AUDIT HOST — MAIN WEBSERVER
============================
Tanggal audit : 2026-06-10
Sumber        : server/host.txt
Metode        : SSH langsung

IP/SSH   : 10.100.1.41  |  ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22
Hostname : app
OS       : Microsoft Windows Server 2012 R2 Standard (Version 6.3.9600)
Resource : RAM ~16 GiB (free ~12 GiB) | Disk C: ~128 GiB (free ~61 GiB, ~47% used)

Peran host: web server utama Geonet — IIS, aplikasi GIS/portal, dev stack lokal.


A. STATUS SSH
-------------
| Item              | Hasil                                      |
|-------------------|--------------------------------------------|
| OpenSSH           | OpenSSH_for_Windows_10.0p2 (Win32-OpenSSH) |
| Service sshd      | RUNNING                                    |
| Port              | 22 (0.0.0.0)                               |
| Login private key | BERHASIL (tanpa password)                  |
| User              | app\administrator                          |
| Key file server   | C:\ProgramData\ssh\administrators_authorized_keys |

Perintah host.txt sudah benar dan verified.


B. LAYANAN UTAMA (Windows Service)
----------------------------------
| Service              | Fungsi                              | Status   |
|----------------------|-------------------------------------|----------|
| W3SVC / IISADMIN     | IIS — World Wide Web Publishing     | RUNNING  |
| WAS                  | Windows Process Activation Service  | RUNNING  |
| WMSVC                | Web Management Service              | RUNNING  |
| sshd                 | OpenSSH SSH Server                  | RUNNING  |
| mosquitto            | MQTT Broker                         | RUNNING  |
| Zabbix Agent         | Monitoring agent                    | RUNNING  |
| vncserver            | VNC remote desktop                  | RUNNING  |
| TermService          | Remote Desktop (RDP)                | RUNNING  |
| WinRM                | PowerShell Remoting                 | RUNNING  |
| MSMQ                 | Message Queuing                     | RUNNING  |
| Netlogon             | Domain member (Active Directory)    | RUNNING  |

Tomcat tidak terdeteksi sebagai Windows service (Tomcat8/Tomcat9 tidak ada),
tetapi port Tomcat (8080, 8443, 8009) aktif — kemungkinan dijalankan manual atau sebagai app.


C. IIS SITES
------------
| Site                  | Port binding                          | Status  |
|-----------------------|---------------------------------------|---------|
| Default Web Site      | 80, 443                               | Started |
| ts.gisportal.id       | 81 (HTTP), 82 (HTTPS)                 | Started |
| imp.gisportal.id      | 100 (HTTPS)                           | Started |
| leantime.gisportal.id | 101 (HTTPS), 102 (HTTP)               | Started |
| widget                | 83 (HTTP), 84 (HTTPS)                 | Started |

Config tool: %windir%\system32\inetsrv\appcmd


D. PORT LISTENING PENTING
-------------------------
| Port   | Kemungkinan layanan                          |
|--------|----------------------------------------------|
| 22     | OpenSSH                                      |
| 80     | IIS HTTP                                     |
| 81-84  | IIS sites (ts, widget)                       |
| 100-102| IIS sites (imp, leantime)                    |
| 443    | IIS HTTPS                                    |
| 1883   | Mosquitto MQTT                               |
| 3000   | App/dev server                               |
| 3389   | (via TermService — RDP)                      |
| 5900   | VNC                                          |
| 5985   | WinRM                                        |
| 8080   | Tomcat / Java app                            |
| 8443   | Tomcat HTTPS / Java app                      |
| 9080   | Java / secondary web                         |
| 9443   | Java HTTPS                                   |
| 10050  | Zabbix Agent                                 |


E. APLIKASI & FOLDER PENTING (C:\)
----------------------------------
| Path / folder           | Keterangan                              |
|-------------------------|-----------------------------------------|
| C:\inetpub\wwwroot\     | Default IIS web root — portal, GIS apps |
| C:\laragon\             | Laragon dev stack (PHP/MySQL local)     |
| C:\laragon-2026\        | Laragon versi/update                    |
| C:\xampp\               | XAMPP stack                             |
| C:\Gitea\               | Gitea Git server (gitea.exe)            |
| C:\nginx-rtmp-win32-dev\| Nginx RTMP (streaming)                 |
| C:\app\                 | Aplikasi custom                         |

Contoh app di wwwroot: portal, arcgis, eSearch, eBasemapGallery, mooview,
FieldResumeWKP, WellSitePrep, speed, widget, exbwidget, dll.


F. ANALISA
----------
Peran: server produksi web + GIS portal (*.gisportal.id beberapa site host lokal).
Stack campuran IIS + Java/Tomcat + Laragon/XAMPP + Gitea + MQTT.

Reverse proxy (10.100.1.24) mem-proxy banyak domain ke host ini via nginx
(contoh di reverse-proxy-audit: app, arc, asset, maps, simp, stream, dll).

Catatan:
  - Windows Server 2012 R2 sudah EOL — rencanakan upgrade.
  - Banyak port web expose ke 0.0.0.0; pastikan firewall Mikrotik membatasi.
  - Laragon/XAMPP/Gitea di server produksi — verifikasi apakah masih dipakai aktif.
  - SSH sudah OK dengan private key via administrators_authorized_keys.


PERINTAH VERIFIKASI ULANG
-------------------------
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "hostname"
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "sc query W3SVC sshd"
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "%windir%\system32\inetsrv\appcmd list site"
ssh -m hmac-sha1 Administrator@10.100.1.41 -p 22 "netstat -an | findstr LISTENING"