STIGQter STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement DOD-approved encryption to protect the confidentiality of SSH sessions.

DISA Rule

SV-279533r1192035_rule

Vulnerability Number

V-279533

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

NXAC-OS-000009

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the system to run in FIPS mode.

1. For AOS, configure FIPS mode.

$ sudo salt-call state.sls security/CVM/fipsCVM

2. For Prism Central, configure FIPS mode.

$ sudo salt-call state.sls security/PCVM/fipsPCVM

3. For Files, configure FIPS mode.

$ sudo salt-call state.sls security/AFS/fipsAFS

4. For AHV, configure FIPS mode.

$ sudo salt-call state.sls security/KVM/fipsKVM

Check Contents

Verify Nutanix implements DOD-approved encryption to protect the confidentiality of remote access sessions.

1. Verify FIPS mode is enabled using the following command.

$ fips-mode-setup --check
FIPS mode is enabled.

2. If FIPS mode is "enabled", check if the kernel boot parameter is configured for FIPS mode using the following command.

$ grub2-editenv list | grep fips
kernelopts=crashkernel=1G-4G:192M,4G-64G:256M,64G-4096G:512M,4096G-:1G nomodeset biosdevname=0 rhgb quiet intel_iommu=on iommu=pt fips=1 audit=1 split_lock_detect=off audit_backlog_limit=8192 net.ifnames=0 systemd.unified_cgroup_hierarchy=1 boot=/dev/disk/by-label/boot ahv.platform=onprem l1tf=flush,nowarn retbleed=off page_poison=0 slub_debug=- spec_rstack_overflow=microcode

3. If the kernel command line is configured to use FIPS mode, check if the system is in FIPS mode using the following command.

$ sudo cat /proc/sys/crypto/fips_enabled
1

If FIPS mode is not "enabled", the kernel boot parameter is not configured for FIPS mode, or the system does not have a value of "1" for "fips_enabled" in "/proc/sys/crypto", this is a finding.

Vulnerability Number

V-279533

Documentable

False

Rule Version

NXAC-OS-000009

Severity Override Guidance

Verify Nutanix implements DOD-approved encryption to protect the confidentiality of remote access sessions.

1. Verify FIPS mode is enabled using the following command.

$ fips-mode-setup --check
FIPS mode is enabled.

2. If FIPS mode is "enabled", check if the kernel boot parameter is configured for FIPS mode using the following command.

$ grub2-editenv list | grep fips
kernelopts=crashkernel=1G-4G:192M,4G-64G:256M,64G-4096G:512M,4096G-:1G nomodeset biosdevname=0 rhgb quiet intel_iommu=on iommu=pt fips=1 audit=1 split_lock_detect=off audit_backlog_limit=8192 net.ifnames=0 systemd.unified_cgroup_hierarchy=1 boot=/dev/disk/by-label/boot ahv.platform=onprem l1tf=flush,nowarn retbleed=off page_poison=0 slub_debug=- spec_rstack_overflow=microcode

3. If the kernel command line is configured to use FIPS mode, check if the system is in FIPS mode using the following command.

$ sudo cat /proc/sys/crypto/fips_enabled
1

If FIPS mode is not "enabled", the kernel boot parameter is not configured for FIPS mode, or the system does not have a value of "1" for "fips_enabled" in "/proc/sys/crypto", this is a finding.

Check Content Reference

M

Target Key

5730