STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

The NixOS audit package must be installed.

DISA Rule

SV-268090r1130981_rule

Vulnerability Number

V-268090

Group Title

SRG-OS-000037-GPOS-00015

Rule Version

ANIX-00-000160

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000158 - Provide the capability to process, sort, and search audit records for events of interest based on organization-defined audit fields within audit records.
• CCI-000159 - Use internal system clocks to generate time stamps for audit records.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001403 - Automatically audit account modification actions.
• CCI-001404 - Automatically audit account disabling actions.
• CCI-001405 - Automatically audit account removal actions.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-002130 - Automatically audit account enabling actions.
• CCI-002234 - Log the execution of privileged functions.

Weight

10

Fix Recommendation

Configure NixOS to have the audit service package.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

environment.systemPackages = [
audit
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify that NixOS has the audit service installed with the following command:

$ systemctl is-active audit
active

If the "audit" service is not active, this is a finding.

Vulnerability Number

V-268090

Documentable

False

Rule Version

ANIX-00-000160

Severity Override Guidance

Verify that NixOS has the audit service installed with the following command:

$ systemctl is-active audit
active

If the "audit" service is not active, this is a finding.

Check Content Reference

M

Target Key

5658