Konfigurasi Dasar Server Linux

Server Linux yang terkonfigurasi dengan baik adalah kunci untuk infrastruktur IT yang handal dan aman.

Prasyarat

• Fresh install Linux server (Ubuntu/Debian/CentOS)
• Akses root atau sudo privileges
• Koneksi internet

Update System

Debian/Ubuntu

apt update && apt upgrade -y

CentOS/RHEL

yum update -y

Konfigurasi SSH

Edit SSH Config

nano /etc/ssh/sshd_config

Pengaturan yang Disarankan

# Disable root login
PermitRootLogin no

# Disable password authentication (gunakan key-based auth)
PasswordAuthentication no

# Ubah default port
Port 2222

# Limit user yang boleh login
AllowUsers username1 username2

Restart SSH Service

systemctl restart sshd
# atau
service sshd restart

Setup Firewall

UFW (Ubuntu)

apt install ufw
ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp    # SSH port
ufw allow 80/tcp      # HTTP
ufw allow 443/tcp     # HTTPS
ufw enable

firewalld (CentOS)

systemctl start firewalld
systemctl enable firewalld
firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

User Management

Create User dengan Sudo Access

# Create user
adduser username

# Add to sudo group (Debian/Ubuntu)
usermod -aG sudo username

# Add to wheel group (CentOS)
usermod -aG wheel username

Setup SSH Key Authentication

# Generate SSH key di client
ssh-keygen -t rsa -b 4096

# Copy ke server
ssh-copy-id username@server_ip

# Atau manual
ssh username@server_ip "mkdir -p ~/.ssh"
cat ~/.ssh/id_rsa.pub | ssh username@server_ip "cat >> ~/.ssh/authorized_keys"

Timezone Configuration

# List available timezones
timedatectl list-timezones

# Set timezone
timedatectl set-timezone Asia/Jakarta

Install Essential Packages

Debian/Ubuntu

apt install -y \
    vim \
    git \
    curl \
    wget \
    htop \
    tree \
    net-tools \
    unzip \
    build-essential

CentOS/RHEL

yum install -y \
    vim \
    git \
    curl \
    wget \
    htop \
    tree \
    net-tools \
    unzip \
    gcc \
    make

System Hardening

Disable IPv6 (opsional)

echo "net.ipv6.conf.all.disable_ipv6 = 1" >> /etc/sysctl.conf
echo "net.ipv6.conf.default.disable_ipv6 = 1" >> /etc/sysctl.conf
sysctl -p

Secure Shared Memory

echo "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0" >> /etc/fstab

Limit Network Services

# Lihat service yang listening
netstat -tulpn
# atau
ss -tulpn

# Disable service yang tidak diperlukan
systemctl disable servicename

Log Management

Setup Log Rotation

# Edit logrotate config
nano /etc/logrotate.conf

# Contoh config untuk custom log
/path/to/logfile.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
}

Configure Logwatch (opsional)

# Debian/Ubuntu
apt install logwatch

# CentOS
yum install logwatch

# Konfigurasi
cp /usr/share/logwatch/default.conf/logwatch.conf /etc/logwatch/conf/

Automated Backups

Setup Backup Script

nano /usr/local/bin/backup.sh

#!/bin/bash
BACKUP_DIR="/backup"
DATE=$(date +%Y%m%d_%H%M%S)
mkdir -p $BACKUP_DIR

# Backup important directories
tar -czf $BACKUP_DIR/backup_$DATE.tar.gz \
    /etc \
    /home \
    /var/www

# Keep last 7 days backup
find $BACKUP_DIR -name "backup_*.tar.gz" -mtime +7 -delete

chmod +x /usr/local/bin/backup.sh

# Add to crontab
crontab -e

# Run daily at 2 AM
0 2 * * * /usr/local/bin/backup.sh

Monitoring Dasar

Install Monitoring Tool

# Install htop untuk resource monitoring
apt install htop  # Debian/Ubuntu
yum install htop  # CentOS

Check System Health

# Disk usage
df -h

# Memory usage
free -m

# CPU usage
top
# atau
htop

# Network connections
netstat -tulpn

Tips Tambahan

1. Selalu backup sebelum melakukan perubahan besar
2. Gunakan version control untuk config files
3. Document semua perubahan yang dilakukan
4. Test changes di staging environment dulu
5. Subscribe security mailing list untuk distro Anda

Kesimpulan

Server yang terkonfigurasi dengan baik akan lebih aman, reliable, dan mudah di-maintenance. Ikuti best practices di atas untuk setup server produksi Anda.