasi sshd, membatasi akses SSH, hingga basic hardening SSH. Kamu sekarang menguasai SSH & Remote Administration di Debian Linux. Di Volume 09, kita akan dalami Firewall & Security. Sampai jumpa!