Ansible Lockdown Logo

Introduction

  • Automated Security Benchmark - Auditing and Remediation
    • MindPoint Group - A Quantum Sky Company’s (QuantumSky) Ansible-Lockdown Overview
    • Why should this role be applied to a system?
    • What is security hardening?
      • CIS Overview
        • What is CIS?
        • What do the CIS roles do?
        • Control Severities
      • STIG Overview
        • What is STIG?
        • What do the STIG roles do?
        • Control Severities
    • What is provided?
    • How is this written?
    • Development Process
      • Lifecycle of releases and branches
      • Branches
        • Remediate
        • Audit
      • Demos

Getting Started

  • Audit
    • Overview
    • Considerations
    • Currently Enabled Playbooks
    • Setup auditing as standalone
    • Running the Audit Only as part of remediate playbook
    • Defining the audit
    • Running on Linux
      • Bash Script Explanation: Goss Security Audit
    • Fetch or Copy Audit Files
    • Running on Windows
      • Windows CIS Roles: Audit from the Playbook
      • PowerShell Script Explanation: Goss Security Audit
      • Windows STIG Roles: SCAP Compliance Checker
  • Remediate
    • Requirements
    • Installation
      • Using ansible-galaxy
      • Using git
    • How to Use
      • On Its Own
      • With Existing Playbooks
      • Variables and the Role
      • Using and Modifying Variables Directly (defaults/main.yml)
      • Modifying Variables with Extra-Vars
      • Using Tags
  • Using Audit and Remediate together
  • Post Hardening Lockdown Reporting via Ansible_Facts
    • Lockdown Facts Example:
      • CIS
      • STIG
  • Container and Docker Guide
    • Overview
    • Container Detection
    • Controls Skipped in Containers
    • Running Audit in Containers
      • Audit from Host Against Container
    • Running Remediation in Containers
      • Building Hardened Container Images
      • Remediating Running Containers
    • Known Limitations
    • Best Practices
    • Troubleshooting
  • ARM64/aarch64 Architecture Guide
    • Overview
    • Support Status
    • Getting Started on ARM64
      • Prerequisites
      • Running Remediation
      • Running Audit
    • Known Limitations
      • auditd System Call Differences
      • Kernel Module Differences
      • Validation Steps
    • Troubleshooting
      • Audit Binary Issues
      • auditd Rule Failures
    • Reporting ARM64 Issues
    • Best Practices

Available Content

  • Release Schedule
    • CIS
    • STIG
    • Playbook Releases
      • Example
  • CIS Benchmarks
    • Operating Systems
    • Cloud Platforms
    • Applications
    • Archived Roles
  • CIS Specific Information
    • Advanced Options
  • STIG Benchmarks
    • Operating Systems
    • Networking
    • Applications
    • Archived Roles

Development

  • Contributing
    • How to contribute to audit development
      • Adding code
      • Considerations
      • Layout
        • Content
        • Metadata
      • Gotchas
    • How to Contribute to Remediate Development
      • Remediate Code Summary
      • Remediate Code Considerations
        • General Layout
        • Variables
        • STIG Control Task Layout
        • CIS Control Task Layout
    • Molecule - Linux-Based Container Testing
      • Prerequisites
      • Repository layout
      • Scenario configuration
      • Running tests
      • Idempotency
      • Linting integration
      • Platforms and ARM64
      • CI/CD pipelines
      • Troubleshooting
      • Best Practices

Support

  • Getting Support
    • Contact Us
    • Quantum Sky Official Site and Services
  • Audit - FAQ
    • Goss Binary Issues
      • Why does goss run manually fail?
      • Goss Binary Not Found
      • Exec Format Error
      • Goss Version Too Old
    • Architecture-Specific Issues
      • Why do I have different results between x86_64 and ARM64/aarch64 audits?
    • Audit Results and Interpretation
      • How Do I Read the Audit Output?
      • Why Are So Many Controls Failing?
      • Why Do I Have Failures After Successful Remediation?
      • How Do I Filter Audit Results?
    • Performance and Resource Issues
      • My system is impacted when running the audit. How can I restrict its effect?
      • Audit Takes Too Long
      • Audit Causes High Disk I/O
    • Script and Configuration Issues
      • Variables File Not Found
      • Permission Denied Running Script
      • Output File Not Created
    • Container and Special Environments
      • Why Do Many Controls Fail in Containers?
  • Remediate - FAQ
    • Connection and Authentication Issues
      • Missing Sudo Password (Linux OS Based)
      • SSH Connection Timeout
      • WinRM Connection Failed (Windows)
      • Python Interpreter Not Found
      • Module Not Found Errors
    • Playbook Execution Issues
      • Task Fails with “Permission Denied”
      • Idempotency Warnings
    • Configuration and Variable Issues
      • How Do I Skip Specific Controls?
      • How Do I Change Default Values?
      • Variable Precedence Issues
    • Service and System Issues
      • Users Locked Out After Hardening
    • Where Can I Get More Help?
  • Known Issues
    • Audit Known Issues
      • ARM64/aarch64 auditd Syscall Differences
      • Goss Timeout on Large Filesystems
      • Container Environment Audit Limitations
      • Windows Audit Requires Administrator
    • Remediate Known Issues
      • Cloud-init Fails After Hardening
      • SELinux Modules Broken on RHEL 8.6 with EPEL
      • Python 3.8 Library Issues on RHEL 8
      • FIPS Mode Breaks Certain Controls
      • Grub Password Lockout
      • SSH Lockout After Hardening
      • PAM Lockout Issues
    • Platform-Specific Issues
      • Amazon Linux 2023
      • Ubuntu 24.04
      • Windows Server 2025
    • Deprecation Notices
      • Archived Benchmarks
    • Reporting New Issues

Reference & Appendices

  • Glossary
  • Useful links
    • Support
    • Main Content site
    • Audit
    • Remediate
    • Linting
Ansible Lockdown
  • Useful links

Useful links

Support

  • Commercial

    Providing:

    • Early Releases

    • Priority bug fixes

    • Ticketed support

    • Lockdown Enterprise

    • engage@mindpointgroup.com : Email inquiry

  • Community

    • Discord Invite Link

Main Content site

  • Repositories

Audit

  • Syver (a fork of Goss) and Syver Docs

  • krameff/goss (Syver’s earlier name, archived)

  • Goss (upstream) and Goss Docs

Remediate

  • Ansible Main Site

  • Ansible Get Started

  • Ansible Docs

Linting

  • ansible-lint

  • yamllint

  • pre-commit

Previous

© Copyright 2026, MindPoint Group - A Quantum Sky Company. Last updated on 2026-10-30 20:53.

Built with Sphinx using a theme provided by Read the Docs.