Kernel Hardening Linux: Cara Membuat Server Kamu Benar-benar Aman

Kernel adalah jantung sistem operasi. Jika kernel bisa dieksploitasi, attacker punya akses penuh ke seluruh sistem. Hardening kernel adalah proses memperkuat pertahanan di level terdalam sistem operasi.

Sysctl Hardening

Sysctl adalah interface untuk mengubah parameter kernel secara runtime. Dengan mengatur parameter yang tepat, kamu bisa memblokir banyak jenis serangan.

Buat File Konfigurasi

# /etc/sysctl.d/99-hardening.conf

# Proteksi IP Spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects (mencegah MITM)
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

# SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1

# ASLR (Address Space Layout Randomization)
kernel.randomize_va_space = 2

# Disable SysRq key
kernel.sysrq = 0

# Restrict dmesg access
kernel.dmesg_restrict = 1

# Restrict kernel pointer exposure
kernel.kptr_restrict = 2

# Disable IPv6 jika tidak dipakai
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

Apply Konfigurasi

sudo sysctl --system
sudo sysctl -p /etc/sysctl.d/99-hardening.conf

AppArmor (Ubuntu/Debian)

AppArmor membatasi program berdasarkan path. Setiap program bisa dijalankan dalam mode enforce (blokir pelanggaran) atau complain (catat pelanggaran saja).

# Cek status AppArmor
sudo aa-status

# Install profiles tambahan
sudo apt install apparmor-profiles apparmor-profiles-extra

# Set profile ke enforce
sudo aa-enforce /etc/apparmor.d/usr.sbin.nginx

# Set profile ke complain (untuk testing)
sudo aa-complain /etc/apparmor.d/usr.sbin.nginx

# Reload semua profiles
sudo systemctl reload apparmor

SELinux (RHEL/Fedora)

SELinux menggunakan label-based access control. Setiap file dan process punya label yang menentukan siapa yang bisa mengaksesnya.

# Cek status SELinux
sestatus

# Set ke enforcing
sudo setenforce 1

# Cek context file
ls -Z /var/www/html/

# Restore context setelah install
sudo restorecon -Rv /var/www/html/

# Buat custom policy
ausearch -c --raw | audit2allow -M mypol
sudo semodule -i mypol.pp

SSH Hardening

SSH adalah gerbang utama akses ke server. Konfigurasi yang lemah = undangan untuk attacker.

# /etc/ssh/sshd_config

# Ganti port default
Port 2222

# Larang root login
PermitRootLogin prohibit-password

# Disable password auth (hanya SSH key)
PasswordAuthentication no
PubkeyAuthentication yes

# Batas percobaan login
MaxAuthTries 3

# Timeout koneksi
ClientAliveInterval 300
ClientAliveCountMax 2

# Hanya izinkan user tertentu
AllowUsers yuki

# Disable empty passwords
PermitEmptyPasswords no

# Disable X11 forwarding
X11Forwarding no

# Disable TCP forwarding jika tidak perlu
AllowTcpForwarding no

Generate SSH Key

# Di client (Windows/Linux/Mac)
ssh-keygen -t ed25519 -C "[email protected]"

# Copy public key ke server
ssh-copy-id -p 2222 yuki@server-ip

Fail2Ban Configuration

Fail2Ban memantau log dan memblokir IP yang mencurigakan secara otomatis.

# /etc/fail2ban/jail.local

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

[nginx-http-auth]
enabled = true
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 5
bantime = 7200

[nginx-limit-req]
enabled = true
filter = nginx-limit-req
logpath = /var/log/nginx/error.log
maxretry = 10
bantime = 3600

# Restart Fail2Ban
sudo systemctl restart fail2ban

# Cek status
sudo fail2ban-client status
sudo fail2ban-client status sshd

Firewall (UFW)

# Default deny
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow specific ports
sudo ufw allow 2222/tcp    # SSH
sudo ufw allow 80/tcp      # HTTP
sudo ufw allow 443/tcp     # HTTPS

# Enable
sudo ufw enable
sudo ufw status verbose

Disable Unnecessary Services

# Cek semua service yang aktif
systemctl list-unit-files --state=enabled

# Disable service yang tidak perlu
sudo systemctl disable bluetooth
sudo systemctl disable cups
sudo systemctl disable avahi-daemon
sudo systemctl disable ModemManager

Monitoring dan Logging

# Install logwatch untuk daily summary
sudo apt install logwatch
sudo logwatch --detail high --mailto [email protected] --range today

# Monitor auth log real-time
sudo tail -f /var/log/auth.log | grep "Failed password"

# Cek failed login attempts
sudo journalctl -u sshd --since "1 hour ago" | grep "Failed"

# Install rkhunter untuk rootkit detection
sudo apt install rkhunter
sudo rkhunter --check

Kesimpulan

Hardening kernel Linux bukan sekadar mengubah satu-dua setting. Ini adalah pendekatan berlapis yang mencakup sysctl, AppArmor/SELinux, SSH hardening, Fail2Ban, dan firewall. Mulai dari langkah kecil: aktifkan sysctl hardening dan konfigurasi SSH dengan benar. Keamanan bukan produk, tapi proses yang harus dijalankan terus-menerus.