cfc6ec9721
Implements Task 5. Disables telnet/ftp/www/www-ssl/api/api-ssl (winbox kept for recovery), sets DNS + NTP client, ensures SSH on the configured port. Verified run-twice idempotent (changed=0) against crs310-maker on the bench. Also sets ansible_user=sjat in host_vars for day-2 key auth. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
37 lines
1.2 KiB
YAML
37 lines
1.2 KiB
YAML
---
|
|
# Identity, management services, DNS/NTP and service hardening.
|
|
# All commands here are `set` on singleton/named items, so they are naturally
|
|
# idempotent; RouterOS `command` cannot report change, hence `changed_when: false`.
|
|
|
|
- name: Set system identity
|
|
community.routeros.command:
|
|
commands:
|
|
- /system/identity/set name="{{ switch_identity_name }}"
|
|
changed_when: false
|
|
|
|
- name: Configure DNS servers
|
|
community.routeros.command:
|
|
commands:
|
|
- /ip/dns/set servers="{{ switch_dns_servers }}" allow-remote-requests=no
|
|
changed_when: false
|
|
|
|
- name: Configure NTP client
|
|
community.routeros.command:
|
|
commands:
|
|
- /system/ntp/client/set enabled=yes servers="{{ switch_ntp_servers }}"
|
|
changed_when: false
|
|
|
|
- name: Disable unused IP services (hardening; winbox kept for recovery)
|
|
community.routeros.command:
|
|
commands:
|
|
- /ip/service/set {{ item }} disabled=yes
|
|
loop: "{{ switch_disabled_services }}"
|
|
loop_control:
|
|
label: "{{ item }}"
|
|
changed_when: false
|
|
|
|
- name: Ensure SSH service is enabled on the configured port
|
|
community.routeros.command:
|
|
commands:
|
|
- /ip/service/set ssh disabled=no port={{ switch_ssh_port }}
|
|
changed_when: false
|