STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must configure the firewall to control remote access methods.

DISA Rule

SV-279532r1192283_rule

Vulnerability Number

V-279532

Group Title

SRG-OS-000297-GPOS-00115

Rule Version

NXAC-OS-000008

Severity

CAT II

CCI(s)

• CCI-002314 - Employ automated mechanisms to control remote access methods.

Weight

10

Fix Recommendation

Restrict using functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

1. For AOS, run the following command.

$ sudo salt-call state.sls security/CVM/iptables/init

2. For Prism Central, run the following command.

$ sudo salt-call state.sls security/PVCM/iptables/init

3. For Files, run the following command.

$ sudo salt-call state.sls security/AFS/iptables/init

4. For AHV, run the following command.

$ sudo salt-call state.sls security/KVM/iptablesKVM

Check Contents

Verify using remote access methods are prohibited or restricted.

1. Verify IPv4 configuration using the following command.

$ sudo systemctl status iptables.service
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: active (exited) since Thu 2024-10-10 20:05:33 UTC; 1 day 7h ago

2. If IPv6 is in use, use the following command to verify IPv6 configuration.

$ sudo systemctl status ip6tables.service
ip6tables.service - IPv6 firewall with ip6tables
Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; enabled; vendor preset: disabled)
Active: active (exited) since Thu 2024-10-10 20:05:36 UTC; 1 day 7h ago
Main PID: 6641 (code=exited, status=0/SUCCESS)

If there are no iptables services "Loaded" and "Active", this is a finding.

Vulnerability Number

V-279532

Documentable

False

Rule Version

NXAC-OS-000008

Severity Override Guidance

Verify using remote access methods are prohibited or restricted.

1. Verify IPv4 configuration using the following command.

$ sudo systemctl status iptables.service
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: active (exited) since Thu 2024-10-10 20:05:33 UTC; 1 day 7h ago

2. If IPv6 is in use, use the following command to verify IPv6 configuration.

$ sudo systemctl status ip6tables.service
ip6tables.service - IPv6 firewall with ip6tables
Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; enabled; vendor preset: disabled)
Active: active (exited) since Thu 2024-10-10 20:05:36 UTC; 1 day 7h ago
Main PID: 6641 (code=exited, status=0/SUCCESS)

If there are no iptables services "Loaded" and "Active", this is a finding.

Check Content Reference

M

Target Key

5730