OpenControls Logo

STIG Viewer

STIGViewer Support

The NixOS audit records must be off-loaded onto a different system or storage media from the system being audited.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-268108ANIX-00-000480SV-268108r1131020_ruleCCI-000154medium
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. NixOS supports "systemd-journald", which is a common system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. This utility also natively supports TLS to securely encrypt and off-load auditing.
STIGDate
Anduril NixOS Security Technical Implementation Guide2025-08-19

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MON-02.2Central Review & Analysis
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (43) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+33 more (top 10 by confidence shown)

CCI1 mapping
CCI-000154
1.00

Details

Check Text (C-268108r1131020_chk)

Verify the audit system off-loads audit records onto a different system or media from the system being audited. List the configured destinations with the following command: $ grep -i "Url" /etc/systemd/journal-upload.conf" If no URL is configured, this is a finding.

Fix Text (F-71935r1131019_fix)

Configure the operating system to off-load audit records onto a different system or media from the system being audited by specifying a remote destination in the systemd-journald configuration. On the client, modify /etc/nixos/configuration.nix or /etc/nixos/flake.nix to include the following lines: services.journald.upload = { enable = true; Upload = { ServerKeyFile = $PATH_TO_CLIENT_PEM_SSL_KEY; URL = $URL_OF_REMOTE_SERVER; ServerCertificateFile = $PATH_TO_SSL_CERT; TrustedCertificateFile = $PATH_TO_SERVER_CERT; }; }; } On the server, modify /etc/nixos/configuration.nix or /etc/nixos/flake.nix to include the following lines: services.journald.remote = { enable = true; listen = "https"; URL = $URL_OF_REMOTE_SERVER; ServerKeyFile = $PATH_TO_SERVER_PEM_SSL_KEY; ServerCertificateFile = $PATH_TO_SSL_CERT; }; };