chrisfu
|
ca8dd6a525
|
Add TP-Link SG2428LP switch hardening as repeatable IaC + static IP/DNS
Secure and configure the SG2428LP managed switch (10.0.0.10) as repeatable
Ansible, driven from the control node over SSH by an expect engine.
- tplink_switch_harden role (verified JetStream CLI syntax): HTTP off/
HTTPS-only, Telnet off, SSH v2, SNMP off, RSTP + loopback-detection,
then copy running-config startup-config (persist).
- playbooks/harden_switch.yml + [switches] inventory group; dry by default,
-e switch_apply=true to apply, -e switch_apply_network=true for addressing.
- Static mgmt IP 10.0.0.10/24 (off DHCP, below the .20-.199 pool), gw 10.0.0.1,
hostname sg2428lp.
- op -> ansible-vault bridge (etc/set-switch-1password.sh); admin password in
group_vars/switches/vault.yml.
- DNS: A/PTR sg2428lp.prole.org -> 10.0.0.10 (records added to dns.yml/ptr_records).
- Fix: tag the samba_reverse_dns zone-list set_fact so tag-limited runs define
samba_reverse_zones.
Engine notes (hard-won): forces password-only SSH auth (the switch drops
publickey-first logins); always saves config (unsaved changes revert on reboot).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
2026-06-10 00:20:55 -07:00 |
|