STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement TLS to protect the integrity and confidentiality of remote access and nonlocal maintenance and diagnostic sessions.

DISA Rule

SV-279536r1192381_rule

Vulnerability Number

V-279536

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

NXAC-OS-000013

Severity

CAT I

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

Check Contents

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to only use DOD-approved TLS encryption using the following command.

$ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config
TLS.MinProtocol = TLSv1.2
DTLS.MinProtocol = DTLSv1.2

If the "TLS.MinProtocol" is not set to "TLVSv1.2" (or later) or the "DTLS.Min.Protocol" is not set to "DTLSv1.2", this is a finding.

Vulnerability Number

V-279536

Documentable

False

Rule Version

NXAC-OS-000013

Severity Override Guidance

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to only use DOD-approved TLS encryption using the following command.

$ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config
TLS.MinProtocol = TLSv1.2
DTLS.MinProtocol = DTLSv1.2

If the "TLS.MinProtocol" is not set to "TLVSv1.2" (or later) or the "DTLS.Min.Protocol" is not set to "DTLSv1.2", this is a finding.

Check Content Reference

M

Target Key

5730