STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must provide audit record generation capability for DOD-defined auditable events for account changes.

DISA Rule

SV-279549r1192397_rule

Vulnerability Number

V-279549

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

NXAC-OS-000043

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS generates full-text recording of privileged commands by running the following commands.

$ sudo grep -iw "postdrop" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -iw "unix_update" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid=nutanix -F auid!=unset -k privileged-unix-update
-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

$ sudo grep -w "postqueue" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w "semanage" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid=nutanix -F auid!=4294967295 -k secobjects
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -w "setfiles" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged-priv_change
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change

$ sudo grep -w "userhelper" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged-passwd
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd

$ sudo grep -w "setsebool" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid=nutanix -F auid!=4294967295 -k secobjects
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -w "unix_chkpwd" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

If any of the audit rule commands does not return a line or the line is commented out, this is a finding.

Vulnerability Number

V-279549

Documentable

False

Rule Version

NXAC-OS-000043

Severity Override Guidance

Verify Nutanix OS generates full-text recording of privileged commands by running the following commands.

$ sudo grep -iw "postdrop" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/postdrop -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -iw "unix_update" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid=nutanix -F auid!=unset -k privileged-unix-update
-a always,exit -F path=/usr/sbin/unix_update -F perm=x -F auid>=1000 -F auid!=unset -k privileged-unix-update

$ sudo grep -w "postqueue" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/postqueue -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w "semanage" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid=nutanix -F auid!=4294967295 -k secobjects
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -w "setfiles" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged-priv_change
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change

$ sudo grep -w "userhelper" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged-passwd
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd

$ sudo grep -w "setsebool" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid=nutanix -F auid!=4294967295 -k secobjects
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -w "unix_chkpwd" /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid=nutanix -F auid!=4294967295 -k privileged
-a always,exit -F path=/usr/sbin/unix_chkpwd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

If any of the audit rule commands does not return a line or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5730