Instalasi CyberPanel AlmaLinux 9 Sekaligus Hardening Server

21. Backup wajib

Minimal gunakan tiga lapis:

1. Backup CyberPanel harian
2. Backup eksternal ke server/object storage berbeda
3. Snapshot VPS sebelum upgrade besar

Backup yang berada pada disk VPS yang sama bukan backup penuh, karena ikut hilang jika disk rusak atau server diretas.

Buat direktori backup root dengan izin ketat:

install -d -m 700 -o root -g root /root/secure-backup

Jangan menyimpan backup database, .env, atau private key di folder website publik seperti:

public_html/
public/
htdocs/

22. Pemeriksaan keamanan akhir

Jalankan:

echo "=== OS ==="
cat /etc/os-release

echo "=== HOSTNAME ==="
hostnamectl

echo "=== FIREWALL ==="
firewall-cmd --state
firewall-cmd --list-all --zone=public
firewall-cmd --list-all --zone=trusted

echo "=== PORT ==="
ss -tulpn

echo "=== SSH EFFECTIVE CONFIG ==="
sshd -T | grep -E \
'port|permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|maxauthtries|allowusers'

echo "=== FAILED SERVICES ==="
systemctl --failed

echo "=== FAIL2BAN ==="
fail2ban-client status
fail2ban-client status sshd

echo "=== SELINUX ==="
getenforce

echo "=== CRYPTO POLICY ==="
update-crypto-policies --show

echo "=== AUTO UPDATE ==="
systemctl status dnf-automatic.timer --no-pager

echo "=== CYBERPANEL ==="
systemctl status lscpd --no-pager

echo "=== OPENLITESPEED ==="
systemctl status lsws --no-pager

Target akhirnya:

Root SSH login          : nonaktif
SSH password login      : nonaktif
SSH key                 : aktif
User sudo terpisah      : aktif
SSH port                : dibatasi IP/VPN
CyberPanel 8090         : dibatasi IP/VPN
OpenLiteSpeed 7080      : dibatasi IP/VPN
2FA CyberPanel          : aktif
Firewall provider       : aktif
Firewalld               : aktif
Fail2Ban                : aktif
Security updates        : aktif
Unused services         : nonaktif
Backup eksternal        : aktif

Konfigurasi paling aman untuk production website: publik hanya membuka 80/tcp, 443/tcp, dan opsional 443/udp. SSH, CyberPanel 8090, dan OpenLiteSpeed WebAdmin 7080 hanya dapat diakses dari IP administrator, VPN, atau SSH tunnel.