STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must generate audit records when concurrent logons to the same account occur from different sources.

DISA Rule

SV-268166r1131137_rule

Vulnerability Number

V-268166

Group Title

SRG-OS-000473-GPOS-00218

Rule Version

ANIX-00-001790

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

Configure NixOS to generate audit logs on account creations and modifications.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.audit.rules = [
"-w /var/log/lastlog -p wa -k logins"
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS is configured to generate audit records with the following command:

$ sudo auditctl -l | grep -w lastlog

-w /var/log/lastlog -p wa -k logins

If the command does not return a watch for the lastlog file, this is a finding.

Vulnerability Number

V-268166

Documentable

False

Rule Version

ANIX-00-001790

Severity Override Guidance

Verify NixOS is configured to generate audit records with the following command:

$ sudo auditctl -l | grep -w lastlog

-w /var/log/lastlog -p wa -k logins

If the command does not return a watch for the lastlog file, this is a finding.

Check Content Reference

M

Target Key

5658