AUDIT HOST — AD-LDAP (DOMAIN CONTROLLER)
=========================================
Tanggal audit : 2026-06-10
Sumber        : server/host.txt
Metode        : SSH langsung

IP/SSH   : 10.100.1.40  |  ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22
Hostname : ad-server
FQDN     : ad-server.gisportal.id
OS       : Microsoft Windows Server 2012 R2 Datacenter (Version 6.3.9600)
Domain   : gisportal.id (PDC, Global Catalog, DNS, KDC)
Resource : RAM ~4 GiB (free ~2.1 GiB) | Disk C: ~32 GiB (free ~3.2 GiB — KRITIS)

Peran host: Domain Controller, DNS, LDAP, ADFS, mail, database pendukung (WAMP).


A. STATUS SSH
-------------
| Item              | Hasil                                      |
|-------------------|--------------------------------------------|
| OpenSSH           | OpenSSH_for_Windows_10.0p2 (Win32-OpenSSH) |
| Service sshd      | RUNNING                                    |
| Port              | 22 (0.0.0.0)                               |
| Login private key | BERHASIL (tanpa password)                  |
| User              | gisportal\administrator                    |

Perintah host.txt sudah benar dan verified.


B. ACTIVE DIRECTORY & DNS
-------------------------
| Service  | Fungsi                         | Status   |
|----------|--------------------------------|----------|
| NTDS     | Active Directory Domain Svc    | RUNNING  |
| DNS      | DNS Server                     | RUNNING  |
| KDC      | Kerberos Key Distribution Ctr  | RUNNING  |
| Netlogon | Netlogon                       | RUNNING  |
| ADWS     | Active Directory Web Services  | RUNNING  |
| DHCPServer | DHCP Server                  | RUNNING  |
| Dfs / DFSR | DFS Namespace / Replication  | RUNNING  |

Domain info (nltest):
  DC Name    : \\ad-server.gisportal.id
  Address    : \\10.100.1.40
  Dom Name   : gisportal.id
  Forest     : gisportal.id
  Flags      : PDC GC DS LDAP KDC DNS_DC DNS_DOMAIN DNS_FOREST WRITABLE


C. AUTENTikasi & FEDERASI
-------------------------
| Service   | Fungsi                              | Status   |
|-----------|-------------------------------------|----------|
| adfssrv   | Active Directory Federation Svc     | RUNNING  |
| ADAM_gisportal | AD LDS instance "gisportal"    | RUNNING  |
| IAS       | Network Policy Server (NPS)         | RUNNING  |

IIS sites:
  Default Web Site  → 80, 443 (enterprise.gisportal.id via 10.100.1.30 binding)
  LDAP              → 1443 (HTTPS)


D. MAIL SERVER
--------------
| Service    | Port        | Fungsi                    |
|------------|-------------|---------------------------|
| hMailServer| 25, 110, 143, 587 | SMTP, POP3, IMAP   |
| SMTPSVC    | 25          | SMTP (IIS)                |


E. DATABASE & DEV STACK
-----------------------
| Service         | Port     | Fungsi                    |
|-----------------|----------|---------------------------|
| wampmysqld64    | 3306     | MySQL (WAMP)              |
| wampmariadb64   | 3307     | MariaDB (WAMP)            |
| wampapache64    | 8080     | Apache (WAMP)             |
| MSSQL$WID       | —        | Windows Internal Database |

Port tambahan AD/admin: 389, 636, 3268, 3269, 9389 (AD Web Services), 8081, dll.


F. BACKUP & MONITORING
----------------------
| Service              | Fungsi                              |
|----------------------|-------------------------------------|
| VeeamEndpointBackupSvc | Veeam Agent for Microsoft Windows |
| VeeamDeploySvc       | Veeam Installer Service             |
| VeeamTransportSvc    | Veeam Data Mover Service            |
| Zabbix Agent         | Monitoring (port 10050)             |
| vncserver            | VNC remote desktop (port 5900)      |
| TermService          | Remote Desktop (port 3389)          |


G. PORT LISTENING PENTING
-------------------------
| Port   | Layanan                                      |
|--------|----------------------------------------------|
| 22     | OpenSSH                                      |
| 53     | DNS Server (10.100.1.40)                     |
| 88     | Kerberos                                     |
| 389    | LDAP                                         |
| 636    | LDAPS                                        |
| 3268   | Global Catalog LDAP                          |
| 3269   | Global Catalog LDAPS                         |
| 3389   | RDP                                          |
| 3306   | MySQL (WAMP)                                 |
| 3307   | MariaDB (WAMP)                               |
| 8080   | WAMP Apache                                  |
| 9389   | AD Web Services                              |
| 1443   | IIS site LDAP (HTTPS)                        |
| 10050  | Zabbix Agent                                 |


H. ANALISA
----------
Peran: jantung infrastruktur identitas Geonet — AD domain gisportal.id,
DNS internal, ADFS, mail, plus WAMP stack dan Veeam backup.

Semua server Windows/Linux di jaringan kemungkinan autentikasi via domain ini.
Reverse proxy mem-proxy adfs.gisportal.id ke host terkait.

Catatan KRITIS:
  - Disk C: hanya ~3.2 GiB free — segera bersihkan/expand disk.
  - RAM hanya ~4 GiB — sangat tipis untuk DC + mail + WAMP + ADFS.
  - Windows Server 2012 R2 sudah EOL — rencanakan upgrade/pindah DC.
  - Port LDAP/DNS/RDP/MySQL expose ke 0.0.0.0 — pastikan firewall ketat.
  - SSH sudah OK dengan private key.


PERINTAH VERIFIKASI ULANG
-------------------------
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "hostname"
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "nltest /dsgetdc:"
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "sc query NTDS DNS KDC adfssrv sshd"
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "netstat -an | findstr LISTENING"