cara install fail2ban dan wazuh minimal di vps agar aman dari brute force dan bot

📘 Dokumentasi Minimal Setup Security Server
(Fail2Ban + Wazuh)

🎯 Tujuan: Panduan cepat untuk install & konfigurasi Fail2Ban, Install Wazuh (minimal), serta hardening dasar untuk server Laravel / web.

🧱 1. INSTALL FAIL2BAN

apt update
apt install fail2ban -y
systemctl enable fail2ban
systemctl start fail2ban

⚙️ 2. CONFIG FAIL2BAN

Buat config utama:

nano /etc/fail2ban/jail.local

Isi minimal config:

[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 5
backend = systemd

[sshd]
enabled = true
port = 22
logpath = %(sshd_log)s

[nginx-badbots]
enabled = true
port = http,https
logpath = /usr/local/lsws/logs/access.log

[nginx-php-exploit]
enabled = true
port = http,https
logpath = /usr/local/lsws/logs/access.log
maxretry = 2

🔍 3. FILTER CUSTOM (WAJIB)

Bad bots

nano /etc/fail2ban/filter.d/nginx-badbots.conf

[Definition]
failregex = <HOST> -.*"(GET|POST).*" "(curl|wget|python|libredtail|bot).*"
ignoreregex =

PHP exploit

nano /etc/fail2ban/filter.d/nginx-php-exploit.conf

[Definition]
failregex = <HOST> -.*"(GET|POST).*(phpunit|eval|base64_decode|auto_prepend_file|allow_url_include).*"
ignoreregex =

🔄 4. RESTART & CEK

systemctl restart fail2ban
systemctl status fail2ban
fail2ban-client status
tail -f /var/log/fail2ban.log

🛡️ 5. INSTALL WAZUH (MINIMAL)

curl -sO https://packages.wazuh.com/4.x/wazuh-install.sh
bash wazuh-install.sh -a

🔧 6. SERVICE WAZUH

systemctl status wazuh-manager
systemctl status wazuh-dashboard
systemctl restart wazuh-manager

📊 7. MONITOR LOG WAZUH

tail -f /var/ossec/logs/alerts/alerts.log
tail -f /var/ossec/logs/ossec.log

🔗 8. INTEGRASI FAIL2BAN → WAZUH

Edit config:

nano /var/ossec/etc/ossec.conf

Tambahkan:

<integration>
  <name>fail2ban</name>
  <level>3</level>
</integration>

systemctl restart wazuh-manager

🔐 9. HARDENING WAJIB (MINIMAL)

Disable PHP dangerous function

nano /usr/local/lsws/lsphp83/etc/php.ini
disable_functions = exec,passthru,shell_exec,system,proc_open,popen

Block folder sensitif (LiteSpeed / Nginx)

location ~* /(vendor|\.env|\.git|storage) {
    deny all;
}

Block phpunit exploit

location ~* phpunit {
    deny all;
}

🚨 10. TROUBLESHOOTING

journalctl -xeu fail2ban
tail -f /var/ossec/logs/ossec.log
tail -f /usr/local/lsws/logs/access.log

✅ 11. CHECKLIST FINAL

• Fail2Ban aktif
• Jail berjalan
• Log LiteSpeed terbaca
• Wazuh manager running
• Alert masuk
• SSH brute force ke-detect
• Web exploit ke-detect
• IP attacker otomatis ke-ban

🚀 CATATAN
Server internet publik pasti:
• Akan kena scan bot setiap menit
• Akan dicoba exploit otomatis
👉 Itu NORMAL
👉 Yang penting: detect + block otomatis

🔚 SELESAI
Dokumentasi ini cukup untuk:
✅ Server production minimal
✅ Laravel aman dari scanning umum
✅ Auto-block attacker

Jika butuh upgrade:
• WAF (ModSecurity)
• Hardening Docker
• Advanced Wazuh rules
👉 Tinggal lanjut ke tahap berikutnya.

---

Dokumentasi Minimal Setup Security – Fail2Ban + Wazuh untuk Laravel / Web Server