Instalasi CyberPanel AlmaLinux 9 Sekaligus Hardening Server

11. Amankan sudo

Buat aturan khusus:

visudo -f /etc/sudoers.d/andika

Isi:

Defaults:andika use_pty
Defaults:andika timestamp_timeout=5
andika ALL=(ALL) ALL

Atur izin:

chmod 440 /etc/sudoers.d/andika
visudo -c

Jangan menggunakan:

NOPASSWD: ALL

untuk akun administrator utama.

12. Aktifkan Fail2Ban

Buat konfigurasi:

nano /etc/fail2ban/jail.local

Isi:

[DEFAULT]
banaction = firewallcmd-rich-rules
banaction_allports = firewallcmd-rich-rules
findtime = 10m
bantime = 1h
maxretry = 4
backend = systemd
ignoreip = 127.0.0.1/8 ::1 IP_ADMIN_ANDA

[sshd]
enabled = true
port = 22779
mode = aggressive
maxretry = 4
findtime = 10m
bantime = 24h

Aktifkan:

systemctl enable --now fail2ban
systemctl restart fail2ban

Periksa:

fail2ban-client status
fail2ban-client status sshd
journalctl -u fail2ban --no-pager -n 50

13. Aktifkan pembaruan keamanan otomatis

Edit:

nano /etc/dnf/automatic.conf

Pastikan bagian ini:

[commands]
upgrade_type = security
random_sleep = 300
download_updates = yes
apply_updates = yes

[emitters]
emit_via = stdio

[base]
debuglevel = 1

Aktifkan timer:

systemctl enable --now dnf-automatic.timer
systemctl list-timers | grep dnf

Perlu diperhatikan bahwa pembaruan otomatis sistem tidak selalu memperbarui CyberPanel. Periksa pembaruan CyberPanel secara berkala dan lakukan backup/snapshot sebelum upgrade besar.

14. Aktifkan audit sistem

Instal dan aktifkan audit daemon:

dnf install -y audit
systemctl enable --now auditd

Tambahkan pemantauan berkas sensitif:

cat > /etc/audit/rules.d/hardening.rules <<'EOF'
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
-w /etc/ssh/sshd_config -p wa -k sshd
-w /etc/ssh/sshd_config.d/ -p wa -k sshd
-w /etc/firewalld/ -p wa -k firewall
EOF

Muat ulang:

augenrules --load
auditctl -l

Melihat perubahan:

ausearch -k sshd
ausearch -k sudoers

15. Hardening kernel dan jaringan

Buat:

nano /etc/sysctl.d/99-server-hardening.conf

Isi:

# Proteksi spoofing dan redirect
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Reverse path filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# SYN protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_rfc1337 = 1

# Log paket mencurigakan
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Proteksi informasi kernel
kernel.dmesg_restrict = 1
kernel.kptr_restrict = 2
kernel.yama.ptrace_scope = 1

# Proteksi symlink dan hardlink
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2

# Core dump
fs.suid_dumpable = 0
kernel.core_uses_pid = 1
EOF

Terapkan:

sysctl --system

Jangan menambahkan parameter jaringan agresif yang belum diuji karena dapat mengganggu mail, container, DNS, atau koneksi web.