STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must generate audit records when successful/unsuccessful attempts to access security objects occur.

DISA Rule

SV-279554r1192407_rule

Vulnerability Number

V-279554

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

NXAC-OS-000048

Severity

CAT II

CCI(s)

CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

Fix Recommendation

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS auditing is configured to generate audit records for all successful and unsuccessful system changes using the following commands.

$ sudo grep -iw truncate /etc/audit/audit.rules
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S truncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S truncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw openat /etc/audit/audit.rules
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S openat-F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S openat -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S openat -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw open /etc/audit/audit.rules
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S open-F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S open -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S open -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw open_by_handle_at /etc/audit/audit.rules
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S open_by_handle_at-F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S open_by_handle_at -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw ftruncate /etc/audit/audit.rules
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S ftruncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S ftruncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

If the commands do not return the appropriate response line, as indicated above, or if the lines are commented out, this is a finding.

Nutanix OS must generate audit records when successful/unsuccessful attempts to access security objects occur.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key