STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must employ approved cryptographic hashing algorithms for all stored passwords.

DISA Rule

SV-268175r1131158_rule

Vulnerability Number

V-268175

Group Title

SRG-OS-000120-GPOS-00061

Rule Version

ANIX-00-001940

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Lock all interactive user accounts not using SHA-512 hashing until the passwords can be regenerated with SHA-512.

$ sudo usermod -L $USERNAME

Check Contents

Verify NixOS uses employs approved cryptographic hashing algorithms for all stored passwords with the following command:

(Change <unique-username> to the desired user to verify.)

$ sudo cat /etc/shadow | grep "<unique-username>" | cut -d'$' -f2

If the command does not return 6 for SHA512, this is a finding.

Vulnerability Number

V-268175

Documentable

False

Rule Version

ANIX-00-001940

Severity Override Guidance

Verify NixOS uses employs approved cryptographic hashing algorithms for all stored passwords with the following command:

(Change <unique-username> to the desired user to verify.)

$ sudo cat /etc/shadow | grep "<unique-username>" | cut -d'$' -f2

If the command does not return 6 for SHA512, this is a finding.

Check Content Reference

M

Target Key

5658