Lockdown Playbooks Guide
Overview
The CIQ Lockdown Wrapper applies DISA STIG, CIS Benchmark, and CUI/OSPP security hardening to Rocky Linux 9 systems, converting them to RLC Pro Hardened. It ships as an RPM (ciq-lockdown-wrapper) from CIQ Depot with Ansible playbooks and bundled roles.
Use the Lockdown Wrapper to harden existing systems that are already in production. For new deployments, pre-hardened RLC Pro Hardened images are available through CIQ Depot - see the installation guides.
The lockdown playbooks are also available as an Ansible collection you can install directly from CIQ Depot with ansible-galaxy, using your existing Depot entitlement. See Installing Ansible Collections from Depot.
Hardening profiles
| Profile | Playbook | Description |
|---|---|---|
| RLC-H only | rlch9_hardened | LKRG, hardened_malloc, control - no STIG/CIS |
| CIS | rlch9_cis | Full CIS Level 1 + Level 2 rule set |
| DISA STIG | rlch9_stig | DISA STIG only |
| CIS + STIG | rlch9_combined | Full compliance - recommended for production |
| CUI/OSPP | rlch9_cui | NIST SP 800-171 / CMMC |
All playbooks install to /usr/share/ansible/collections/ansible_collections/ctrliq/rlch9_lockdown/playbooks/ and are invoked by FQCN (e.g. ctrliq.rlch9_lockdown.rlch9_stig) - see Quick Start.
Idempotent by design
The lockdown playbooks are idempotent: If there are no new changes, repeatedly running the playbooks against already-hardened systems reports zero changes. This makes the playbooks safe for repeated runs, configuration-drift remediation, and scheduled compliance enforcement. See Idempotency for verification steps and the drift audit/remediation workflow.
In this guide
- Quick Start – Install the RPM and harden your first system.
- Configuration – Profiles, environments, variables, and customization.
- Variable Reference – Full reference of named configuration variables by profile.
- Idempotency – Re-run behavior, verification, and drift remediation.
- Compliance Scores – How to interpret OpenSCAP and GOSS results.
- Troubleshooting – Common issues and solutions.
Related pages
- DISA STIG Profile – STIG compliance overview for RLC Pro Hardened.
- CIS Benchmarks Profile – CIS compliance overview.
- Verification Scripts – Check compliance status on deployed systems.
- Installing Ansible Collections from Depot – Install the lockdown collection with
ansible-galaxy. - FIPS Enablement – FIPS mode details (required for STIG).