You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
136 lines
5.6 KiB
136 lines
5.6 KiB
AUDIT HOST — AD-LDAP (DOMAIN CONTROLLER) |
|
========================================= |
|
Tanggal audit : 2026-06-10 |
|
Sumber : server/host.txt |
|
Metode : SSH langsung |
|
|
|
IP/SSH : 10.100.1.40 | ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 |
|
Hostname : ad-server |
|
FQDN : ad-server.gisportal.id |
|
OS : Microsoft Windows Server 2012 R2 Datacenter (Version 6.3.9600) |
|
Domain : gisportal.id (PDC, Global Catalog, DNS, KDC) |
|
Resource : RAM ~4 GiB (free ~2.1 GiB) | Disk C: ~32 GiB (free ~3.2 GiB — KRITIS) |
|
|
|
Peran host: Domain Controller, DNS, LDAP, ADFS, mail, database pendukung (WAMP). |
|
|
|
|
|
A. STATUS SSH |
|
------------- |
|
| Item | Hasil | |
|
|-------------------|--------------------------------------------| |
|
| OpenSSH | OpenSSH_for_Windows_10.0p2 (Win32-OpenSSH) | |
|
| Service sshd | RUNNING | |
|
| Port | 22 (0.0.0.0) | |
|
| Login private key | BERHASIL (tanpa password) | |
|
| User | gisportal\administrator | |
|
|
|
Perintah host.txt sudah benar dan verified. |
|
|
|
|
|
B. ACTIVE DIRECTORY & DNS |
|
------------------------- |
|
| Service | Fungsi | Status | |
|
|----------|--------------------------------|----------| |
|
| NTDS | Active Directory Domain Svc | RUNNING | |
|
| DNS | DNS Server | RUNNING | |
|
| KDC | Kerberos Key Distribution Ctr | RUNNING | |
|
| Netlogon | Netlogon | RUNNING | |
|
| ADWS | Active Directory Web Services | RUNNING | |
|
| DHCPServer | DHCP Server | RUNNING | |
|
| Dfs / DFSR | DFS Namespace / Replication | RUNNING | |
|
|
|
Domain info (nltest): |
|
DC Name : \\ad-server.gisportal.id |
|
Address : \\10.100.1.40 |
|
Dom Name : gisportal.id |
|
Forest : gisportal.id |
|
Flags : PDC GC DS LDAP KDC DNS_DC DNS_DOMAIN DNS_FOREST WRITABLE |
|
|
|
|
|
C. AUTENTikasi & FEDERASI |
|
------------------------- |
|
| Service | Fungsi | Status | |
|
|-----------|-------------------------------------|----------| |
|
| adfssrv | Active Directory Federation Svc | RUNNING | |
|
| ADAM_gisportal | AD LDS instance "gisportal" | RUNNING | |
|
| IAS | Network Policy Server (NPS) | RUNNING | |
|
|
|
IIS sites: |
|
Default Web Site → 80, 443 (enterprise.gisportal.id via 10.100.1.30 binding) |
|
LDAP → 1443 (HTTPS) |
|
|
|
|
|
D. MAIL SERVER |
|
-------------- |
|
| Service | Port | Fungsi | |
|
|------------|-------------|---------------------------| |
|
| hMailServer| 25, 110, 143, 587 | SMTP, POP3, IMAP | |
|
| SMTPSVC | 25 | SMTP (IIS) | |
|
|
|
|
|
E. DATABASE & DEV STACK |
|
----------------------- |
|
| Service | Port | Fungsi | |
|
|-----------------|----------|---------------------------| |
|
| wampmysqld64 | 3306 | MySQL (WAMP) | |
|
| wampmariadb64 | 3307 | MariaDB (WAMP) | |
|
| wampapache64 | 8080 | Apache (WAMP) | |
|
| MSSQL$WID | — | Windows Internal Database | |
|
|
|
Port tambahan AD/admin: 389, 636, 3268, 3269, 9389 (AD Web Services), 8081, dll. |
|
|
|
|
|
F. BACKUP & MONITORING |
|
---------------------- |
|
| Service | Fungsi | |
|
|----------------------|-------------------------------------| |
|
| VeeamEndpointBackupSvc | Veeam Agent for Microsoft Windows | |
|
| VeeamDeploySvc | Veeam Installer Service | |
|
| VeeamTransportSvc | Veeam Data Mover Service | |
|
| Zabbix Agent | Monitoring (port 10050) | |
|
| vncserver | VNC remote desktop (port 5900) | |
|
| TermService | Remote Desktop (port 3389) | |
|
|
|
|
|
G. PORT LISTENING PENTING |
|
------------------------- |
|
| Port | Layanan | |
|
|--------|----------------------------------------------| |
|
| 22 | OpenSSH | |
|
| 53 | DNS Server (10.100.1.40) | |
|
| 88 | Kerberos | |
|
| 389 | LDAP | |
|
| 636 | LDAPS | |
|
| 3268 | Global Catalog LDAP | |
|
| 3269 | Global Catalog LDAPS | |
|
| 3389 | RDP | |
|
| 3306 | MySQL (WAMP) | |
|
| 3307 | MariaDB (WAMP) | |
|
| 8080 | WAMP Apache | |
|
| 9389 | AD Web Services | |
|
| 1443 | IIS site LDAP (HTTPS) | |
|
| 10050 | Zabbix Agent | |
|
|
|
|
|
H. ANALISA |
|
---------- |
|
Peran: jantung infrastruktur identitas Geonet — AD domain gisportal.id, |
|
DNS internal, ADFS, mail, plus WAMP stack dan Veeam backup. |
|
|
|
Semua server Windows/Linux di jaringan kemungkinan autentikasi via domain ini. |
|
Reverse proxy mem-proxy adfs.gisportal.id ke host terkait. |
|
|
|
Catatan KRITIS: |
|
- Disk C: hanya ~3.2 GiB free — segera bersihkan/expand disk. |
|
- RAM hanya ~4 GiB — sangat tipis untuk DC + mail + WAMP + ADFS. |
|
- Windows Server 2012 R2 sudah EOL — rencanakan upgrade/pindah DC. |
|
- Port LDAP/DNS/RDP/MySQL expose ke 0.0.0.0 — pastikan firewall ketat. |
|
- SSH sudah OK dengan private key. |
|
|
|
|
|
PERINTAH VERIFIKASI ULANG |
|
------------------------- |
|
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "hostname" |
|
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "nltest /dsgetdc:" |
|
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "sc query NTDS DNS KDC adfssrv sshd" |
|
ssh -m hmac-sha1 Administrator@10.100.1.40 -p 22 "netstat -an | findstr LISTENING"
|
|
|