STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must implement DOD-approved encryption to protect the confidentiality of remote access sessions.

DISA Rule

SV-268089r1130978_rule

Vulnerability Number

V-268089

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

ANIX-00-000150

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure NixOS to use only ciphers employing FIPS 140-3 approved algorithms.

To configure OpenSSH, add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

services.openssh.setting.Ciphers = [
"aes256-ctr"
"aes192-ctr"
"aes128-ctr"
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS is configured to only use ciphers employing FIPS 140-3 approved algorithms with the following command:

$ grep Ciphers /etc/ssh/sshd_config
Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If the cipher entries in the "sshd_config" file have any ciphers other than "aes256-ctr,aes192-ctr,aes128-ctr", the order differs from the example above, or they are missing or commented out, this is a finding.

Vulnerability Number

V-268089

Documentable

False

Rule Version

ANIX-00-000150

Severity Override Guidance

Verify NixOS is configured to only use ciphers employing FIPS 140-3 approved algorithms with the following command:

$ grep Ciphers /etc/ssh/sshd_config
Ciphers aes256-ctr,aes192-ctr,aes128-ctr

If the cipher entries in the "sshd_config" file have any ciphers other than "aes256-ctr,aes192-ctr,aes128-ctr", the order differs from the example above, or they are missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5658