STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must generate audit records for all account creations, modifications, disabling, and termination events.

DISA Rule

SV-268167r1131139_rule

Vulnerability Number

V-268167

Group Title

SRG-OS-000476-GPOS-00221

Rule Version

ANIX-00-001820

Severity

CAT II

CCI(s)

• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.
• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

Configure NixOS to generate audit logs on account creations and modifications.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.audit.rules = [
"-w /etc/sudoers -p wa -k identity"
"-w /etc/passwd -p wa -k identity"
"-w /etc/shadow -p wa -k identity"
"-w /etc/gshadow -p wa -k identity"
"-w /etc/group -p wa -k identity"
"-w /etc/security/opasswd -p wa -k identity"
];

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS is configured to generate audit records on account events with the following command:

$ sudo auditctl -l | grep /etc

-w /etc/sudoers -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

If the output from the command does not include the example output, this is a finding.

Vulnerability Number

V-268167

Documentable

False

Rule Version

ANIX-00-001820

Severity Override Guidance

Verify NixOS is configured to generate audit records on account events with the following command:

$ sudo auditctl -l | grep /etc

-w /etc/sudoers -p wa -k identity
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/security/opasswd -p wa -k identity

If the output from the command does not include the example output, this is a finding.

Check Content Reference

M

Target Key

5658