Blog · 2026-07-30 · Hands-on

Ubuntu 24.04 Base + ubuntu24_cis

Apply the public StigForge role ubuntu24_cis on StigReady Ubuntu 24.04 Base. Defaults target CIS Level 1; Level 2 evidence ships in the same release tree. StigReady Ubuntu 24.04 Base is on AWS Marketplace: the Base catalog links to its listing.

Before you start

A subscription to StigReady Ubuntu 24.04 Base on AWS Marketplace (the Base catalog links to its listing), or a Private Offer
Ansible 2.16+ on a control host that can SSH to the instance
Role pin used in this post: v0.3.49, the newest tag on 2026-10-24 — check stigready/ubuntu24-cis tags for newer ones

1. Launch Base

Subscribe to Ubuntu 24.04 Base (x86_64 or arm64) from its AWS Marketplace listing, linked from the Base catalog, or browse the StigReady seller page. Contact us for a Private Offer.
Launch with a key pair you control.
SSH as ubuntu (or use SSM Session Manager).

ssh -i your-key.pem ubuntu@<instance-ip>

2. Install the role (pinned tag)

# requirements.yml
roles:
  - src: https://github.com/stigready/ubuntu24-cis
    scm: git
    version: v0.3.49
    name: ubuntu24_cis

ansible-galaxy role install -r requirements.yml -p ./roles

3. Run the playbook

# inventory.ini
[stig]
ubuntu24-base ansible_host=<instance-ip> ansible_user=ubuntu

# site.yml
- hosts: stig
  become: true
  roles:
    - role: ubuntu24_cis

ansible-playbook -i inventory.ini site.yml

The role default profile is cis-l1 (stigforge_profile in defaults/main.yml). Set stigforge_profile: cis-l2 when your policy requires Level 2, and prefer the Applied CIS L2 AMI if you want L2 scored at bake without wiring it yourself.

4. Score the instance

The role repo ships a per-tag manifest (factory commit, SSG version, content digest), not a score; container verification was retired because a container cannot evaluate most benchmark rules.

Score this host: oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_cis_level1_server --results results.xml --report report.html /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml (cis_level2_server for L2).
Published scores for the StigReady Applied image built with this role: stigready.com/#applied-tier (the StigForge table names the role version each score was measured with)

Questions? contact@stigready.com