STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

DISA Rule

SV-268124r1131055_rule

Vulnerability Number

V-268124

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

ANIX-00-000710

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-002470 - Only allow the use of organization-defined certificate authorities for verification of the establishment of protected sessions.
• CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

10

Fix Recommendation

Configure NixOS to authenticate using DOD's root CA.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

services.sssd.enable = true;
environment.etc."sssd/pki/sssd_auth_ca_db.pem".source = let
certzip = pkgs.fetchzip {
url = "https://dl.dod.cyber.mil/wp-content/uploads/pki-pke/zip/unclass-certificates_pkcs7_v5-6_dod.zip";
sha256 = "sha256-iwwJRXCnONk/LFddQlwy8KX9e9kVXW/QWDnX5qZFZjc=";
};
in "${certzip}/DOD_PKE_CA_chain.pem";

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS only allows the use of DOD PKI-established certificate authorities by running the following:

$ openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root CA file is not a DOD-issued certificate with a valid date and installed in the /etc/sssd/pki/sssd_auth_ca_db.pem location, this is a finding.

Vulnerability Number

V-268124

Documentable

False

Rule Version

ANIX-00-000710

Severity Override Guidance

Verify NixOS only allows the use of DOD PKI-established certificate authorities by running the following:

$ openssl x509 -text -in /etc/sssd/pki/sssd_auth_ca_db.pem
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1 (0x1)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Validity
Not Before: Mar 20 18:46:41 2012 GMT
Not After : Dec 30 18:46:41 2029 GMT
Subject: C = US, O = U.S. Government, OU = DOD, OU = PKI, CN = DOD Root CA 3
Subject Public Key Info:
Public Key Algorithm: rsaEncryption

If the root CA file is not a DOD-issued certificate with a valid date and installed in the /etc/sssd/pki/sssd_auth_ca_db.pem location, this is a finding.

Check Content Reference

M

Target Key

5658