DISA STIGS Viewer

Finding ID	Version	Rule ID	IA Controls	Severity
V-268090	ANIX-00-000160	SV-268090r1039158_rule		Medium

Description

Without establishing what type of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. Audit record content that may be necessary to satisfy this requirement includes, for example, time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. Associating event types with detected events in the operating system audit logs provides a means of investigating an attack; recognizing resource utilization or capacity thresholds; or identifying an improperly configured operating system. Satisfies: SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000054-GPOS-00025, SRG-OS-000055-GPOS-00026, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000255-GPOS-00096, SRG-OS-000303-GPOS-00120, SRG-OS-000327-GPOS-00127

STIG	Date
Anduril NixOS Security Technical Implementation Guide	2024-10-25

Check Text (C-72014r1039156_chk)

Verify that NixOS has the audit service is installed with the following command: $ nix-store --query --requisites /run/current-system | cut -d- -f2- | sort | uniq | grep audit audit-3.1.2 audit-3.1.2-bin audit-3.1.2-man audit-start audit-stop unit-auditd.service unit-audit.service If the "audit" package is not installed, this is a finding.

Fix Text (F-71917r1039157_fix)

Configure NixOS to have the audit service package. Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix: environment.systemPackages = [ audit ]; Rebuild the NixOS configuration with the following command: $ sudo nixos-rebuild switch