Keamanan

Panel yang expose ke publik = target serangan. Berikut hardening minimum.

1. Firewall

Buka hanya port yang perlu:

ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp      # SSH
ufw allow 80/tcp      # HTTP (redirect ke HTTPS)
ufw allow 443/tcp     # HTTPS
ufw allow 8080/tcp    # Wings (kalau ini node)
ufw allow 2022/tcp    # SFTP (kalau ini node)
ufw enable

Port game server (25565, 27015, dll) tambah sesuai kebutuhan.

2. SSH hardening

Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 22222

Restart:

systemctl restart sshd

Selalu test login di terminal baru sebelum keluar dari session lama.

3. Fail2ban

Install & enable untuk block brute force:

apt install -y fail2ban
systemctl enable --now fail2ban

Config /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 22222
maxretry = 3
bantime = 3600

[nginx-http-auth]
enabled = true
port = http,https

Reload:

systemctl restart fail2ban

4. HTTPS wajib

Panel harus selalu di HTTPS. Redirect HTTP → HTTPS di Nginx sudah ada di instalasi panel.

Auto-renew Let's Encrypt:

certbot renew --dry-run

Cron auto-renew:

0 3 * * * certbot renew --quiet && systemctl reload nginx

5. Update rutin

# System
apt update && apt upgrade -y

# Panel
cd /var/www/pterodactyl
php artisan down
curl -L https://github.com/pterodactyl/panel/releases/latest/download/panel.tar.gz | tar -xzv
composer install --no-dev --optimize-autoloader
php artisan view:clear
php artisan config:clear
php artisan migrate --force
php artisan queue:restart
php artisan up

# Wings (di node)
systemctl stop wings
curl -L -o /usr/local/bin/wings "https://github.com/pterodactyl/wings/releases/latest/download/wings_linux_amd64"
chmod u+x /usr/local/bin/wings
systemctl start wings

6. Database

• Password kuat (min 20 karakter, alfanumerik + simbol)
• Bind ke 127.0.0.1 saja, bukan 0.0.0.0
• Backup otomatis (lihat Backup Panel)

Cek bind:

grep bind-address /etc/mysql/mariadb.conf.d/50-server.cnf

Harus bind-address = 127.0.0.1.

7. Redis

Kalau Redis di publik, aktifkan password. Edit /etc/redis/redis.conf:

bind 127.0.0.1
requirepass PASSWORD_KUAT

Update .env panel:

REDIS_PASSWORD=PASSWORD_KUAT

8. Rate limit

Panel sudah punya rate limit built-in (240 req/menit per API key). Tambah rate limit di Nginx untuk login:

limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

location = /auth/login {
    limit_req zone=login burst=5 nodelay;
    try_files $uri $uri/ /index.php?$query_string;
}

9. 2FA wajib untuk admin

Di panel → Admin → Settings → aktifkan Require 2FA untuk role admin.

10. Backup

Backup rutin (harian):

• Database panel (mysqldump panel > backup.sql)
• Folder /var/www/pterodactyl (khusus .env dan storage)
• Konfigurasi Wings di setiap node (/etc/pterodactyl/config.yml)

Simpan off-site (S3, Backblaze, rsync ke server lain).

11. Monitoring

Pasang alerting untuk:

• CPU / memory > 90% selama 5 menit
• Disk > 85%
• Wings heartbeat down
• Nginx 5xx > 10/menit

Rekomendasi stack: Prometheus + Grafana + Alertmanager, atau layanan seperti UptimeRobot.

12. Log audit

Panel simpan activity log di Admin → Servers → server → tab Activity. Untuk retensi lebih lama, ekspor ke ELK / Loki.

Checklist

• [ ] SSH pakai key, root disabled, port non-standard
• [ ] Firewall aktif dengan default deny
• [ ] Fail2ban jalan
• [ ] HTTPS + auto-renew
• [ ] Panel & Wings ter-update
• [ ] Database bind lokal, password kuat
• [ ] Redis bind lokal + password
• [ ] 2FA aktif untuk admin
• [ ] Backup harian off-site
• [ ] Monitoring + alerting jalan