Linux Ops

# Sumber kebenaran lintas-distro
cat /etc/os-release
hostnamectl                # OS, kernel, virtualization, machine-id
uname -srm                 # kernel + arsitektur (x86_64 / aarch64)
arch                       # arsitektur saja

nproc                      # jumlah vCPU
lscpu                      # detail CPU
free -h                    # RAM + swap
df -hT                     # disk + tipe filesystem
lsblk -f                   # block device + UUID/FS
ip -br a                   # ringkasan interface + IP
uptime                     # load average + waktu hidup

sudo hostnamectl set-hostname app01.example.com
timedatectl set-timezone Asia/Jakarta
timedatectl list-timezones | grep Asia   # cari tz
localectl status

# Buat keypair (ed25519 lebih ringkas & modern dari RSA)
ssh-keygen -t ed25519 -C "deploy@laptop"

# Salin public key ke server
ssh-copy-id deploy@SERVER_IP
# manual: tempel isi ~/.ssh/id_ed25519.pub ke
#   ~/.ssh/authorized_keys di server

# Izin harus ketat atau sshd menolaknya diam-diam
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R "$USER":"$USER" ~/.ssh

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

# Persisten saat boot
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

# Tuning
sudo sysctl -w vm.swappiness=10
echo 'vm.swappiness=10' | sudo tee /etc/sysctl.d/99-swap.conf

ip a                       # alamat IP per interface
ip r                       # tabel routing
ss -tulpn                  # port listening + proses (ganti netstat)
ss -s                      # ringkasan socket
dig +short example.com     # resolusi DNS
curl -I https://site       # cek header HTTP/status
mtr example.com            # traceroute + ping berkelanjutan

sudo systemctl start  nginx
sudo systemctl stop   nginx
sudo systemctl restart nginx
sudo systemctl reload nginx        # reload config tanpa downtime
sudo systemctl enable --now nginx  # enable + start sekaligus
sudo systemctl disable nginx
systemctl status nginx
systemctl is-enabled nginx
sudo systemctl daemon-reload       # setelah ubah unit file
sudo systemctl mask nginx          # cegah start total

systemctl list-units --type=service --state=running
systemctl --failed                 # service yang gagal

journalctl -u nginx -f             # follow log service
journalctl -u nginx --since "1 hour ago"
journalctl -b -p err               # error sejak boot ini
journalctl -k                      # pesan kernel (= dmesg)
sudo journalctl --vacuum-time=7d   # pangkas log >7 hari

sudo useradd -m -s /bin/bash alice   # -m buat home
sudo passwd alice
sudo usermod -aG docker alice        # -a WAJIB (append, bukan replace)
sudo userdel -r alice                # -r hapus home
id alice
groups alice
getent passwd alice

sudo visudo                          # /etc/sudoers
sudo visudo -f /etc/sudoers.d/deploy # lebih aman: drop-in
# contoh isi drop-in:
#   deploy ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart app

sudo chage -l alice                  # lihat aging
sudo chage -M 90 -W 7 alice          # max 90 hari, warning 7 hari

chmod 640 file        # rw- r-- ---
chmod u+x,g-w file
chown alice:devs file
chmod -R g+rwX dir/    # X = +x hanya utk dir/file yg sudah exec

# ACL (izin per-user di luar owner/group)
setfacl -m u:bob:rwx file
getfacl file

# Special bits
chmod 1777 /shared     # sticky: hanya pemilik yang dapat menghapus filenya
chmod 2775 /team       # setgid: file mewarisi grup direktori

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
# buka shell baru / source profil:
source ~/.bashrc

nvm install --lts          # Node LTS terbaru
nvm install 20
nvm use 20
nvm alias default 20
node -v && npm -v
corepack enable            # aktifkan pnpm/yarn modern

php -r "copy('https://getcomposer.org/installer','composer-setup.php');"
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
rm composer-setup.php
composer --version

curl -fsSL https://pyenv.run | bash
# tambah ke ~/.bashrc:
#   export PYENV_ROOT="$HOME/.pyenv"
#   command -v pyenv >/dev/null || export PATH="$PYENV_ROOT/bin:$PATH"
#   eval "$(pyenv init -)"
pyenv install 3.12.4
pyenv global 3.12.4

# /etc/ssh/sshd_config.d/99-hardening.conf
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no
PermitEmptyPasswords no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy

sudo sshd -t                       # validasi (WAJIB)
sudo systemctl restart ssh         # deb: ssh  |  rhel: sshd
# RHEL: sudo systemctl restart sshd

# /etc/sysctl.d/99-hardening.conf
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1
net.ipv6.conf.all.accept_redirects = 0
kernel.randomize_va_space = 2
kernel.kptr_restrict = 2
kernel.dmesg_restrict = 1
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.suid_dumpable = 0

sudo sysctl --system               # muat semua drop-in

# /etc/audit/rules.d/hardening.rules
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k scope
-w /var/log/auth.log -p wa -k auth   # rhel: /var/log/secure
-a always,exit -F arch=b64 -S execve -k exec

sudo augenrules --load
sudo ausearch -k identity

# /etc/fstab: partisi terpisah ideal; tmpfs sebagai alternatif:
tmpfs  /tmp      tmpfs  defaults,noexec,nosuid,nodev  0 0
tmpfs  /dev/shm  tmpfs  defaults,noexec,nosuid,nodev  0 0
# /var/tmp idealnya bind ke /tmp atau partisi sendiri

sudo systemctl daemon-reload
sudo mount -o remount /tmp
mount | grep /tmp          # verifikasi flag aktif

# /etc/modprobe.d/cis-blacklist.conf
install cramfs /bin/true
install freevxfs /bin/true
install jffs2 /bin/true
install hfs /bin/true
install hfsplus /bin/true
install udf /bin/true
install usb-storage /bin/true   # blok mass-storage USB

# nonaktifkan modul yg sudah termuat
sudo modprobe -r cramfs 2>/dev/null || true

# Banner peringatan hukum
echo "Authorized access only. Activity is monitored." \
 | sudo tee /etc/issue /etc/issue.net

# faillock: kunci akun setelah N kali gagal
# RHEL: kelola via 'authselect ... with-faillock'
# /etc/security/faillock.conf:
#   deny = 5
#   unlock_time = 900
sudo faillock --user alice           # lihat status
sudo faillock --user alice --reset

# clone dari github lalu:
sudo ./lynis audit system
# laporan: /var/log/lynis.log  + hardening index

journalctl -p 3 -xb               # error+ sejak boot ini, plus konteks
journalctl --since "10 min ago"
systemctl --failed                # service mati
dmesg -T | tail -50               # ring buffer kernel + timestamp
last -a                           # login berhasil
lastb                             # login GAGAL (butuh root)
sudo du -xh / | sort -rh | head   # pemakan disk terbesar
sudo ss -tulpn                    # apa yang listening di port apa

grep "ERROR" app.log              # baris yang memuat ERROR
grep -i "timeout" app.log         # abaikan besar/kecil huruf
grep -n "RC 91" iso.log           # sertakan nomor baris
grep -c "0210" iso.log            # hitung baris yang cocok
grep -v "DEBUG" app.log           # kebalikan: sembunyikan yang cocok
grep -A3 -B1 "FATAL" app.log      # 3 baris sesudah, 1 baris sebelum
grep -E "RC (51|55|62)" iso.log   # regex extended dengan OR
grep -o "PAN=[0-9]*" iso.log      # cetak hanya bagian yang cocok
grep -rl "panic" /var/log         # daftar file yang memuat pola

rg "RC 91" iso.log
rg -i "timeout"                   # cari rekursif di direktori saat ini
rg -c "0200" *.log                # hitung kemunculan per file
rg -N "MTI=02\d\d" iso.log       # regex, tanpa nomor baris
rg -o "DE_0\d\d" iso.log         # ekstrak token yang cocok saja

sed -n '10,20p' app.log              # cetak baris 10 sampai 20
sed -n '/0200/p' iso.log             # cetak baris yang cocok pola
sed 's/\r$//' file.txt              # buang CR (konversi CRLF ke LF)
sed -i.bak 's/lama/baru/g' app.conf  # ganti di tempat, simpan cadangan .bak
sed '/^#/d;/^$/d' app.conf           # hapus komentar dan baris kosong

awk '{print $1, $4}' access.log              # cetak kolom 1 dan 4
awk -F',' '{print $3}' data.csv              # pemisah koma
awk -F'|' '$5=="0210"{print $0}' iso.log     # filter berdasar nilai field
awk '{sum+=$2} END{print sum}' nums          # jumlahkan kolom 2
awk -F'|' '{c[$6]++} END{for(k in c) print c[k], k}' iso.log
awk 'NR>1' data.csv                          # lewati baris header
awk '$9>=500' access.log                     # filter numerik pada kolom 9

find /var/log -name "*.log" -mtime -1     # diubah kurang dari 1 hari
find . -type f -size +100M                # file lebih besar dari 100MB
find /var/log -name "*.gz" | xargs zcat | grep "ERROR"
find . -type f -print0 | xargs -0 grep -l "PAN"

jq '.' app.json                              # cetak rapi
jq '.transactions[] | .rc' log.json          # ekstrak field dari array
jq -r '.[] | [.pan, .mti] | @tsv' log.json   # output mentah, dipisah tab
jq 'select(.rc=="91")' events.json           # filter berdasar nilai
jq 'group_by(.rc) | map({rc:.[0].rc, n:length})' events.json
tail -f app.log | jq -c 'select(.level=="error")'   # saring aliran realtime

cut -d',' -f1,3 data.csv          # ambil kolom tertentu dari CSV
sort file | uniq -c | sort -rn    # frekuensi, urut dari terbanyak
sort -u list.txt                  # baris unik
wc -l file                        # hitung jumlah baris
tr 'a-z' 'A-Z' < file             # ubah ke huruf besar
tr -d '\r' < dos.txt > unix.txt   # buang CR
paste -sd, file                   # gabung semua baris, dipisah koma

zcat app.log.1.gz | grep "ERROR"     # baca gzip tanpa mengekstrak
zgrep "RC 91" app.log.*.gz           # grep langsung pada banyak .gz
xzcat app.log.xz | less              # baca arsip xz
tail -n 200 -f app.log               # 200 baris terakhir, lalu ikuti
tail -f app.log | grep --line-buffered "0210"
less +F app.log                      # mode ikuti di less (Ctrl-C lalu G untuk keluar)

# Distribusi response code (pemisah '|', kolom 6 = RC), urut terbanyak
awk -F'|' 'NR>1{c[$6]++} END{for(k in c) print c[k], k}' iso.log \
  | sort -rn

# Jumlah PAN unik yang muncul pada MTI 0210
awk -F'|' '$1=="0210"{print $3}' iso.log | sort -u | wc -l

# Tinjau cepat baris bermasalah beserta nomor barisnya
grep -nE "RC (51|55|62|75)" iso.log | head

# Redaksi PAN sebelum membagikan sampel log
sed -E 's/([0-9]{6})[0-9]{6,9}([0-9]{4})/\1******\2/g' iso.log > redacted.log