OpenControls Logo

STIG Viewer

STIGViewer Support

NixOS must have the packages required for offloading audit logs installed and running.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-268107ANIX-00-000460SV-268107r1131017_ruleCCI-000154medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. NixOS supports "systemd-journald", which is a common system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. This utility also natively supports TLS to securely encrypt and off-load auditing. Satisfies: SRG-OS-000051-GPOS-00024, SRG-OS-000269-GPOS-00103
STIGDate
Anduril NixOS Security Technical Implementation Guide2025-08-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-02.2Central Review & Analysis
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (43) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+33 more (top 10 by confidence shown)

CCI1 mapping
CCI-000154
1.00

Details

Check Text (C-268107r1131017_chk)

Verify that the systemd-journald service is running with the following command: $ systemctl status systemd-journald.service systemd-journald.service - Journal Service Loaded: loaded (/etc/systemd/system/systemd-journald.service; enabled; preset: ignored) Drop-In: /nix/store/z8klzmxqgpmn8ganwrsqizy3qdxnirr8-system-units/systemd-journald.service.d +-overrides.conf Active: active (running) since Mon 2025-03-10 10:41:08 PDT; 1 day 2h ago If the systemd-journald.service is not "active" and "running", this is a finding.

Fix Text (F-71934r1131016_fix)

Configure the operating system to off-load audit logs. Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix: services.journald.audit = true; Rebuild and switch to the new NixOS configuration: $ sudo nixos-rebuild switch