https://vlan51.com/tags/hardening/Recent content in Hardening on vlan51Hugoen-gbMon, 01 Jan 2024 00:00:00 +0000https://vlan51.com/comware-v5/hardening/Mon, 01 Jan 2024 00:00:00 +0000https://vlan51.com/comware-v5/hardening/<p>How to harden HPE Comware v5 switches by restricting remote access to SSH and HTTPS only and using ACLs to limit management connections to specific hosts.</p> <blockquote> <p><strong>Note:</strong> HPE Comware v5 is end-of-sale on most platforms. These commands remain relevant for H3C and older HPE A/E-series switches still in service.</p> </blockquote> <h2 id="disable-insecure-protocols">Disable insecure protocols <a class="anchor" href="#disable-insecure-protocols" aria-label="Link to this section">#</a></h2> <div class="code"> <div class="code-bar"><span>cli</span><button class="copy" type="button" aria-label="Copy to clipboard">Copy</button></div><pre><code>undo ip http server enable undo telnet server enable</code></pre></div> <h2 id="enable-ssh-and-https">Enable SSH and HTTPS <a class="anchor" href="#enable-ssh-and-https" aria-label="Link to this section">#</a></h2> <div class="code"> <div class="code-bar"><span>cli</span><button class="copy" type="button" aria-label="Copy to clipboard">Copy</button></div><pre><code>ip https enable ssh server enable</code></pre></div> <h2 id="restrict-vty-to-ssh-only">Restrict VTY to SSH only <a class="anchor" href="#restrict-vty-to-ssh-only" aria-label="Link to this section">#</a></h2> <div class="code"> <div class="code-bar"><span>cli</span><button class="copy" type="button" aria-label="Copy to clipboard">Copy</button></div><pre><code>user-interface vty 0 4 protocol inbound ssh</code></pre></div> <h2 id="restrict-management-access-with-an-acl">Restrict management access with an ACL <a class="anchor" href="#restrict-management-access-with-an-acl" aria-label="Link to this section">#</a></h2> <div class="code"> <div class="code-bar"><span>cli</span><button class="copy" type="button" aria-label="Copy to clipboard">Copy</button></div><pre><code>acl number 2050 rule 5 permit source 1.2.3.4 0 rule 10 permit source 10.0.0.0 0.255.255.255 rule 15 permit source 192.168.0.0 0.0.255.255</code></pre></div> <p>Apply to HTTPS and SSH:</p>