Variable Reference

Scope

This page lists the named, semantically-meaningful variables each hardening profile exposes - the ones with real values to tune (paths, timeouts, policy strings, credentials), not simple on/off rule switches. See Key variables on the Configuration page for the most commonly-needed subset, and Individual rule toggles for the rhel_09_XXXXXX (STIG) and rhel9cis_rule_X_X_X (CIS) per-rule enable/disable pattern - those aren't repeated here since every one follows the same true/false convention already documented there.

Not every variable a role reads is listed here. If you need something not covered, check inventory/group_vars/all/ciq_defaults.yml in your scaffolded working directory (see Quick Start) or contact CIQ Support.

Common to every profile

Variable	Default	Description
`ciq_allow_reboot`	`true`	Allow automatic reboot after hardening
`ciq_run_audit`	`true` (`false` for RLC-H only)	Run a compliance audit before/after hardening
`ciq_post_reboot_delay`	`30`	Seconds to wait after triggering reboot before reconnecting
`ciq_reboot_timeout`	`600`	Seconds to wait for the target to come back after reboot
`ciq_enable_lkrg`	`true`	Enable Linux Kernel Runtime Guard
`ciq_enable_hardened_malloc`	`true`	Enable the hardened memory allocator
`ciq_enable_rlch_hardening`	`true`	Enable RLC-H package install, control utility restrictions, and password-hashing algorithm enforcement. Distinct from `ciq_enable_lkrg` and `ciq_enable_hardened_malloc` above, which gate LKRG and hardened_malloc independently
`ciq_run_rlch`	`true`	Gates only the CIQ meta-package (`rlc-h`) install step - see Framework selection
`ciq_use_state_files`	`false`	Enable the experimental state-files feature (see Idempotency)
`ciq_use_lts_repos`	`false`	Use the Rocky Linux 9.6 LTS repo bundles instead of the rolling `rlc-h-9` repos
`enable_firewalld`	`true`	Enable and configure firewalld
`ciq_rlch_repos`	(list)	RLC-H repository products to enable
`ciq_depot_username` / `ciq_depot_token`	`""`	Depot credentials - set via vault, required for package installation
`grub2_password`	`""`	GRUB bootloader password (plaintext in vault; hashed at runtime). Optional - the GRUB password control skips cleanly with a warning if unset, rather than failing
`log_file`	`/var/log/rlc-hardened-setup.log`	Wrapper's own run log on the target
`ciq_audit_output_dir`	`/var/log/ciq-lockdown`	Where audit reports are written on the target

Profile-specific variables

DISA STIG

CIS Benchmark

CUI / OSPP

RLC-H only

rlch9_stig

Variable	Default	Description
`rhel9stig_cat1_patch`	`true`	Apply Category I (High) controls
`rhel9stig_cat2_patch`	`true`	Apply Category II (Medium) controls
`rhel9stig_cat3_patch`	`true`	Apply Category III (Low) controls
`ciq_dod_banner`	`true`	Display the DoD login banner
`ciq_fail_delay`	`4`	Seconds delayed after a failed login attempt
`ciq_password_max_age`	`60`	Maximum password age in days
`ciq_password_min_age`	`1`	Minimum password age in days
`ciq_ptrace_scope`	`3`	Kernel `ptrace_scope` restriction level
`ciq_set_password_aging`	`true`	Enforce password aging (max/min age, warn age)
`ciq_root_mail_alias`	`""`	Local user or relay address that receives root's system mail
`ciq_grub_admin_username`	`"bootadmin"`	Sets `grub2_username`'s default for this profile - the account name STIG's bootloader task actually reads
`grub2_username`	`"{{ ciq_grub_admin_username }}"`	GRUB superuser account name STIG's bootloader task reads directly
`var_authselect_profile`	`sssd`	Authselect profile name STIG expects

rlch9_cis

Variable	Default	Description
`rhel9cis_server`	`true`	Server profile (vs workstation)
`rhel9cis_pass_max_days`	`45`	Maximum password age in days
`rhel9cis_pass_min_days`	`2`	Minimum password age in days
`rhel9cis_pass_warn_age`	`7`	Password expiry warning period in days
`rhel9cis_authselect_custom_profile_name`	`rlch9-hardened`	Name of the custom authselect profile CIS creates
`rhel9cis_set_boot_pass`	`false`	Effective default (`ciq_defaults.yml` overrides the role's own default) - leave off. The upstream role's built-in boot-password task checks different variable names than this one sets and hard-fails if enabled; the real GRUB password mechanism is `ciq_gap_cis`'s task, driven by `grub2_password` (see Bootloader password)
`rhel9cis_shell_timeout`	`900`	Idle shell timeout in seconds
`rhel9cis_umask`	`"027"`	Default umask applied system-wide
`rhel9cis_disruption_high`	`true`	Apply CIS rules considered potentially disruptive upstream (e.g. authselect profile changes)
`rhel9cis_time_sync_server`	`"0.rhel.pool.ntp.org,1.rhel.pool.ntp.org"`	NTP servers used for time sync validation
`var_authselect_profile`	`sssd`	Authselect profile name CIS expects
`var_password_hashing_algorithm`	`SHA512`	Password hash algorithm (`/etc/login.defs`)
`var_password_hashing_algorithm_pam`	`sha512`	Password hash algorithm (PAM)
`var_password_pam_minlen`	`14`	Minimum password length
`var_password_pam_minclass`	`4`	Minimum character classes required in a password
`var_password_pam_difok`	`2`	Minimum characters that must differ from the previous password
`var_password_pam_maxrepeat`	`3`	Maximum consecutive repeated characters allowed
`var_password_pam_dictcheck`	`1`	Enable dictionary-word password check
`var_password_pam_remember`	`24`	Number of previous passwords remembered (reuse prevention)
`var_selinux_state`	`enforcing`	SELinux mode
`var_selinux_policy_name`	`targeted`	SELinux policy
`var_system_crypto_policy`	`DEFAULT:NO-SHA1`	System-wide crypto policy string
`cis_banner_text`	`"Authorized users only. All activity may be monitored and reported."`	Login banner text

rlch9_cui

Variable	Default	Description
`ciq_dod_banner`	`false`	No DoD banner requirement under CUI/OSPP
`ciq_install_fips_meta`	`true`	Install the CIQ FIPS metapackage - CUI/OSPP requires FIPS
`ciq_set_password_aging`	`false`	No password aging required under OSPP - faillock handles lockout instead
`firewalld_sshd_zone`	`public`	Firewalld zone applied to the SSH service
`inactivity_timeout_value`	`600`	Idle session timeout in seconds - OSPP/CUI requires 10 minutes
`sshd_idle_timeout_value`	`600`	SSH idle timeout in seconds
`rhel9stig_cat1_patch` / `_cat2_patch` / `_cat3_patch`	`true`	STIG master switches - CUI runs all STIG categories to cover its OSPP rules
`var_authselect_profile`	`custom/rlch9-hardened`	Authselect profile name CUI expects
`var_accounts_passwords_pam_faillock_deny`	`3`	Failed logins allowed before lockout
`var_accounts_passwords_pam_faillock_fail_interval`	`900`	Window (seconds) over which failed attempts count toward lockout
`var_accounts_tmout`	`600`	Idle shell timeout in seconds
`var_auditd_admin_space_left_action`	`single`	Action when audit log disk space is critically low
`var_logind_session_timeout`	`10_minutes`	systemd-logind idle session timeout
`var_password_pam_minlen`	`15`	Minimum password length
`var_password_pam_minclass`	`4`	Minimum character classes required in a password
`var_password_pam_difok`	`8`	Minimum characters that must differ from the previous password
`var_system_crypto_policy`	`"fips"`	Plain FIPS crypto policy (not `FIPS:STIG` - CUI's requirement differs from STIG's)

rlch9_hardened - no DISA STIG or CIS Benchmark hardening, infrastructure hardening only.

Variable	Default	Description
`ciq_security_policy`	`"HARDENED"`	Identifies this profile in audit output
`ciq_enable_fips`	`false`	FIPS is off by default in this profile - the STIG and CUI profiles enable it

Troubleshooting Overview