STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must provide audit record generation capability for all account actions.

DISA Rule

SV-279555r1192409_rule

Vulnerability Number

V-279555

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

NXAC-OS-000049

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.

Weight

10

Fix Recommendation

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS auditing is configured to generate audit records for all account creations, modifications, disabling, and terminations using the following commands.

$ sudo grep /etc/shadow /etc/audit/audit.rules
-w /etc/shadow -p wa -k audit_account_changes

$ sudo grep /etc/security/opasswd /etc/audit/audit.rules
-w /etc/security/opasswd -p wa -k audit_account_changes

$ sudo grep /etc/passwd /etc/audit/audit.rules
-w /etc/passwd -p wa -k audit_account_changes

$ sudo grep /etc/gshadow /etc/audit/audit.rules
-w /etc/gshadow -p wa -k audit_account_changes

$ sudo grep /etc/group /etc/audit/audit.rules
-w /etc/group -p wa -k audit_account_changes

$ sudo grep /etc/sudoers /etc/audit/audit.rules
-w /etc/sudoers -p wa -k actions

$ sudo grep /etc/sudoers.d/ /etc/audit/audit.rules
-w /etc/sudoers.d/ -p wa -k actions

$ sudo grep -w /usr/bin/su /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w sudo /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w gpasswd /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w passwd /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd

$ sudo grep -w chage /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w newgrp /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

If the commands do not return the appropriate response line, as indicated above, or if the lines are commented out, this is a finding.

Vulnerability Number

V-279555

Documentable

False

Rule Version

NXAC-OS-000049

Severity Override Guidance

Verify Nutanix OS auditing is configured to generate audit records for all account creations, modifications, disabling, and terminations using the following commands.

$ sudo grep /etc/shadow /etc/audit/audit.rules
-w /etc/shadow -p wa -k audit_account_changes

$ sudo grep /etc/security/opasswd /etc/audit/audit.rules
-w /etc/security/opasswd -p wa -k audit_account_changes

$ sudo grep /etc/passwd /etc/audit/audit.rules
-w /etc/passwd -p wa -k audit_account_changes

$ sudo grep /etc/gshadow /etc/audit/audit.rules
-w /etc/gshadow -p wa -k audit_account_changes

$ sudo grep /etc/group /etc/audit/audit.rules
-w /etc/group -p wa -k audit_account_changes

$ sudo grep /etc/sudoers /etc/audit/audit.rules
-w /etc/sudoers -p wa -k actions

$ sudo grep /etc/sudoers.d/ /etc/audit/audit.rules
-w /etc/sudoers.d/ -p wa -k actions

$ sudo grep -w /usr/bin/su /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/su -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w sudo /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w gpasswd /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w passwd /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-passwd

$ sudo grep -w chage /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

$ sudo grep -w newgrp /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

If the commands do not return the appropriate response line, as indicated above, or if the lines are commented out, this is a finding.

Check Content Reference

M

Target Key

5730