STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement cryptography to protect the integrity and confidentiality of remote access and nonlocal maintenance and diagnostic sessions.

DISA Rule

SV-279538r1192550_rule

Vulnerability Number

V-279538

Group Title

SRG-OS-000250-GPOS-00093

Rule Version

NXAC-OS-000015

Severity

CAT I

CCI(s)

• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

Check Contents

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to have systemwide crypto policies using the following command.

$ sudo grep -i crypto_policy /etc/sysconfig/sshd
# CRYPTO_POLICY=

If "CRYPTO_POLICY" is uncommented, this is a finding.

Vulnerability Number

V-279538

Documentable

False

Rule Version

NXAC-OS-000015

Severity Override Guidance

Note: For AHV, this requirement is Not Applicable.

Verify AOS, Prism Central, and Files OS VMs are configured to have systemwide crypto policies using the following command.

$ sudo grep -i crypto_policy /etc/sysconfig/sshd
# CRYPTO_POLICY=

If "CRYPTO_POLICY" is uncommented, this is a finding.

Check Content Reference

M

Target Key

5730