STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.

DISA Rule

SV-268177r1131162_rule

Vulnerability Number

V-268177

Group Title

SRG-OS-000375-GPOS-00160

Rule Version

ANIX-00-002010

Severity

CAT II

CCI(s)

• CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
• CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.

Weight

10

Fix Recommendation

Configure NixOS to use strong authentication when establishing nonlocal maintenance and diagnostic sessions.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

security.pam.p11.enable = true;

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify NixOS provides authentication via the security and pam modules with the following command:

$ cat /etc/nixos/configuration.nix | grep -A 1 security.pam.p11

security.pam.p11.enable = true;

If security.pam.p11.enable is not. "true", is not present or is commented out, this is a finding.

Vulnerability Number

V-268177

Documentable

False

Rule Version

ANIX-00-002010

Severity Override Guidance

Verify NixOS provides authentication via the security and pam modules with the following command:

$ cat /etc/nixos/configuration.nix | grep -A 1 security.pam.p11

security.pam.p11.enable = true;

If security.pam.p11.enable is not. "true", is not present or is commented out, this is a finding.

Check Content Reference

M

Target Key

5658