ABDURROZAK.MY.ID // DEBIAN LINUX SERVER FUNDAMENTAL

LINUX SERVERSECURITY

Volume 15 dari seri Debian Linux Server Fundamental. Panduan komprehensif dasar keamanan Debian Server. Setiap command dan script dijelaskan detail dengan penjelasan per baris. Dari update security, firewall, UFW/nftables, SSH hardening, user security, permission security, Fail2ban, hingga basic server hardening.

VOLUME15 / 17

SUB-BAB8

BACA90 MENIT

SECURITY100%

ABDUR ROZAK, S.Kom. Web Developer & Network Educator - abdurrozak.my.id

VOLUME 15 / 17

DASAR KEAMANAN DEBIAN SERVER

Panduan lengkap Linux Server Security di Debian Linux. 8 sub-bab mencakup update security, firewall, UFW atau nftables, SSH hardening, user security, permission security, Fail2ban, hingga basic server hardening. Setiap command dan script disertai penjelasan detail per baris.

SUB-BAB8 LEVELSecurity WAKTU90 MENIT

SUB-BAB 01 UPDATE

UPDATE SECURITY

Update Package

UPDATE

# Update package list
sudo apt update

# Upgrade package
sudo apt upgrade

# Upgrade package dengan auto-confirm
sudo apt upgrade -y

# Full upgrade (upgrade dengan dependency changes)
sudo apt full-upgrade -y

# Dist-upgrade (upgrade dengan dependency changes dan remove obsolete)
sudo apt dist-upgrade -y

# Auto-remove obsolete packages
sudo apt autoremove -y

# Auto-clean cached packages
sudo apt autoclean

# Clean all cached packages
sudo apt clean

Unattended Upgrades

UNATTENDED

# Install unattended-upgrades
sudo apt install unattended-upgrades apt-listchanges

# Configure unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# Edit configuration
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

# Enable security updates
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
    "${distro_id}:${distro_codename}-updates";
};

# Enable automatic updates
sudo nano /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";

# Test unattended-upgrades
sudo unattended-upgrades --dry-run

# Run unattended-upgrades
sudo unattended-upgrades

# Check logs
sudo tail -f /var/log/unattended-upgrades/unattended-upgrades.log

Security Updates Only

SECURITY

# Install only security updates
sudo apt upgrade -t $(lsb_release -cs)-security

# List security updates
sudo apt list --upgradable | grep security

# Install security updates only
sudo apt-get upgrade -t $(lsb_release -cs)-security -y

# Check for security updates
sudo apt-get -s dist-upgrade | grep "^Inst" | grep -i securi

KOMPETENSI SUB-BAB 01

Mampu update package secara manual
Mampu konfigurasi unattended-upgrades
Mampu install security updates only
Mampu check security updates

SUB-BAB 02 FIREWALL

FIREWALL KONSEP

Apa Itu Firewall?

Firewall adalah sistem keamanan jaringan yang memonitor dan mengontrol traffic jaringan berdasarkan aturan keamanan yang telah ditentukan. Firewall dapat berupa hardware, software, atau kombinasi keduanya.

Jenis Firewall

JENIS	DESKRIPSI	CONTOH
Packet Filter	Filter berdasarkan header packet	iptables, nftables
Stateful	Filter berdasarkan state koneksi	iptables, nftables
Application	Filter berdasarkan aplikasi	WAF, proxy
Hardware	Hardware dedicated	Fortinet, Cisco ASA

Firewall Actions

ACTION	DESKRIPSI
ACCEPT	Terima packet
DROP	Tolak packet (tidak ada response)
REJECT	Tolak packet (dengan response)
LOG	Log packet
RETURN	Kembali ke chain sebelumnya

KOMPETENSI SUB-BAB 02

Memahami konsep firewall
Memahami jenis firewall
Memahami firewall actions

SUB-BAB 03 UFW/NFTABLES

UFW ATAU NFTABLES

UFW (Uncomplicated Firewall)

UFW

# Install UFW
sudo apt install ufw

# Reset UFW
sudo ufw reset

# Set default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH
sudo ufw allow ssh
sudo ufw allow 22/tcp

# Allow HTTP
sudo ufw allow http
sudo ufw allow 80/tcp

# Allow HTTPS
sudo ufw allow https
sudo ufw allow 443/tcp

# Allow specific port
sudo ufw allow 8080/tcp

# Allow specific port with protocol
sudo ufw allow 53/udp

# Allow from specific IP
sudo ufw allow from 192.168.1.100

# Allow from specific IP to specific port
sudo ufw allow from 192.168.1.100 to any port 22

# Allow from specific subnet
sudo ufw allow from 192.168.1.0/24

# Deny specific port
sudo ufw deny 23/tcp

# Delete rule
sudo ufw delete allow 23/tcp

# Delete rule by number
sudo ufw status numbered
sudo ufw delete 3

# Enable UFW
sudo ufw enable

# Disable UFW
sudo ufw disable

# Check status
sudo ufw status
sudo ufw status verbose
sudo ufw status numbered

# Reload UFW
sudo ufw reload

# Reset UFW
sudo ufw reset

nftables

NFTABLES

# Install nftables
sudo apt install nftables

# Enable nftables
sudo systemctl enable nftables
sudo systemctl start nftables

# Check status
sudo systemctl status nftables

# Edit configuration
sudo nano /etc/nftables.conf

# Basic configuration
#!/usr/sbin/nft -f
flush ruleset
 
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        
        # Allow established connections
        ct state established,related accept
        
        # Allow loopback
        iif lo accept
        
        # Allow SSH
        tcp dport 22 accept
        
        # Allow HTTP
        tcp dport 80 accept
        
        # Allow HTTPS
        tcp dport 443 accept
        
        # Allow ICMP
        ip protocol icmp accept
    }
    
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

# Load configuration
sudo nft -f /etc/nftables.conf

# Check rules
sudo nft list ruleset

# Flush rules
sudo nft flush ruleset

KOMPETENSI SUB-BAB 03

Mampu install dan konfigurasi UFW
Mampu install dan konfigurasi nftables
Mampu allow/deny port dan IP
Mampu check status firewall

SUB-BAB 04 SSH

SSH HARDENING

SSH Hardening

SSH HARDENING

# Edit SSH configuration
sudo nano /etc/ssh/sshd_config

# Change default port
Port 2222

# Disable root login
PermitRootLogin no

# Disable password authentication
PasswordAuthentication no

# Enable public key authentication
PubkeyAuthentication yes

# Disable empty passwords
PermitEmptyPasswords no

# Disable X11 forwarding
X11Forwarding no

# Disable TCP forwarding
AllowTcpForwarding no

# Disable agent forwarding
AllowAgentForwarding no

# Limit authentication attempts
MaxAuthTries 3

# Limit login grace time
LoginGraceTime 60

# Allow only specific users
AllowUsers admin user1 user2

# Allow only specific groups
AllowGroups sshusers

# Disable protocol 1
Protocol 2

# Use strong ciphers
Ciphers aes256-gcm@openssh.com,aes256-ctr,aes256-cbc

# Use strong MACs
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

# Use strong key exchange
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org

# Restart SSH
sudo systemctl restart ssh

SSH Key Authentication

SSH KEY

# Generate SSH key pair (client)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Generate SSH key pair with RSA (client)
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

# Copy public key to server
ssh-copy-id user@server-ip

# Copy public key manually
cat ~/.ssh/id_ed25519.pub | ssh user@server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# Set permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Test SSH key authentication
ssh user@server-ip

# Use specific key
ssh -i ~/.ssh/id_ed25519 user@server-ip

KOMPETENSI SUB-BAB 04

Mampu hardening SSH configuration
Mampu generate SSH key pair
Mampu copy public key to server
Mampu configure SSH key authentication

SUB-BAB 05 USER

USER SECURITY

User Security Best Practices

USER SECURITY

# Create user with no login shell
sudo useradd -M -s /sbin/nologin username

# Create user with home directory
sudo useradd -m username

# Set password
sudo passwd username

# Set strong password policy
sudo apt install libpam-pwquality
sudo nano /etc/security/pwquality.conf
minlen = 12
minclass = 4
maxrepeat = 3
maxclassrepeat = 4

# Lock user account
sudo usermod -L username

# Unlock user account
sudo usermod -U username

# Delete user
sudo userdel username

# Delete user with home directory
sudo userdel -r username

# Add user to group
sudo usermod -aG groupname username

# Remove user from group
sudo gpasswd -d username groupname

# List user groups
groups username

# List all users
cut -d: -f1 /etc/passwd

# List all groups
cut -d: -f1 /etc/group

# Check user password expiry
sudo chage -l username

# Set password expiry
sudo chage -M 90 username

# Set password expiry warning
sudo chage -W 7 username

KOMPETENSI SUB-BAB 05

Mampu create user dengan security best practices
Mampu set strong password policy
Mampu lock/unlock user account
Mampu manage user groups

SUB-BAB 06 PERMISSION

PERMISSION SECURITY

Permission Security Best Practices

PERMISSION

# Check file permissions
ls -la /path/to/file

# Set file permissions
chmod 644 /path/to/file

# Set directory permissions
chmod 755 /path/to/directory

# Set owner and group
chown user:group /path/to/file

# Set owner and group recursively
chown -R user:group /path/to/directory

# Set permissions recursively
chmod -R 755 /path/to/directory

# Set sticky bit
chmod +t /tmp

# Set setuid bit
chmod u+s /path/to/file

# Set setgid bit
chmod g+s /path/to/directory

# Remove setuid bit
chmod u-s /path/to/file

# Remove setgid bit
chmod g-s /path/to/directory

# Find files with setuid bit
find / -perm -4000 -type f 2>/dev/null

# Find files with setgid bit
find / -perm -2000 -type f 2>/dev/null

# Find world-writable files
find / -perm -0002 -type f 2>/dev/null

# Find world-writable directories
find / -perm -0002 -type d 2>/dev/null

KOMPETENSI SUB-BAB 06

Mampu check file permissions
Mampu set file and directory permissions
Mampu set special bits (sticky, setuid, setgid)
Mampu find files with special permissions

SUB-BAB 07 FAIL2BAN

FAIL2BAN INSTALLATION

Install Fail2ban

FAIL2BAN

# Install fail2ban
sudo apt install fail2ban

# Enable fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# Check status
sudo systemctl status fail2ban

# Copy configuration
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit configuration
sudo nano /etc/fail2ban/jail.local

# Basic configuration
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5
 
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
 
[apache-auth]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/error.log
maxretry = 3

# Restart fail2ban
sudo systemctl restart fail2ban

# Check status
sudo fail2ban-client status

# Check SSH status
sudo fail2ban-client status sshd

# Check logs
sudo tail -f /var/log/fail2ban.log

# Unban IP
sudo fail2ban-client set sshd unbanip 192.168.1.100

# Ban IP
sudo fail2ban-client set sshd banip 192.168.1.100

KOMPETENSI SUB-BAB 07

Mampu install fail2ban
Mampu konfigurasi fail2ban
Mampu check fail2ban status
Mampu ban/unban IP

SUB-BAB 08 HARDENING

BASIC SERVER HARDENING

Basic Server Hardening Checklist

HARDENING

# 1. Update system
sudo apt update && sudo apt upgrade -y

# 2. Install security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# 3. Configure firewall
sudo apt install ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable

# 4. Harden SSH
sudo nano /etc/ssh/sshd_config
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 60
sudo systemctl restart ssh

# 5. Install fail2ban
sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# 6. Configure fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

# 7. Create non-root user
sudo adduser username
sudo usermod -aG sudo username

# 8. Configure SSH key authentication
ssh-keygen -t ed25519
ssh-copy-id username@server-ip

# 9. Disable root login
sudo nano /etc/ssh/sshd_config
PermitRootLogin no

# 10. Configure automatic security updates
sudo nano /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

# 11. Configure log rotation
sudo nano /etc/logrotate.conf

# 12. Configure NTP
sudo apt install ntp
sudo systemctl enable ntp
sudo systemctl start ntp

# 13. Configure sysctl
sudo nano /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
sudo sysctl -p

# 14. Configure file permissions
sudo chmod 600 /etc/shadow
sudo chmod 644 /etc/passwd
sudo chmod 600 /etc/gshadow
sudo chmod 644 /etc/group

# 15. Disable unused services
sudo systemctl list-unit-files --state=enabled
sudo systemctl disable service-name

# 16. Configure automatic updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# 17. Configure log monitoring
sudo apt install logwatch
sudo logwatch --output mail --mailto admin@example.com --detail high

# 18. Configure automatic security audits
sudo apt install lynis
sudo lynis audit system

# 19. Configure automatic backups
sudo apt install rsync
sudo crontab -e
0 2 * * * rsync -av /etc /backup/etc

# 20. Configure automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

KOMPETENSI SUB-BAB 08

Mampu melakukan basic server hardening
Mampu configure automatic security updates
Mampu configure log monitoring
Mampu configure automatic backups

VOLUME 15 SELESAI

SELAMAT!

Kamu telah menyelesaikan Volume 15 - Linux Server Security. Dari update security, firewall, UFW/nftables, SSH hardening, user security, permission security, Fail2ban, hingga basic server hardening. Kamu sekarang menguasai dasar keamanan Debian Server. Di Volume 16, kita akan dalami Backup & Recovery. Sampai jumpa!

SUB-BAB8 LEVELSecurity NEXTBackup & Recovery

ABDURROZAK.MY.ID // TERHUBUNG

JARINGAN SOSIAL

Temukan saya di berbagai platform digital

s.id GitHub Instagram Threads Facebook TikTok YT Teacher YT Course YT Studio Hashnode WhatsApp Email

LINUX SERVERSECURITY

DASAR KEAMANAN DEBIAN SERVER

UPDATE SECURITY

Update Package

Unattended Upgrades

Security Updates Only

FIREWALL KONSEP

Apa Itu Firewall?

Jenis Firewall

Firewall Actions

UFW ATAU NFTABLES

UFW (Uncomplicated Firewall)

nftables

SSH HARDENING

SSH Hardening

SSH Key Authentication

USER SECURITY

User Security Best Practices

PERMISSION SECURITY

Permission Security Best Practices

FAIL2BAN INSTALLATION

Install Fail2ban

BASIC SERVER HARDENING

Basic Server Hardening Checklist

SELAMAT!

JARINGAN SOSIAL

BANTUAN