Server-Härtung & Betrieb (Max-Security): Debian 12 + YunoHost + Nextcloud + WordPress + Mail

uptime
free -h
df -h
sudo ss -tulpen | egrep ':22|:80|:443|:25|:587|:993|:53' || true
sudo systemctl status nginx --no-pager
sudo systemctl status php8.3-fpm --no-pager
sudo systemctl status mariadb --no-pager
sudo systemctl status redis-server --no-pager
sudo fail2ban-client status

sudo du -h --max-depth=1 /var | sort -hr
sudo du -h --max-depth=1 /var/www | sort -hr
sudo du -h --max-depth=2 /var/www/wordpress/wp-content/uploads | sort -hr | head -20

sudo swapon --show
free -h
ls -lh /swapfile
grep -n swapfile /etc/fstab || true

echo "vm.swappiness=20" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p | tail -n 20

grep -R "sury" -n /etc/apt/sources.list /etc/apt/sources.list.d/* || true
ls -1 /etc/apt/sources.list.d
sudo apt update
sudo apt -f install -y
sudo apt autoremove --purge -y
sudo apt autoclean

php -m | grep -i redis
redis-cli ping
sudo systemctl status redis-server --no-pager

sudo yunohost app shell nextcloud
php occ config:system:set redis host --value="127.0.0.1"
php occ config:system:set redis port --value=6379 --type=integer
php occ config:system:set memcache.locking --value="\OC\Memcache\Redis"
php occ config:system:set memcache.distributed --value="\OC\Memcache\Redis"
php occ config:system:get redis
php occ config:system:get memcache.locking
exit

sudo mysql -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size';"
sudo mysql -e "SHOW VARIABLES LIKE 'max_connections';"
sudo systemctl status mariadb --no-pager

# /etc/mysql/mariadb.conf.d/50-server.cnf  (unter [mysqld])
innodb_buffer_pool_size = 768M
innodb_log_file_size = 256M
innodb_flush_method = O_DIRECT
innodb_flush_log_at_trx_commit = 2
max_connections = 60
tmp_table_size = 64M
max_heap_table_size = 64M

sudo systemctl restart mariadb
sudo mysql -e "SHOW VARIABLES LIKE 'innodb_buffer_pool_size';"

# /etc/php/8.3/fpm/pool.d/www.conf
pm = dynamic
pm.max_children = 18
pm.start_servers = 4
pm.min_spare_servers = 2
pm.max_spare_servers = 6
pm.max_requests = 500

sudo php-fpm8.3 -t
sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm --no-pager

sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client status nextcloud
sudo fail2ban-client status wordpress

# /etc/fail2ban/jail.local
[DEFAULT]
bantime = 24h
findtime = 10m
maxretry = 3

sudo systemctl restart fail2ban
sudo fail2ban-client status

# /etc/nginx/nginx.conf  (innerhalb http { ... })
limit_req_zone $binary_remote_addr zone=global_limit:10m rate=10r/s;

# innerhalb server { listen 443 ssl http2; ... } für mitcloud.mayit.eu
limit_req zone=global_limit burst=20 nodelay;

sudo nginx -t
sudo systemctl reload nginx

# IP Spoofing Protection
net.ipv4.conf.all.rp_filter=1
net.ipv4.conf.default.rp_filter=1

# Disable IP forwarding
net.ipv4.ip_forward=0

# SYN Flood Protection
net.ipv4.tcp_syncookies=1

# Disable source routing
net.ipv4.conf.all.accept_source_route=0
net.ipv6.conf.all.accept_source_route=0

# Ignore ICMP broadcast
net.ipv4.icmp_echo_ignore_broadcasts=1

# Log suspicious packets
net.ipv4.conf.all.log_martians=1

sudo sysctl -p
sudo sysctl net.ipv4.ip_forward
sudo sysctl net.ipv4.tcp_syncookies

sudo apt install -y mailutils
echo "Testmail Monitoring OK" | mail -s "Server Test" DEINE-MAIL@DOMAIN.DE

sudo nano /usr/local/sbin/server-health-check.sh

#!/bin/bash
MAIL="DEINE-MAIL@DOMAIN.DE"
HOSTNAME=$(hostname)

# RAM Check
RAM_USED=$(free | awk '/Mem:/ {printf("%.0f"), $3/$2*100}')
if [ "$RAM_USED" -gt 85 ]; then
  echo "RAM usage is ${RAM_USED}% on ${HOSTNAME}" | mail -s "ALERT: High RAM on ${HOSTNAME}" "$MAIL"
fi

# Disk Check
DISK_USED=$(df / | awk 'END{print $5}' | sed 's/%//')
if [ "$DISK_USED" -gt 85 ]; then
  echo "Disk usage is ${DISK_USED}% on ${HOSTNAME}" | mail -s "ALERT: High Disk on ${HOSTNAME}" "$MAIL"
fi

# Load Check
LOAD=$(uptime | awk -F'load average:' '{ print $2 }' | cut -d, -f1 | tr -d ' ')
LOAD_INT=${LOAD%.*}
if [ "$LOAD_INT" -gt 2 ]; then
  echo "Load average is ${LOAD} on ${HOSTNAME}" | mail -s "ALERT: High Load on ${HOSTNAME}" "$MAIL"
fi

# Service Check
for SERVICE in nginx php8.3-fpm mariadb redis-server
do
  if ! systemctl is-active --quiet "$SERVICE"; then
    echo "Service $SERVICE is NOT running on ${HOSTNAME}" | mail -s "ALERT: Service down on ${HOSTNAME}" "$MAIL"
  fi
done

sudo chmod +x /usr/local/sbin/server-health-check.sh
sudo /usr/local/sbin/server-health-check.sh

sudo crontab -e
# hinzufügen:
*/5 * * * * /usr/local/sbin/server-health-check.sh

# /usr/local/sbin/server-daily-report.sh (Beispiel – optional)
# Sammle: uptime, df -h, free -h, fail2ban status, top 5 processes by mem/cpu, last 100 auth.log lines
# Versand per mail -s "Daily Report ${HOSTNAME}" "$MAIL"

sudo yunohost backup create --system --apps nextcloud,wordpress --name "daily-$(date +%F)"
sudo yunohost backup list
# Speicherorte prüfen (je nach YunoHost-Konfiguration): /home/yunohost.backup/ oder konfiguriertes Storage

sudo yunohost app shell nextcloud
php occ maintenance:mode --on

# DB Dump (lokal – danach offsite kopieren)
mysqldump --single-transaction -h localhost -u nextcloud -p"$(php -r 'include(\"/var/www/nextcloud/config/config.php\"); echo $CONFIG[\"dbpassword\"];')" nextcloud \
  > /home/yunohost.app/nextcloud/data/backup-nextcloud-db-$(date +%F).sql

php occ maintenance:mode --off
exit

# 1) System-Stand prüfen (Debian/YunoHost Version)
# 2) YunoHost Backup restore (system + apps)
# 3) Nextcloud: maintenance:mode on → DB import → files restore → files:scan → maintenance off
# 4) WordPress: DB import + wp-content restore
# 5) Smoke Tests: HTTP(S), login, webdav, cron, mail flow

sudo apt update
sudo apt upgrade -y
sudo apt autoremove --purge -y
sudo yunohost diagnosis run
sudo fail2ban-client status
sudo journalctl -p 3 -xb --no-pager | tail -n 200

sudo yunohost app shell nextcloud
php occ status
php occ db:add-missing-indices
php occ maintenance:repair
exit

# 1) Ressourcen
uptime
free -h
df -h
sudo iotop -oPa  # falls installiert

# 2) Web/DB/PHP
sudo systemctl status nginx php8.3-fpm mariadb redis-server --no-pager

# 3) Logs (kurz)
sudo tail -n 200 /var/log/nginx/error.log
sudo journalctl -u php8.3-fpm --since "30 min ago" --no-pager | tail -n 200
sudo journalctl -u mariadb --since "30 min ago" --no-pager | tail -n 200

# 4) Fail2Ban / Bruteforce
sudo fail2ban-client status nextcloud
sudo fail2ban-client status sshd

# Welche Dienste laufen?
sudo systemctl list-units --type=service --state=running

# Welche PHP-FPM Units existieren?
sudo systemctl list-units | grep fpm

# Nginx Konfiguration komplett anzeigen (vorsichtig, sehr lang)
sudo nginx -T | head -n 120

# Nextcloud config Werte prüfen
sudo yunohost app shell nextcloud
php occ config:system:get trusted_domains
php occ config:system:get overwrite.cli.url
exit