mirror of
https://github.com/dredx/prole.git
synced 2026-09-23 11:03:59 +00:00
ca8dd6a525
Secure and configure the SG2428LP managed switch (10.0.0.10) as repeatable Ansible, driven from the control node over SSH by an expect engine. - tplink_switch_harden role (verified JetStream CLI syntax): HTTP off/ HTTPS-only, Telnet off, SSH v2, SNMP off, RSTP + loopback-detection, then copy running-config startup-config (persist). - playbooks/harden_switch.yml + [switches] inventory group; dry by default, -e switch_apply=true to apply, -e switch_apply_network=true for addressing. - Static mgmt IP 10.0.0.10/24 (off DHCP, below the .20-.199 pool), gw 10.0.0.1, hostname sg2428lp. - op -> ansible-vault bridge (etc/set-switch-1password.sh); admin password in group_vars/switches/vault.yml. - DNS: A/PTR sg2428lp.prole.org -> 10.0.0.10 (records added to dns.yml/ptr_records). - Fix: tag the samba_reverse_dns zone-list set_fact so tag-limited runs define samba_reverse_zones. Engine notes (hard-won): forces password-only SSH auth (the switch drops publickey-first logins); always saves config (unsaved changes revert on reboot). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
4.6 KiB
YAML
60 lines
4.6 KiB
YAML
---
|
|
# tplink_switch_harden — defaults
|
|
#
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# SAFETY: switch_apply defaults to FALSE.
|
|
# A normal run only logs in and captures `show system-info` (proves access,
|
|
# changes nothing). Config is applied ONLY with -e switch_apply=true.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
switch_apply: false
|
|
switch_expect_timeout: 30
|
|
|
|
# Network re-addressing (static IP + gateway) is DISRUPTIVE: applying it drops
|
|
# the session because the management IP changes. Kept behind its own toggle and
|
|
# OFF by default, because in steady state (already at the static IP) it is a
|
|
# no-op, and the one-time DHCP->static cutover is handled deliberately, not on
|
|
# every run. Enable with -e switch_apply_network=true during the cutover.
|
|
switch_apply_network: false
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# VERIFIED against SG2428LP firmware via on-device `?` help (2026-06-09).
|
|
# All entries are idempotent — most are already at these values by factory
|
|
# default, so re-applying is a harmless no-op. Each runs inside `configure`.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
switch_harden_commands:
|
|
- { cmd: "no ip http server", desc: "disable plaintext HTTP management (port 80)" }
|
|
- { cmd: "ip http secure-server", desc: "ensure HTTPS management is enabled" }
|
|
- { cmd: "telnet disable", desc: "disable Telnet (port 23)" }
|
|
- { cmd: "ip ssh server", desc: "ensure SSH server is enabled" }
|
|
- { cmd: "ip ssh version v2", desc: "enable SSH protocol v2" }
|
|
- { cmd: "no snmp-server", desc: "ensure SNMP agent is disabled" }
|
|
- { cmd: "spanning-tree", desc: "enable spanning tree globally" }
|
|
- { cmd: "spanning-tree mode rstp", desc: "use RSTP" }
|
|
- { cmd: "loopback-detection", desc: "enable global loopback detection" }
|
|
|
|
# Device identity — safe, non-disruptive (applied with the hardening set).
|
|
# VERIFY token: JetStream may use `hostname` or `system name`.
|
|
switch_identity_commands:
|
|
- { cmd: "hostname {{ switch_hostname }}", desc: "set system hostname" }
|
|
|
|
# Static management addressing — DISRUPTIVE (drops session on the IP change).
|
|
# Applied only when switch_apply_network=true. VERIFY exact syntax on-device:
|
|
# the mgmt interface, the dhcp-client disable, and gateway form all vary.
|
|
switch_network_commands:
|
|
- { cmd: "interface vlan {{ switch_mgmt_vlan }}", desc: "enter mgmt VLAN interface" }
|
|
- { cmd: "ip address {{ switch_mgmt_ip_static }} {{ switch_mgmt_netmask }}", desc: "set static mgmt IP (overrides DHCP alloc)" }
|
|
- { cmd: "exit", desc: "leave interface context" }
|
|
- { cmd: "ip route 0.0.0.0 0.0.0.0 {{ switch_mgmt_gateway }}", desc: "default route via gateway" }
|
|
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# OPT-IN, HIGHER-RISK hardening — left OUT of the default set on purpose.
|
|
# Management access-control can lock you out if the control node is not inside
|
|
# the permitted range; only enable after confirming syntax AND your admin
|
|
# subnet. Provided here as a reference to fold into switch_harden_commands once
|
|
# verified. Do the ACL LAST and from a host inside the permitted range.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
# switch_harden_commands_optional:
|
|
# - { cmd: "user idle-timeout 10", desc: "10-min CLI idle timeout" }
|
|
# - { cmd: "user access-control ip-based enable", desc: "enable mgmt IP allowlist" }
|
|
# - { cmd: "user access-control ip-based 10.0.0.0 255.255.255.0", desc: "permit admin subnet" }
|