STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix AHV must disable the chrony daemon from acting like a server.

DISA Rule

SV-279571r1192432_rule

Vulnerability Number

V-279571

Group Title

SRG-OS-000095-GPOS-00049

Rule Version

NXAC-OS-000102

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Configure the operating system to disable the chrony daemon from acting as a server by adding or modifying the following line in the "/etc/chrony.conf" file:

port 0

Check Contents

For AOS, Prism Central, or Files, this is not a finding.

1. Verify Nutanix AHV disables the chrony daemon from acting as a server using the following command.

$ sudo grep -w 'port' /etc/chrony.conf
port 0

If the "port" option is not set to "0", is commented out, or missing, this is a finding.

2. Verify the OS disables the ability to use the cramfs kernel module. Check if the cramfs kernel module is disabled using the following command.

$ sudo grep -r cramfs /etc/modprobe.d/* | grep "blacklist"
blacklist cramfs

If the command does not return any output or the output is not "blacklist cramfs", and using the cramfs kernel module is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Vulnerability Number

V-279571

Documentable

False

Rule Version

NXAC-OS-000102

Severity Override Guidance

For AOS, Prism Central, or Files, this is not a finding.

1. Verify Nutanix AHV disables the chrony daemon from acting as a server using the following command.

$ sudo grep -w 'port' /etc/chrony.conf
port 0

If the "port" option is not set to "0", is commented out, or missing, this is a finding.

2. Verify the OS disables the ability to use the cramfs kernel module. Check if the cramfs kernel module is disabled using the following command.

$ sudo grep -r cramfs /etc/modprobe.d/* | grep "blacklist"
blacklist cramfs

If the command does not return any output or the output is not "blacklist cramfs", and using the cramfs kernel module is not documented with the information system security officer (ISSO) as an operational requirement, this is a finding.

Check Content Reference

M

Target Key

5730