STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must notify designated personnel if baseline configurations are changed in an unauthorized manner.

DISA Rule

SV-268153r1131108_rule

Vulnerability Number

V-268153

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

ANIX-00-001460

Severity

CAT II

CCI(s)

• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
• CCI-002696 - Verify correct operation of organization-defined security functions.
• CCI-002699 - Perform verification of the correct operation of organization-defined security functions: when the system is in an organization-defined transitional state; upon command by a user with appropriate privileges; and/or on an organization-defined frequency.
• CCI-002702 - Shut the system down, restart the system, and/or initiate organization-defined alternative action(s) when anomalies in the operation of the organization-defined security functions are discovered.

Weight

10

Fix Recommendation

Configure NixOS to notify when baseline configuration changes.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

nixpkgs.overlays = [
(final: prev: {
aide = prev.aide.overrideAttrs (old: {
configureFlags = (old.configureFlags or [ ]) ++ [ "--sysconfdir=/etc" ];
});
})
];

environment.systemPackages = [
pkgs.aide
];
environment.etc = {
# Creates /etc/aide.conf
"aide.conf" = {
text = ''
<CONFIG_TEXT>
'';
mode = "0444";
};
};
services.cron = {
enable = true;
systemCronJobs = [
"00 0 * * 0\troot\taide -c /etc/aide.conf --check | /bin/mail -s "aide integrity check run for ${config.networking.hostName}" root@notareal.email"
];
};

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS notifies if baseline configurations are changed with Advanced Intrusion Detection Environment with the following commands:

$ systemctl is-active aide.service

active

If aide is not active and is not configured to alert on file system changes, this is a finding.

Vulnerability Number

V-268153

Documentable

False

Rule Version

ANIX-00-001460

Severity Override Guidance

Verify NixOS notifies if baseline configurations are changed with Advanced Intrusion Detection Environment with the following commands:

$ systemctl is-active aide.service

active

If aide is not active and is not configured to alert on file system changes, this is a finding.

Check Content Reference

M

Target Key

5658