The NixOS audit records must be off-loaded onto a different system or storage media from the system being audited.
An XCCDF Rule
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. NixOS supports "syslog-ng". "syslog-ng" is a common system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. This utility also natively supports TLS to securely encrypt and off-load auditing.
- ID
- SV-268108r1039573_rule
- Version
- ANIX-00-000480
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the operating system to off-load audit records onto a different system or media from the system being audited by specifying a remote destination in the syslog-ng configuration.
Add or update the "services.syslog-ng.extraConfig" configuration in /etc/nixos/configuration.nix to include the following:
source s_local { system(); internal(); };