STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.

DISA Rule

SV-268176r1131160_rule

Vulnerability Number

V-268176

Group Title

SRG-OS-000125-GPOS-00065

Rule Version

ANIX-00-001960

Severity

CAT I

CCI(s)

• CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Configure NixOS to use strong authentication when establishing nonlocal maintenance and diagnostic sessions.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

openssh.settings.UsePAM = ''yes'';

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS employs strong authentication in the establishment of nonlocal sessions with SSH by the following command:

$ sudo /run/current-system/sw/bin/sshd -G | grep pam

usepam yes

If usepam is not yes, this is a finding.

Vulnerability Number

V-268176

Documentable

False

Rule Version

ANIX-00-001960

Severity Override Guidance

Verify NixOS employs strong authentication in the establishment of nonlocal sessions with SSH by the following command:

$ sudo /run/current-system/sw/bin/sshd -G | grep pam

usepam yes

If usepam is not yes, this is a finding.

Check Content Reference

M

Target Key

5658