Linux Tutorial (10): Security Hardening: Dari Baseline hingga Audit

Layer 1: Network     → Firewall, rate limiting
Layer 2: Host        → SSH hardening, patching
Layer 3: Application → Least privilege, input validation
Layer 4: Data        → Encryption at rest/transit
Layer 5: Monitoring  → Audit log, intrusion detection

# Port non-default (security through obscurity: bukan cukup sendiri)
Port 2222
 
# Authentication
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthenticationMethods publickey
 
# Limit users
AllowUsers deploy admin
DenyUsers baduser
 
# Session limits
MaxAuthTries 3
MaxSessions 5
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
 
# Disable forwarding jika tidak perlu
AllowTcpForwarding no
X11Forwarding no
PermitTunnel no

# Validasi config sebelum restart
sudo sshd -t
sudo systemctl restart sshd
 
# Monitor failed attempts
grep "Failed password" /var/log/auth.log | tail -20
journalctl -u ssh --since "1 hour ago" | grep -i "failed"

# ufw baseline
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment 'SSH'
sudo ufw allow 80,443/tcp comment 'HTTP/HTTPS'
sudo ufw enable
 
# Rate limit SSH brute force
sudo ufw limit 2222/tcp

sudo apt install fail2ban
 
# /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 3600
findtime = 600
maxretry = 3
backend  = systemd
 
[sshd]
enabled  = true
port     = 2222
filter   = sshd
maxretry = 3
bantime  = 86400
 
[nginx-http-auth]
enabled  = true
filter   = nginx-http-auth
port     = http,https
logpath  = /var/log/nginx/error.log
maxretry = 5

sudo systemctl enable --now fail2ban
sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client set sshd unbanip 192.168.1.100

# Status
sudo aa-status
 
# Profile mode
sudo aa-complain /usr/sbin/nginx    # log only
sudo aa-enforce /usr/sbin/nginx     # enforce
 
# List profiles
ls /etc/apparmor.d/

# Status
getenforce                    # Enforcing / Permissive / Disabled
sestatus
 
# Context file
ls -Z /var/www/html/
ps -eZ | grep nginx
 
# Restore default context
sudo restorecon -Rv /var/www/html/
 
# Troubleshoot denial
sudo ausearch -m avc -ts recent
sudo sealert -a /var/log/audit/audit.log

# Install auditd
sudo apt install auditd audispd-plugins
 
# Rules: /etc/audit/rules.d/hardening.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/sudoers -p wa -k sudoers
-a always,exit -F arch=b64 -S execve -k exec_commands
 
# Load rules
sudo augenrules --load
sudo systemctl restart auditd
 
# Search audit log
sudo ausearch -k identity --start today
sudo ausearch -k sshd_config -i

# Ubuntu unattended-upgrades
sudo apt install unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades
 
# /etc/apt/apt.conf.d/50unattended-upgrades
# Unattended-Upgrade::Automatic-Reboot "false";
# Unattended-Upgrade::Mail "admin@example.com";

# IP forwarding (disable jika bukan router)
net.ipv4.ip_forward = 0
 
# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
 
# Ignore source routed packets
net.ipv4.conf.all.accept_source_route = 0
 
# SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
 
# Log martian packets
net.ipv4.conf.all.log_martians = 1
 
# Restrict kernel pointer exposure
kernel.kptr_restrict = 2
 
# Restrict dmesg access
kernel.dmesg_restrict = 1

sudo sysctl --system
sudo sysctl -p /etc/sysctl.d/99-hardening.conf

# AIDE: Advanced Intrusion Detection Environment
sudo apt install aide
sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
 
# Check integrity
sudo aide --check
 
# Automate via cron/systemd timer

# Cek SUID binaries (attack surface)
find / -perm -4000 -type f 2>/dev/null
 
# Cek world-writable files
find / -type f -perm -002 2>/dev/null
 
# Cek file without owner
find / -nouser -o -nogroup 2>/dev/null
 
# Review sudo access
sudo cat /etc/sudoers
getent group sudo

# Lynis security audit
sudo apt install lynis
sudo lynis audit system