STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must have the packages required for offloading audit logs installed and running.

DISA Rule

SV-268107r1131017_rule

Vulnerability Number

V-268107

Group Title

SRG-OS-000051-GPOS-00024

Rule Version

ANIX-00-000460

Severity

CAT II

CCI(s)

CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.
CCI-001665 - Preserve organization-defined system state information in the event of a system failure.

Weight

Fix Recommendation

Configure the operating system to off-load audit logs.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

services.journald.audit = true;

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify that the systemd-journald service is running with the following command:

$ systemctl status systemd-journald.service

systemd-journald.service - Journal Service
Loaded: loaded (/etc/systemd/system/systemd-journald.service; enabled; preset: ignored)
Drop-In: /nix/store/z8klzmxqgpmn8ganwrsqizy3qdxnirr8-system-units/systemd-journald.service.d
+-overrides.conf
Active: active (running) since Mon 2025-03-10 10:41:08 PDT; 1 day 2h ago

If the systemd-journald.service is not "active" and "running", this is a finding.

Vulnerability Number

V-268107

Documentable

False

Rule Version

ANIX-00-000460

Severity Override Guidance

Check Content Reference

Target Key

5658