Linux Server Administration

# Koneksi SSH dengan password
ssh user@192.168.1.100

# Koneksi SSH dengan port custom
ssh -p 2222 user@192.168.1.100

# Koneksi SSH dengan private key
ssh -i ~/.ssh/id_rsa user@192.168.1.100

# Copy file dari local ke server
scp file.txt user@server:/home/user/

# Copy file dari server ke local
scp user@server:/var/log/app.log ./

# Copy direktori secara rekursif
scp -r ./myapp user@server:/opt/

# SSH tunneling (port forwarding)
ssh -L 8080:localhost:80 user@server  # Local port 8080 → server port 80

# Langkah 1: Generate SSH key pair di mesin lokal
ssh-keygen -t ed25519 -C "admin@myserver.com"
# Tekan Enter untuk menyimpan di default (~/.ssh/id_ed25519)
# Masukkan passphrase (opsional tapi direkomendasikan)

# Output:
# Generating public/private ed25519 key pair.
# Your identification has been saved in /home/user/.ssh/id_ed25519
# Your public key has been saved in /home/user/.ssh/id_ed25519.pub

# Langkah 2: Copy public key ke server
ssh-copy-id user@192.168.1.100

# Atau secara manual:
cat ~/.ssh/id_ed25519.pub | ssh user@192.168.1.100 "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

# Langkah 3: Coba login tanpa password
ssh user@192.168.1.100  # Harusnya tidak perlu password lagi

# Langkah 4 (Opsional): Disable password authentication
# Edit /etc/ssh/sshd_config di server:
# PasswordAuthentication no
# PermitRootLogin no
# ChallengeResponseAuthentication no
# Lalu restart sshd:
sudo systemctl restart sshd

# ~/.ssh/config di mesin lokal

# Server produksi
Host production
    HostName 192.168.1.100
    User deploy
    Port 22
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60
    ServerAliveCountMax 3

# Server staging via bastion/jump host
Host staging
    HostName 10.0.2.50
    User admin
    ProxyJump bastion

Host bastion
    HostName 203.0.113.50
    User jumpuser
    Port 2222

# Sekarang cukup:
ssh production      # = ssh -i ~/.ssh/id_ed25519 -p 22 deploy@192.168.1.100
ssh staging         # = ssh melalui bastion → staging

# Tambah user baru
sudo useradd -m -s /bin/bash -G sudo budi
# -m = buat home directory
# -s = set shell default
# -G = tambahkan ke grup

# Set password untuk user baru
sudo passwd budi

# Tambah user dengan spesifikasi lengkap
sudo useradd -m -d /home/sari -s /bin/bash -c "Web Developer" -G sudo,www-data sari

# Modifikasi user
sudo usermod -aG docker budi      # Tambahkan user budi ke grup docker
sudo usermod -s /usr/sbin/nologin botuser  # Disable interactive login
sudo usermod -L olduser            # Lock/disable user account

# Hapus user
sudo userdel -r olduser            # -r = hapus juga home directory

# Lihat informasi user
id budi                             # Lihat UID, GID, dan grup
whoami                             # User saat ini
who                                # Siapa yang sedang login
last -10                           # 10 login terakhir

# Lihat permissions
ls -la /var/www/
# -rw-r--r-- 1 www-data www-data 4096 Jun 25 10:00 index.html
# ▲▲▲        ▲▲▲         ▲▲▲
# owner      group       others
# rwx        rwx         rwx

# Ubah permissions dengan chmod (numeric mode)
chmod 755 script.sh      # rwxr-xr-x (owner=rwx, group=r-x, others=r-x)
chmod 644 index.html     # rw-r--r-- (owner=rw, group=r, others=r)
chmod 600 id_rsa         # rw------- (hanya owner, untuk private key SSH)
chmod 700 ~/.ssh         # rwx------ (hanya owner untuk folder .ssh)

# Ubah permissions dengan chmod (symbolic mode)
chmod u+x script.sh     # Tambah execute untuk owner
chmod g+w file.txt      # Tambah write untuk group
chmod o-rwx secret.txt  # Hapus semua permission untuk others
chmod a+r readme.txt    # Tambah read untuk semua (all)

# Ubah owner dan group
sudo chown budi:www-data /var/www/html
sudo chown -R www-data:www-data /var/www/html    # Rekursif

# Setgid: file baru otomatis punya group parent directory
chmod g+s /var/www/shared/

# Setgid: sticky bit untuk folder shared
chmod +t /tmp  # Hanya owner file yang bisa hapus file di /tmp

# Angka dalam chmod:
# r=4, w=2, x=1
# 7=4+2+1 (rwx), 6=4+2 (rw-), 5=4+1 (r-x), 4=r-- (read only)

# Jalankan perintah sebagai root
sudo apt update

# Edit file sebagai root
sudo nano /etc/nginx/nginx.conf

# Switch ke root shell (gunakan dengan hati-hati)
sudo -i

# Jalankan perintah sebagai user lain
sudo -u www-data cat /var/www/secret.txt

# Edit sudoers file dengan aman (JANGAN langsung edit /etc/sudoers)
sudo visudo

# Tambahkan user ke grup sudo
sudo usermod -aG sudo budi

# Contoh /etc/sudoers.d/custom:
# budi ALL=(ALL) ALL                    # Full access dengan password
# deploy ALL=(ALL) NOPASSWD: ALL        # Full access tanpa password
# www-data ALL=(ALL) NOPASSWD: /usr/sbin/nginx  # Hanya nginx command

# Start/stop/restart service
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx      # Reload config tanpa restart

# Enable/disable service (auto-start saat boot)
sudo systemctl enable nginx
sudo systemctl disable nginx

# Lihat status service
sudo systemctl status nginx
# Output: active (running) sejak Mon 2026-06-25

# Lihat semua service yang aktif
systemctl list-units --type=service --state=running

# Lihat semua service yang failed
systemctl --failed

# Lihat log service tertentu
journalctl -u nginx -f           # Follow real-time
journalctl -u nginx --since today # Log hari ini saja
journalctl -u nginx --since "2026-06-25 10:00" --until "2026-06-25 12:00"
journalctl -u nginx -n 100       # 100 baris log terakhir
journalctl -p err -u nginx       # Hanya log level error

# Enable dan start sekaligus
sudo systemctl enable --now nginx

[Unit]
Description=My Node.js Application
Documentation=https://docs.myapp.com
After=network.target postgresql.service
Requires=postgresql.service

[Service]
Type=simple
User=deploy
Group=deploy
WorkingDirectory=/opt/myapp
ExecStart=/usr/bin/node /opt/myapp/server.js
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=10
Environment=NODE_ENV=production
Environment=PORT=3000
EnvironmentFile=/opt/myapp/.env

# Security hardening
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/opt/myapp/logs /opt/myapp/uploads
PrivateTmp=true

# Resource limits
LimitNOFILE=65535
LimitNPROC=4096

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=myapp

[Install]
WantedBy=multi-user.target

# Reload systemd untuk membaca unit file baru
sudo systemctl daemon-reload

# Enable dan start service
sudo systemctl enable --now myapp

# Cek status
sudo systemctl status myapp

# Lihat log aplikasi
journalctl -u myapp -f

# Edit unit file (buka editor)
sudo systemctl edit myapp  # Untuk override/drop-in

# Edit crontab untuk user saat ini
crontab -e

# Lihat crontab saat ini
crontab -l

# Edit crontab untuk user lain (root only)
sudo crontab -u deploy -e

# Contoh crontab entries:
# ┌─── Backup database setiap jam 2 pagi
# │
0 2 * * * /opt/scripts/backup_db.sh >> /var/log/backup.log 2>&1

# Membersihkan file temporary setiap hari jam 3 pagi
0 3 * * * find /tmp -type f -mtime +7 -delete

# Restart web server setiap Minggu jam 4 pagi
0 4 * * 0 systemctl restart nginx

# Cek disk usage setiap 6 jam
0 */6 * * * /opt/scripts/check_disk.sh

# Deploy otomatis setiap push ke main (via webhook, bukan cron)
# Tapi cron bisa pull repo setiap 5 menit:
*/5 * * * * cd /opt/myapp && git pull origin main 2>&1 | logger -t autodeploy

# Kirim laporan harian jam 8 pagi
0 8 * * * /opt/scripts/daily_report.sh | mail -s "Daily Report" admin@company.com

# Cron dengan timezone (systemd)
# Tambahkan CRON_TZ=Asia/Jakarta di awal crontab
CRON_TZ=Asia/Jakarta
0 7 * * * /opt/scripts/morning_task.sh

# /etc/systemd/system/backup.timer
[Unit]
Description=Backup database harian

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true
RandomizedDelaySec=300

[Install]
WantedBy=timers.target

# /etc/systemd/system/backup.service
[Unit]
Description=Run database backup

[Service]
Type=oneshot
ExecStart=/opt/scripts/backup_db.sh
User=deploy

# Aktifkan timer
sudo systemctl enable --now backup.timer

# Lihat semua timer aktif
systemctl list-timers --all

# Lihat penggunaan disk (human-readable)
df -h
# Filesystem      Size  Used Avail Use% Mounted on
# /dev/sda1        50G   32G   16G  67% /
# /dev/sdb1       200G   45G  145G  24% /data

# Lihat penggunaan per direktori
du -sh /var/log        # Total ukuran /var/log
du -sh /home/*         # Ukuran setiap home directory
du -sh /* 2>/dev/null  # Ukuran setiap direktori root

# Top 10 direktori terbesar
du -h --max-depth=1 / 2>/dev/null | sort -hr | head -10

# Lihat info block device
lsblk
# NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
# sda      8:0    0   50G  0 disk
# ├─sda1   8:1    0   50G  0 part /
# sdb      8:16   0  200G  0 disk
# └─sdb1   8:17   0  200G  0 part /data

# Lihat info filesystem
sudo blkid           # UUID dan tipe filesystem
sudo fdisk -l        # Tabel partisi lengkap

# Langkah 1: Buat partisi baru pada /dev/sdb
sudo fdisk /dev/sdb
# Commands: n (new), p (primary), 1 (number), w (write)

# Langkah 2: Format partisi dengan ext4
sudo mkfs.ext4 /dev/sdb1

# Langkah 3: Buat mount point
sudo mkdir -p /data

# Langkah 4: Mount partisi
sudo mount /dev/sdb1 /data

# Langkah 5: Tambahkan ke /etc/fstab untuk auto-mount saat boot
echo 'UUID=xxxx-xxxx  /data  ext4  defaults,noatime  0  2' | sudo tee -a /etc/fstab

# Cek fstab sebelum reboot (penting!)
sudo mount -a

# Resize partisi ext4 (jika disk di-expand di cloud)
sudo resize2fs /dev/sdb1

# Lihat disk I/O
iostat -xz 1 5       # Monitor I/O setiap 1 detik, 5 kali
iotop                # Top untuk disk I/O (seperti top)

# Cek swap saat ini
sudo swapon --show
free -h

# Buat swap file 2GB
sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# Tambahkan ke fstab agar persisten
echo '/swapfile  none  swap  sw  0  0' | sudo tee -a /etc/fstab

# Tuning swappiness (10 = gunakan swap hanya saat benar-benar perlu)
sudo sysctl vm.swappiness=10
echo 'vm.swappiness=10' | sudo tee -a /etc/sysctl.conf

# Lihat konfigurasi IP
ip addr show               # Atau: ip a
ip route show              # Tabel routing

# Cek konektivitas
ping -c 4 google.com
traceroute google.com

# Cek port yang sedang terbuka (listening)
ss -tlnp                   # TCP listening ports
ss -ulnp                   # UDP listening ports
ss -tp                     # Semua koneksi TCP aktif

# Alternatif lama (masih banyak digunakan)
netstat -tlnp              # TCP listening
netstat -anp | grep :80    # Cek koneksi ke port 80

# DNS lookup
dig beebanelabs.pages.dev
nslookup beebanelabs.pages.dev
host beebanelabs.pages.dev

# Test koneksi ke port tertentu
nc -zv 192.168.1.100 22    # Test SSH
telnet 192.168.1.100 80    # Test HTTP

# Download file
wget https://example.com/file.tar.gz
curl -O https://example.com/file.tar.gz
curl -I https://example.com  # Hanya headers

# Lihat hostname dan IP
hostname
hostname -I

# Aktifkan UFW
sudo ufw enable

# Set default policy
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Izinkan port spesifik
sudo ufw allow 22/tcp        # SSH
sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS
sudo ufw allow 8080/tcp      # Custom app

# Izinkan dari IP tertentu
sudo ufw allow from 192.168.1.0/24 to any port 22    # SSH dari LAN saja
sudo ufw allow from 10.0.0.0/8 to any port 3306      # MySQL dari internal

# Izinkan dengan deskripsi
sudo ufw allow 8443/tcp comment 'Grafana HTTPS'

# Hapus rule
sudo ufw delete allow 8080/tcp
sudo ufw delete 3            # Hapus rule nomor 3

# Lihat status dan rules
sudo ufw status verbose
sudo ufw status numbered

# Disable firewall (untuk debugging)
sudo ufw disable

# Konfigurasi static IP (Ubuntu 20.04+)
network:
  version: 2
  ethernets:
    eth0:
      dhcp4: false
      addresses:
        - 192.168.1.100/24
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses:
          - 8.8.8.8
          - 8.8.4.4
          - 1.1.1.1

# Terapkan konfigurasi
sudo netplan apply

# Cek hasil
sudo netplan try   # Coba dulu, auto-rollback jika gagal

# 1. Update sistem
sudo apt update && sudo apt upgrade -y
sudo apt autoremove -y

# 2. Install unattended-upgrades untuk auto security patches
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# 3. Install & konfigurasi fail2ban
sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit /etc/fail2ban/jail.local:
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
banaction = ufw

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 86400
EOF

sudo systemctl enable --now fail2ban

# 4. Harden SSH config (/etc/ssh/sshd_config)
sudo sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/#MaxAuthTries 6/MaxAuthTries 3/' /etc/ssh/sshd_config
sudo sed -i 's/#ClientAliveInterval 0/ClientAliveInterval 300/' /etc/ssh/sshd_config
sudo sed -i 's/#ClientAliveCountMax 3/ClientAliveCountMax 2/' /etc/ssh/sshd_config
echo "AllowUsers deploy admin" | sudo tee -a /etc/ssh/sshd_config
sudo systemctl restart sshd

# 5. Kernel hardening (/etc/sysctl.conf)
cat > /etc/sysctl.d/99-security.conf << 'EOF'
# Disable IP forwarding (jika bukan router)
net.ipv4.ip_forward = 0

# Disable ICMP redirect
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Enable SYN cookie (anti SYN flood)
net.ipv4.tcp_syncookies = 1

# Log Martian packets
net.ipv4.conf.all.log_martians = 1

# Disable IPv6 jika tidak diperlukan
net.ipv6.conf.all.disable_ipv6 = 1
EOF
sudo sysctl --system

# 6. Scan untuk malware
sudo apt install rkhunter
sudo rkhunter --check --skip-keypress