Check: ANIX-00-001790
Anduril NixOS STIG:
ANIX-00-001790
(in version v1 r1)
Title
NixOS must generate audit records when concurrent logins to the same account occur from different sources. (Cat II impact)
Discussion
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). Satisfies: SRG-OS-000473-GPOS-00218, SRG-OS-000042-GPOS-00020, SRG-OS-000475-GPOS-00220
Check Content
Verify NixOS is configured to generate audit records with the following command: $ sudo auditctl -l | grep -w lastlog -w /var/log/lastlog -p wa -k logins If the command does not return a watch for the lastlog file, this is a finding.
Fix Text
Modify NixOS to generate audit logs on account creations and modifications. Edit /etc/nixos/configuration.nix and ensure the following options are configured: security.audit.rules = [ "-w /var/log/lastlog -p wa -k logins" ]; Rebuild the system with the following command: $ sudo nixos-rebuild switch
Additional Identifiers
Rule ID: SV-268166r1039580_rule
Vulnerability ID: V-268166
Group Title: SRG-OS-000473-GPOS-00218
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000135 |
Generate audit records containing the organization-defined additional information that is to be included in the audit records. |
| CCI-000172 |
Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3. |