STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

DISA Rule

SV-279577r1192601_rule

Vulnerability Number

V-279577

Group Title

SRG-OS-000366-GPOS-00153

Rule Version

NXAC-OS-000121

Severity

CAT I

CCI(s)

• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

Configure Yum settings to remove all software components after an updated version is installed.

1. Configure AOS Yum settings using the following command.

$ sudo salt-call state.sls security/CVM/yumCVM

2. Configure Prism Central Yum settings using the following command.

$ sudo salt-call state.sls security/PCVM/yumPCVM

3. Configure Files Yum settings using the following command.

$ sudo salt-call state.sls security/AFS/yumAFS

4. Configure AHV Yum settings using the following command.

$ sudo salt-call state.sls security/KVM/yumKVM

Check Contents

Nutanix OS is a vendor-supported appliance; no connection to any upstream repos is configured or allowed. All patches, service packs, device drivers, and operating system components are solely provided by the vendor. The vendor ensures that all installation packages are properly signed prior to distribution to customer(s).

Verify Nutanix AOS is configured to require "gpgcheck" and "localpkg_gpgcheck" for all installation packages provided by the vendor using the following commands:

$ sudo grep gpgcheck /etc/yum.conf
gpgcheck=1

$ sudo grep localpkg_gpgcheck /etc/yum.conf
localpkg_gpgcheck=1

$ sudo grep repo_gpgcheck /etc/yum.conf
repo_gpgcheck=1

If any output is not set to "1", this is a finding.

Vulnerability Number

V-279577

Documentable

False

Rule Version

NXAC-OS-000121

Severity Override Guidance

Nutanix OS is a vendor-supported appliance; no connection to any upstream repos is configured or allowed. All patches, service packs, device drivers, and operating system components are solely provided by the vendor. The vendor ensures that all installation packages are properly signed prior to distribution to customer(s).

Verify Nutanix AOS is configured to require "gpgcheck" and "localpkg_gpgcheck" for all installation packages provided by the vendor using the following commands:

$ sudo grep gpgcheck /etc/yum.conf
gpgcheck=1

$ sudo grep localpkg_gpgcheck /etc/yum.conf
localpkg_gpgcheck=1

$ sudo grep repo_gpgcheck /etc/yum.conf
repo_gpgcheck=1

If any output is not set to "1", this is a finding.

Check Content Reference

M

Target Key

5730