STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-268141r1131085_rule

Vulnerability Number

V-268141

Group Title

SRG-OS-000142-GPOS-00071

Rule Version

ANIX-00-000980

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure the audit service to use IPv4 TCP syncookies.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

boot.kernel.sysctl = {
"net.ipv4.tcp_syncookies"=1;
};

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS is configured to use IPv4 TCP syncookies with the following command:

$ sudo sysctl net.ipv4.tcp_syncookies

net.ipv4.tcp_syncookies = 1

If the network parameter "ipv4.tcp_syncookies" is not equal to "1" or nothing is returned, this is a finding.

Vulnerability Number

V-268141

Documentable

False

Rule Version

ANIX-00-000980

Severity Override Guidance

Verify NixOS is configured to use IPv4 TCP syncookies with the following command:

$ sudo sysctl net.ipv4.tcp_syncookies

net.ipv4.tcp_syncookies = 1

If the network parameter "ipv4.tcp_syncookies" is not equal to "1" or nothing is returned, this is a finding.

Check Content Reference

M

Target Key

5658