STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement cryptography to protect the integrity of remote access sessions by using only HMACs employing FIPS 140-3-approved algorithms.

DISA Rule

SV-279534r1192285_rule

Vulnerability Number

V-279534

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

NXAC-OS-000010

Severity

CAT I

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
• CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

4. For AHV, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/KVM/sshdKVM
$ sudo systemctl restart sshd

Check Contents

Verify Nutanix OS is configured to use approved ciphers.

1. Configure AOS, Prism Central, and Files OS VMs to use only HMACs employing FIPS 140-3-approved algorithms for remote access using the following command.

$ sudo grep -i macs /etc/crypto-policies/back-ends/opensshserver.config
MACS=hmac-sha2-512,hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

2. Verify AHV "Ciphers" configuration using the following command.

$ sudo grep -i ciphers /etc/ssh/sshd_config
Ciphers aes256-ctr

If unapproved ciphers are listed, the "Ciphers" keyword is missing, or the returned line is commented out, this is a finding.

Vulnerability Number

V-279534

Documentable

False

Rule Version

NXAC-OS-000010

Severity Override Guidance

Verify Nutanix OS is configured to use approved ciphers.

1. Configure AOS, Prism Central, and Files OS VMs to use only HMACs employing FIPS 140-3-approved algorithms for remote access using the following command.

$ sudo grep -i macs /etc/crypto-policies/back-ends/opensshserver.config
MACS=hmac-sha2-512,hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

2. Verify AHV "Ciphers" configuration using the following command.

$ sudo grep -i ciphers /etc/ssh/sshd_config
Ciphers aes256-ctr

If unapproved ciphers are listed, the "Ciphers" keyword is missing, or the returned line is commented out, this is a finding.

Check Content Reference

M

Target Key

5730