STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement cryptography to protect the integrity of remote access session by setting the systemwide policy to use FIPS mode.

DISA Rule

SV-279535r1192593_rule

Vulnerability Number

V-279535

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

NXAC-OS-000012

Severity

CAT I

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

4. For AHV, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/KVM/sshdKVM
$ sudo systemctl restart sshd

Check Contents

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to only use ciphers employing FIPS 140-3-approved algorithms.

1. Verify the "opensslcnf.config" is defined in the "/etc/pki/tls/openssl.cnf" file.

sudo grep -i opensslcnf.config /etc/pki/tls/openssl.cnf
.include /etc/crypto-policies/back-ends/opensslcnf.config

2. Verify the systemwide crypto policy is set to "FIPS".

$ sudo update-crypto-policies --show
FIPS

If the systemwide crypto policy is not set to "FIPS" or the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf", this is a finding.

Vulnerability Number

V-279535

Documentable

False

Rule Version

NXAC-OS-000012

Severity Override Guidance

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to only use ciphers employing FIPS 140-3-approved algorithms.

1. Verify the "opensslcnf.config" is defined in the "/etc/pki/tls/openssl.cnf" file.

sudo grep -i opensslcnf.config /etc/pki/tls/openssl.cnf
.include /etc/crypto-policies/back-ends/opensslcnf.config

2. Verify the systemwide crypto policy is set to "FIPS".

$ sudo update-crypto-policies --show
FIPS

If the systemwide crypto policy is not set to "FIPS" or the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf", this is a finding.

Check Content Reference

M

Target Key

5730