STIGQter STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS audit logs must have a mode of 0600 or less permissive.

DISA Rule

SV-268114r1039230_rule

Vulnerability Number

V-268114

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

ANIX-00-000560

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Verify that the audit log files have a mode of "0600" or less permissive.

Using the path of the directory containing the audit logs, configure the audit log files have a mode of "0600" or less by using the following command:

$ sudo chmod 0600 /var/log/audit/audit.log

Check Contents

Verify that the audit log files have a mode of "0600" or less permissive.

First, determine where the audit logs are stored with the following command:

$ sudo grep log_file /etc/audit/auditd.conf

log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, check if the audit log files have a mode of "0600" or less by using the following command:

$ sudo find /var/log/audit -type f -exec stat -c "%a %n" {} \;

600 /var/log/audit/audit.log

If the audit log files have a mode more permissive than "0600", this is a finding.

Vulnerability Number

V-268114

Documentable

False

Rule Version

ANIX-00-000560

Severity Override Guidance

Verify that the audit log files have a mode of "0600" or less permissive.

First, determine where the audit logs are stored with the following command:

$ sudo grep log_file /etc/audit/auditd.conf

log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, check if the audit log files have a mode of "0600" or less by using the following command:

$ sudo find /var/log/audit -type f -exec stat -c "%a %n" {} \;

600 /var/log/audit/audit.log

If the audit log files have a mode more permissive than "0600", this is a finding.

Check Content Reference

M

Target Key

5658