STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must disable account identifiers (individuals, groups, roles, and devices) after 35 days of inactivity.

DISA Rule

SV-279540r1192387_rule

Vulnerability Number

V-279540

Group Title

SRG-OS-000118-GPOS-00060

Rule Version

NXAC-OS-000017

Severity

CAT II

CCI(s)

• CCI-003627 - Disable accounts when the accounts have expired.

Weight

10

Fix Recommendation

Configure Nutanix OS to use complex password.

1. For AOS, enter the following command.

$ sudo salt-call state.sls security/CVM/pamCVM.sls

2. For Prism Central, enter the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM.sls

3. For Files, enter the following command.

$ sudo salt-call state.sls security/AFS/pamAFS.sls

4. For AHV AOS CVM, enter the following command.

$ ncli cluster edit-hypervisor-security-params enable-high-strength-password=true

Check Contents

Verify Nutanix OS is configured to disable user accounts after the password expires using the following command.

$ sudo grep -i inactive /etc/default/useradd
INACTIVE=0

If the "INACTIVE" value is set to "-1", a value greater than "35", or is commented out, this is a finding.

Vulnerability Number

V-279540

Documentable

False

Rule Version

NXAC-OS-000017

Severity Override Guidance

Verify Nutanix OS is configured to disable user accounts after the password expires using the following command.

$ sudo grep -i inactive /etc/default/useradd
INACTIVE=0

If the "INACTIVE" value is set to "-1", a value greater than "35", or is commented out, this is a finding.

Check Content Reference

M

Target Key

5730