STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must set the value of "lock-after-time" to 890 seconds for remote access sessions.

DISA Rule

SV-279529r1192546_rule

Vulnerability Number

V-279529

Group Title

SRG-OS-000029-GPOS-00010

Rule Version

NXAC-OS-000003

Severity

CAT II

CCI(s)

• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.
• CCI-000060 - Conceal, via the device lock, information previously visible on the display with a publicly viewable image.
• CCI-000056 - Retain the device lock until the user reestablishes access using established identification and authentication procedures.

Weight

10

Fix Recommendation

1. For AOS, Prism Central, and Files, log in as Admin and run the following command to set the Nutanix TMUX and configure options for the Admin account of last resort.

$ configure_dod_mode.sh enter_dod_mode

2. For AHV, this is set by default in the OS. The value of "lock-after-time" is set to "890" by the vendor and must not be altered by customers. If the value is not set to the default, this is an unauthorized modification which may indicate the security settings for the build has been modified. Rebuild the system from source to correct this issue.

Check Contents

Verify Nutanix TMUX shell is enabled, which sets the user session lock for the Admin account of last resort.

1. For AOS, Prism Central, and Files, log in to the CVM as the Admin user.

2. For AHV, verify the value of "locl-after-time" is set to "890" using the following command.

$ sudo grep -i "lock-after-time" /etc/tmux.conf
set -g lock-after-time 890

If the Nutanix TMUX shell is not enabled or if "lock-after-time" is not configured, this is a finding.

Vulnerability Number

V-279529

Documentable

False

Rule Version

NXAC-OS-000003

Severity Override Guidance

Verify Nutanix TMUX shell is enabled, which sets the user session lock for the Admin account of last resort.

1. For AOS, Prism Central, and Files, log in to the CVM as the Admin user.

2. For AHV, verify the value of "locl-after-time" is set to "890" using the following command.

$ sudo grep -i "lock-after-time" /etc/tmux.conf
set -g lock-after-time 890

If the Nutanix TMUX shell is not enabled or if "lock-after-time" is not configured, this is a finding.

Check Content Reference

M

Target Key

5730