STIGQter STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

The NixOS audit records must be off-loaded onto a different system or storage media from the system being audited.

DISA Rule

SV-268108r1131020_rule

Vulnerability Number

V-268108

Group Title

SRG-OS-000051-GPOS-00024

Rule Version

ANIX-00-000480

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the operating system to off-load audit records onto a different system or media from the system being audited by specifying a remote destination in the systemd-journald configuration.

On the client, modify /etc/nixos/configuration.nix or /etc/nixos/flake.nix to include the following lines:

services.journald.upload = {
enable = true;
Upload = {
ServerKeyFile = $PATH_TO_CLIENT_PEM_SSL_KEY;
URL = $URL_OF_REMOTE_SERVER;
ServerCertificateFile = $PATH_TO_SSL_CERT;
TrustedCertificateFile = $PATH_TO_SERVER_CERT;
};
};
}

On the server, modify /etc/nixos/configuration.nix or /etc/nixos/flake.nix to include the following lines:
services.journald.remote = {
enable = true;
listen = "https";
URL = $URL_OF_REMOTE_SERVER;
ServerKeyFile = $PATH_TO_SERVER_PEM_SSL_KEY;
ServerCertificateFile = $PATH_TO_SSL_CERT;
};
};

Check Contents

Verify the audit system off-loads audit records onto a different system or media from the system being audited.

List the configured destinations with the following command:

$ grep -i "Url" /etc/systemd/journal-upload.conf"

If no URL is configured, this is a finding.

Vulnerability Number

V-268108

Documentable

False

Rule Version

ANIX-00-000480

Severity Override Guidance

Verify the audit system off-loads audit records onto a different system or media from the system being audited.

List the configured destinations with the following command:

$ grep -i "Url" /etc/systemd/journal-upload.conf"

If no URL is configured, this is a finding.

Check Content Reference

M

Target Key

5658