STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.

DISA Rule

SV-268158r1131121_rule

Vulnerability Number

V-268158

Group Title

SRG-OS-000420-GPOS-00186

Rule Version

ANIX-00-001610

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the NixOS firewall to enforce rate limits using the hashlimit module.

For example, to limit SSH to 1 MB/s and to limit HTTP to 1000 connections / minute per IP, add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

networking.firewall.enable = true;
networking.firewall.extraCommands = ''
ip46tables --append INPUT --protocol tcp --dport 22 --match hashlimit --hashlimit-name stig_byte_limit --hashlimit-mode srcip --hashlimit-above 1000000b/second --jump nixos-fw-refuse
ip46tables --append INPUT --protocol tcp --dport 80 --match hashlimit --hashlimit-name stig_conn_limit --hashlimit-mode srcip --hashlimit-above 1000/minute --jump nixos-fw-refuse
ip46tables --append INPUT --protocol tcp --dport 443 --match hashlimit --hashlimit-name stig_conn_limit --hashlimit-mode srcip --hashlimit-above 1000/minute --jump nixos-fw-refuse
'';

Note: NixOS provides the helper script "ip46tables" to add rules using both "iptables" and "ip6tables".

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS firewall enforces rate limits using the hashlimit module.

$ sudo iptables -L | grep limit

nixos-fw-refuse tcp -- anywhere anywhere tcp dpt:ssh limit: above 1000000b/s mode srcip
nixos-fw-refuse tcp -- anywhere anywhere tcp dpt:http limit: above 1000/min burst 5 mode srcip
nixos-fw-refuse tcp -- anywhere anywhere tcp dpt:https limit: above 1000/min burst 5 mode srcip

If the command does not produce any rate limiting rules, this is a finding.

Vulnerability Number

V-268158

Documentable

False

Rule Version

ANIX-00-001610

Severity Override Guidance

Verify NixOS firewall enforces rate limits using the hashlimit module.

$ sudo iptables -L | grep limit

nixos-fw-refuse tcp -- anywhere anywhere tcp dpt:ssh limit: above 1000000b/s mode srcip
nixos-fw-refuse tcp -- anywhere anywhere tcp dpt:http limit: above 1000/min burst 5 mode srcip
nixos-fw-refuse tcp -- anywhere anywhere tcp dpt:https limit: above 1000/min burst 5 mode srcip

If the command does not produce any rate limiting rules, this is a finding.

Check Content Reference

M

Target Key

5658