! PermitANY — Arista EOS Security Hardening
! CIS-aligned security hardening for Arista EOS: password policy, management ACL, SSH restrictions, AAA with TACACS+, disable unused services, and control-plane hardening.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
hostname AR-LEAF-01

ip domain-name corp.local

!
! ── Banners ───────────────────────────────────────────────────────────
banner login
AUTHORIZED ACCESS ONLY. All activity is monitored and logged.
EOF
!
! ── Local Users & Enable ─────────────────────────────────────────────

enable secret sha512 $$encrypted$$

!
! ── Password Policy ──────────────────────────────────────────────────
aaa root secret sha512 $$encrypted$$
password minimum length 12
password policy default
   minimum length 12
   minimum digit 1
   minimum uppercase 1
   minimum lowercase 1
   minimum special-character 1
!
! ── AAA / TACACS+ ────────────────────────────────────────────────────

tacacs-server host 10.0.0.50 vrf MGMT key 7 TacacsK3y!
aaa group server tacacs+ TACACS-GROUP
   server 10.0.0.50 vrf MGMT
aaa authentication login default group TACACS-GROUP local
aaa authentication enable default group TACACS-GROUP enable
aaa authorization exec default group TACACS-GROUP local
aaa accounting exec default start-stop group TACACS-GROUP
aaa accounting commands all default start-stop group TACACS-GROUP

!
! ── SSH Hardening ────────────────────────────────────────────────────
management ssh
   authentication mode password
   idle-timeout 10
   log-level info
   cipher aes128-ctr aes192-ctr aes256-ctr
   mac hmac-sha2-256 hmac-sha2-512
   kex ecdh-sha2-nistp256 ecdh-sha2-nistp384 diffie-hellman-group14-sha1
!

management telnet
   shutdown
!


management http-server
   protocol https
   no shutdown
!

! ── Management ACL ───────────────────────────────────────────────────
ip access-list MGMT-ACCESS

   permit ip 10.0.0.0/24 any

   deny ip any any log
!
management ssh
   ip access-group MGMT-ACCESS in
!
! ── Line Settings ────────────────────────────────────────────────────
no aaa authentication login console none
exec-timeout 10 0
!
! ── Login Security ───────────────────────────────────────────────────
aaa authentication policy lockout failure 3
aaa authentication policy lockout duration 300
!
! ── Logging ──────────────────────────────────────────────────────────
logging buffered 32000
logging format timestamp high-resolution
logging on
!
! ── Disable Unused Services ──────────────────────────────────────────
no ip bootp server
no ip source-route
no ip proxy-arp
!