Quick Start

Prerequisites

• Rocky Linux 9 control node (the system you run Ansible from)
• ansible-core >= 2.14.18 on the control node (needs Python 3.10 or newer)
• Rocky Linux 9 target host with SSH access
• CIQ Depot credentials

Step 1: Install the RPM

The wrapper ships in the RLC Pro Hardened repositories (rlc-<version>-hardened) on CIQ Depot - available for the current release and LTS versions. Your Depot entitlement must include RLC Pro Hardened.

On the control node, enable the RLC Pro Hardened product with the Depot client, then install:

dnf install -y ciq-lockdown-wrapper

This installs the ctrliq.rlch9_lockdown Ansible collection directly into /usr/share/ansible/collections/ - ansible-core's default collections path - so FQCN playbook references (ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig) resolve immediately, with no separate ansible-galaxy collection install step.

Nothing is installed into a directory you own yet, so the next step scaffolds one.

Step 2: Scaffold a working directory

Run the bundled ciq-lockdown-collection-init command, passing the directory you want to work from:

ciq-lockdown-collection-init ~/ciq-lockdown

This creates:

• ~/ciq-lockdown/ansible.cfg - points inventory, vault password file, and fact caching at this directory
• ~/ciq-lockdown/inventory/hosts.yml.example
• ~/ciq-lockdown/inventory/group_vars/{all,testing,production}/ - copied from the collection, including ciq_defaults.yml and the vault template

Re-run this command (with --force to also overwrite ansible.cfg/templates) after upgrading the collection to refresh these copies.

From here on, run every command from inside this directory:

cd ~/ciq-lockdown

Step 3: Configure credentials

Copy the vault template, fill in credentials, and encrypt it:

cp inventory/group_vars/all/vault.yml.example \
   inventory/group_vars/all/vault.yml
vi inventory/group_vars/all/vault.yml

vault_ansible_become_pass: "your-sudo-password"   # sudo password for ansible_user (omit if passwordless)
ciq_depot_username:        "your-depot-username"
ciq_depot_token:           "your-depot-token"
grub2_password:            "your-grub2-password"  # plaintext; hashed at runtime

Create a vault password file and encrypt:

echo 'your-vault-password' > .vault_pass
chmod 0600 .vault_pass
ansible-vault encrypt inventory/group_vars/all/vault.yml

Step 4: Configure target hosts

Copy the inventory template and set your target IP:

cp inventory/hosts.yml.example inventory/hosts.yml
vi inventory/hosts.yml

Minimum change - set ansible_host:

prod_servers:
  hosts:
    server1:
      ansible_host: 192.168.1.100   # <- your target

Test connectivity:

ansible all -m ping
# Expected: server1 | SUCCESS => { "ping": "pong" }

Step 5: Run hardening

Preview first, then run - playbooks are invoked by their fully-qualified collection name (FQCN), not a filesystem path:

# Dry run (preview changes, no modifications)
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig --check --diff

# Apply
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig

Common commands

Run from inside ~/ciq-lockdown (or wherever you scaffolded in Step 2):

# CIS Benchmark only (full Level 1 + Level 2)
ansible-playbook ctrliq.rlch9_lockdown.rlch9_cis

# CIS + STIG combined (recommended for production)
ansible-playbook ctrliq.rlch9_lockdown.rlch9_combined

# CUI/OSPP profile
ansible-playbook ctrliq.rlch9_lockdown.rlch9_cui

# RLC-H hardening only (no STIG/CIS)
ansible-playbook ctrliq.rlch9_lockdown.rlch9_hardened

# Skip automatic reboot
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig --skip-tags auto_reboot

# Idempotency check (second run should report changed=0)
ansible-playbook ctrliq.rlch9_lockdown.rlch9_stig 2>&1 | grep -E "changed=|failed="

SSH key notes

After FIPS is enabled on the target, ed25519 keys will not work. Generate an RSA or ECDSA key before running hardening:

# RSA (most compatible)
ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa_rlch
ssh-copy-id -i ~/.ssh/id_rsa_rlch.pub <user>@<target-ip>

Set in inventory/hosts.yml:

vars:
  ansible_ssh_private_key_file: ~/.ssh/id_rsa_rlch

Next steps

• Configuration – profiles, environments, and variables
• Idempotency – verify re-run behavior
• Troubleshooting – if something goes wrong