Anduril NixOS Security Technical Implementation Guide

The Anduril NixOS Security Technical Implementation Guide (V1 R3) has 103 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

103STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Sep 30 2026

NixOS must require the change of at least 50 percent of the total number of characters when passwords are changed.

Anduril NixOS Security Technical Implementation Guide

Assessment Title

Rule Text

NixOS must require the change of at least 50 percent of the total number of characters when passwords are changed.

Description

Discussion Text

Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-268129

Rule

SV-268129r1131063_rule

Severity

medium

Rule Version

ANIX-00-000760

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify NixOS enforces password complexity by requiring that at least 50 percent of the characters are changed with the following command:

$ grep difok /etc/security/pwquality.conf

 difok=8

If the value of "difok" is set to less than "8", or is commented out, this is a finding.

Implementation Procedure

Fix Text

Configure NixOS to enforce password complexity. 

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

environment.etc."/security/pwquality.conf".text = ''
difok=8
'';

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

STIG check 52 of 103 in the Anduril NixOS STIG checklist

← Previous · V-268128NixOS must enforce password complexity by requiring that at least one numeric character be used.Next · V-268130 →NixOS must store only encrypted representations of passwords.