STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix AHV must not be configured to allow Kerberos authentication.

DISA Rule

SV-279579r1192445_rule

Vulnerability Number

V-279579

Group Title

SRG-OS-000364-GPOS-00151

Rule Version

NXAC-OS-000125

Severity

CAT II

CCI(s)

• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect using the following commands.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect using the following commands.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect using the following commands.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

4. For AHV configure SSH, then restart the SSH for the changes to take effect using the following commands.

$ sudo salt-call state.sls security/KVM/sshdKVM
$ sudo systemctl restart sshd

Check Contents

If this is not AHV OS, this requirement is Not Applicable.

Verify Nutanix AHV enforces access restrictions. Check that the SSH daemon does not permit Kerberos to authenticate passwords using the following command.

$ sudo grep -i kerberosauth /etc/ssh/sshd_config
KerberosAuthentication no

If the "KerberosAuthentication" keyword is missing or is set to "yes" and is not documented with the information system security officer (ISSO), or the returned line is commented out, this is a finding.

Vulnerability Number

V-279579

Documentable

False

Rule Version

NXAC-OS-000125

Severity Override Guidance

If this is not AHV OS, this requirement is Not Applicable.

Verify Nutanix AHV enforces access restrictions. Check that the SSH daemon does not permit Kerberos to authenticate passwords using the following command.

$ sudo grep -i kerberosauth /etc/ssh/sshd_config
KerberosAuthentication no

If the "KerberosAuthentication" keyword is missing or is set to "yes" and is not documented with the information system security officer (ISSO), or the returned line is commented out, this is a finding.

Check Content Reference

M

Target Key

5730