STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement cryptography to protect the integrity of remote access sessions.

DISA Rule

SV-279537r1192383_rule

Vulnerability Number

V-279537

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

NXAC-OS-000014

Severity

CAT I

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

Check Contents

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to use only FIPS-validated key exchange algorithms using the following command.

$ sudo grep -i kexalgorithms /etc/crypto-policies/back-ends/opensshserver.config
CRYPTO_POLICY='-oKexAlgorithms=ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512'

If the entries following "KexAlgorithms" are not "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512", appear in a different order than shown, or are missing or commented out, this is a finding.

Vulnerability Number

V-279537

Documentable

False

Rule Version

NXAC-OS-000014

Severity Override Guidance

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to use only FIPS-validated key exchange algorithms using the following command.

$ sudo grep -i kexalgorithms /etc/crypto-policies/back-ends/opensshserver.config
CRYPTO_POLICY='-oKexAlgorithms=ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512'

If the entries following "KexAlgorithms" are not "ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512", appear in a different order than shown, or are missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5730