STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must be configured to limit the number of concurrent sessions to 10 for all accounts and/or account types.

DISA Rule

SV-268085r1130966_rule

Vulnerability Number

V-268085

Group Title

SRG-OS-000027-GPOS-00008

Rule Version

ANIX-00-000090

Severity

CAT III

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

Configure NixOS to limit the number of concurrent sessions to 10 for all accounts and/or account types.

Update the NixOS config, typically stored either in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.pam.loginLimits = [
{
domain = "*";
item = "maxlogins";
type = "hard";
value = "10";
}
];

Note: Security.pam.loginLimits can be set as a global domain (with the * wildcard) but may be set differently for multiple domains.

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS limits the number of concurrent sessions to 10 for all accounts and/or account types.

Check the pam configuration files and confirm a conf file with maxlogins configured:

$ grep "limits.conf" /etc/pam.d/login
> session required /nix/store/sl3fa5zh61xxl03m64if2wqzbvrb6zly-linux-pam-1.6.1/lib/security/pam_limits.so conf=/nix/store/aq8ni1qh3pdygl9cn3qfb8v583ask67m-limits.conf # limits (order 12200)

$ cat /nix/store/aq8ni1qh3pdygl9cn3qfb8v583ask67m-limits.conf

* hard maxlogins 10
@pipewire - rtprio 95
@pipewire - nice -19
@pipewire - memlock 4194304

If the "maxlogins" item is missing or commented out, or the value is set greater than "10" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Vulnerability Number

V-268085

Documentable

False

Rule Version

ANIX-00-000090

Severity Override Guidance

Verify NixOS limits the number of concurrent sessions to 10 for all accounts and/or account types.

Check the pam configuration files and confirm a conf file with maxlogins configured:

$ grep "limits.conf" /etc/pam.d/login
> session required /nix/store/sl3fa5zh61xxl03m64if2wqzbvrb6zly-linux-pam-1.6.1/lib/security/pam_limits.so conf=/nix/store/aq8ni1qh3pdygl9cn3qfb8v583ask67m-limits.conf # limits (order 12200)

$ cat /nix/store/aq8ni1qh3pdygl9cn3qfb8v583ask67m-limits.conf

* hard maxlogins 10
@pipewire - rtprio 95
@pipewire - nice -19
@pipewire - memlock 4194304

If the "maxlogins" item is missing or commented out, or the value is set greater than "10" and is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Check Content Reference

M

Target Key

5658