Generator Skrip Hardening Server Linux (CIS Benchmark)

Parameter Keamanan Server

#!/usr/bin/env bash
# ==============================================================================
# Linux Server Production Hardening Script (CIS Benchmark Inspired)
# Generated by PuluhLabs Enterprise Cloud Infrastructure Engine
# Target OS: Ubuntu 22.04 / 24.04 LTS & Debian 12
# ==============================================================================

set -euo pipefail

echo "==> [1/7] Memperbarui Repositori & Paket Sistem..."
export DEBIAN_FRONTEND=noninteractive
apt-get update && apt-get upgrade -y
apt-get install -y ufw fail2ban unattended-upgrades curl git htop net-tools

echo "==> [2/7] Mengonfigurasi Automatic Security Updates..."
cat << 'EOF' > /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
EOF

echo "==> [3/7] Mengamankan Konfigurasi SSH Daemon..."
sed -i -E 's/^#?Port [0-9]+/Port 2222/' /etc/ssh/sshd_config
sed -i -E 's/^#?PermitRootLogin .+/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i -E 's/^#?PasswordAuthentication .+/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i -E 's/^#?X11Forwarding .+/X11Forwarding no/' /etc/ssh/sshd_config
sed -i -E 's/^#?MaxAuthTries .+/MaxAuthTries 4/' /etc/ssh/sshd_config
systemctl restart ssh || systemctl restart sshd
echo "    [OK] SSH berjalan di port 2222 (Hanya login via SSH Key)"

echo "==> [4/7] Mengonfigurasi UFW Firewall..."
ufw --force reset
ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp comment 'SSH Custom Port'
ufw allow 80/tcp comment 'HTTP Web'
ufw allow 443/tcp comment 'HTTPS Web (TLS)'
ufw --force enable
echo "    [OK] Firewall aktif (Hanya port 2222, 80, dan 443 yang dibuka)"

echo "==> [5/7] Mengonfigurasi Fail2ban Anti-Brute Force..."
cat << 'EOF' > /etc/fail2ban/jail.local
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port = 2222
EOF
systemctl restart fail2ban
echo "    [OK] Fail2ban aktif (Auto-ban IP setelah 5x gagal login)"

echo "==> [6/7] Menerapkan Hardening Kernel Sysctl (Anti-SYN Flood & Spoofing)..."
cat << 'EOF' > /etc/sysctl.d/99-puluhlabs-hardening.conf
# Proteksi Serangan Jaringan
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Optimasi Buffer Jaringan High-Concurrency
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_fin_timeout = 15
EOF
sysctl -p /etc/sysctl.d/99-puluhlabs-hardening.conf
echo "    [OK] Kernel sysctl hardening aktif"

echo "==> [7/7] Menyiapkan Swap Space (2G) untuk Mencegah OOM Crash..."
if [ ! -f /swapfile ]; then
    fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
    chmod 600 /swapfile
    mkswap /swapfile
    swapon /swapfile
    echo '/swapfile none swap sw 0 0' >> /etc/fstab
    echo "    [OK] Swapfile 2G berhasil dibuat"
else
    echo "    [SKIP] Swapfile sudah ada"
fi

echo "=============================================================================="
echo " [SELESAI] Server Linux Anda Telah Berhasil Dikeraskan (Hardened)!"
echo " Silakan uji koneksi SSH baru di jendela terminal lain SEBELUM keluar:"
echo "   ssh -p 2222 username@<IP_SERVER>"
echo "=============================================================================="