STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must audit all account change actions.

DISA Rule

SV-279541r1192389_rule

Vulnerability Number

V-279541

Group Title

SRG-OS-000004-GPOS-00004

Rule Version

NXAC-OS-000018

Severity

CAT II

CCI(s)

• CCI-000018 - Automatically audit account creation actions.
• CCI-001403 - Automatically audit account modification actions.
• CCI-001404 - Automatically audit account disabling actions.
• CCI-001405 - Automatically audit account removal actions.
• CCI-002130 - Automatically audit account enabling actions.
• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

Configure Nutanix OS to audit all account change actions.

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify the OS is configured to audit all account change actions.

Run the following command to verify account creation and modification is audited:

$ sudo auditctl -l | grep "audit_account_changes"

If the command does not return the following output, this is a finding.

-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

Vulnerability Number

V-279541

Documentable

False

Rule Version

NXAC-OS-000018

Severity Override Guidance

Verify the OS is configured to audit all account change actions.

Run the following command to verify account creation and modification is audited:

$ sudo auditctl -l | grep "audit_account_changes"

If the command does not return the following output, this is a finding.

-w /etc/group -p wa -k audit_account_changes
-w /etc/passwd -p wa -k audit_account_changes
-w /etc/gshadow -p wa -k audit_account_changes
-w /etc/shadow -p wa -k audit_account_changes
-w /etc/security/opasswd -p wa -k audit_account_changes

Check Content Reference

M

Target Key

5730