STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix VMM must encrypt the boot password for root.

DISA Rule

SV-279542r1192391_rule

Vulnerability Number

V-279542

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

NXAC-OS-000023

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

1. Configure the Nutanix OS VMs to encrypt the boot password for root using the following command.

$ fix_bootloader_pw

2. Follow the prompts to set the password.

Check Contents

Verify the Nutanix OS VMs encrypt the boot password for root using the following command.

$ sudo grep -iw grub2_password /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.D5A1D797EFCF694E49691FED9FC586FB5

$ sudo grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

If the root password entry does not begin with "grub2_password" or "ExecStart" line is configured for anything other than "/usr/lib/systemd/systemd-sulogin-shell rescue", this is a finding.

Vulnerability Number

V-279542

Documentable

False

Rule Version

NXAC-OS-000023

Severity Override Guidance

Verify the Nutanix OS VMs encrypt the boot password for root using the following command.

$ sudo grep -iw grub2_password /boot/grub2/user.cfg
GRUB2_PASSWORD=grub.pbkdf2.sha512.10000.D5A1D797EFCF694E49691FED9FC586FB5

$ sudo grep -i execstart /usr/lib/systemd/system/rescue.service | grep -i sulogin
ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue

If the root password entry does not begin with "grub2_password" or "ExecStart" line is configured for anything other than "/usr/lib/systemd/systemd-sulogin-shell rescue", this is a finding.

Check Content Reference

M

Target Key

5730