STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must provide audit record generation capability for DOD-defined auditable events for all kernel module load, unload, and restart actions.

DISA Rule

SV-279556r1192411_rule

Vulnerability Number

V-279556

Group Title

SRG-OS-000062-GPOS-00031

Rule Version

NXAC-OS-000050

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

10

Fix Recommendation

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS is configured to generate audit records on all kernel module load, unload, and restart actions using the following command.

$ sudo grep "/usr/bin/kmod" /etc/audit/audit.rules
-w /usr/bin/kmod -p x -F auid!=unset -k module-change

$ sudo cat /boot/grub/grub.conf | grep audit
kernel /boot/vmlinuz-3.10.0-1160.24.1.el7.nutanix.20210425.cvm.x86_64 ro root=UUID=71a1fe8c-812f-4403-80ed-894f554b061c rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 rhgb crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us audit=1 audit_backlog_limit=8192 nousb fips=1 nomodeset biosdevname=0 net.ifnames=0 scsi_mod.use_blk_mq=y panic=30 console=ttyS0,115200n8 console=tty0 clocksource=tsc kvm_nopvspin=1 xen_nopvspin=1 hv_netvsc.ring_size=512 mds=off mitigations=off

If the commands do not return the appropriate response line, as indicated above, or if the lines are commented out, this is a finding.

Vulnerability Number

V-279556

Documentable

False

Rule Version

NXAC-OS-000050

Severity Override Guidance

Verify Nutanix OS is configured to generate audit records on all kernel module load, unload, and restart actions using the following command.

$ sudo grep "/usr/bin/kmod" /etc/audit/audit.rules
-w /usr/bin/kmod -p x -F auid!=unset -k module-change

$ sudo cat /boot/grub/grub.conf | grep audit
kernel /boot/vmlinuz-3.10.0-1160.24.1.el7.nutanix.20210425.cvm.x86_64 ro root=UUID=71a1fe8c-812f-4403-80ed-894f554b061c rd_NO_LUKS rd_NO_LVM rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 rhgb crashkernel=auto KEYBOARDTYPE=pc KEYTABLE=us audit=1 audit_backlog_limit=8192 nousb fips=1 nomodeset biosdevname=0 net.ifnames=0 scsi_mod.use_blk_mq=y panic=30 console=ttyS0,115200n8 console=tty0 clocksource=tsc kvm_nopvspin=1 xen_nopvspin=1 hv_netvsc.ring_size=512 mds=off mitigations=off

If the commands do not return the appropriate response line, as indicated above, or if the lines are commented out, this is a finding.

Check Content Reference

M

Target Key

5730