NixOS must enable the audit daemon.
DISA Rule
SV-268080r1130951_rule
Vulnerability Number
V-268080
Group Title
SRG-OS-000004-GPOS-00004
Rule Version
ANIX-00-000030
Severity
CAT II
CCI(s)
- CCI-000018 - Automatically audit account creation actions.
- CCI-001464 - Initiates session audits automatically at system start-up.
- CCI-001858 - Provide an alert in an organization-defined real-time-period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
- CCI-001875 - Provide an audit reduction capability that supports on-demand audit review and analysis.
- CCI-001877 - Provide an audit reduction capability that supports after-the-fact investigations of incidents.
- CCI-001878 - Provide a report generation capability that supports on-demand audit review and analysis.
- CCI-001879 - Provide a report generation capability that supports on-demand reporting requirements.
- CCI-001880 - Provide a report generation capability that supports after-the-fact investigations of security incidents.
- CCI-001881 - Provide an audit reduction capability that does not alter original content or time ordering of audit records.
- CCI-001882 - Provide a report generation capability that does not alter original content or time ordering of audit records.
- CCI-001876 - Provide an audit reduction capability that supports on-demand reporting requirements.
- CCI-001889 - Record time stamps for audit records that meet organization-defined granularity of time measurement.
Weight
10
Fix Recommendation
Configure NixOS to enable the audit service by updating the NixOS config, typically stored either in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:
security.auditd.enable = true;
security.audit.enable = true;
Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch
Check Contents
Verify NixOS has the audit service configured with the following commands:
$ systemctl is-active audit.service
active
$ systemctl is-active auditd.service
active
If auditd and audit services are not active, this is a finding.
Vulnerability Number
V-268080
Documentable
False
Rule Version
ANIX-00-000030
Severity Override Guidance
Verify NixOS has the audit service configured with the following commands:
$ systemctl is-active audit.service
active
$ systemctl is-active auditd.service
active
If auditd and audit services are not active, this is a finding.
Check Content Reference
M
Target Key
5658
STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025: