STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must prevent using dictionary words for passwords.

DISA Rule

SV-279580r1192309_rule

Vulnerability Number

V-279580

Group Title

SRG-OS-000710-GPOS-00160

Rule Version

NXAC-OS-000127

Severity

CAT II

CCI(s)

• CCI-004061 - For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).

Weight

10

Fix Recommendation

Configure the use of complex passwords for Nutanix OS VMs.

1. For AOS, configure the use of complex passwords using the following command.

$ sudo salt-call state.sls security/CVM/pamCVM.sls

2. For Prism Central, configure the use of complex passwords using the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM.sls

3. For Files, configure the use of complex passwords using the following command.

$ sudo salt-call state.sls security/AFS/pamAFS.sls

4. For Prism Central, configure the use of complex passwords using the following command.

$ ncli cluster edit-hypervisor-security-params enable-high-strength-password=true

Check Contents

Verify Nutanix OS prevents dictionary attacks.

1. For AOS, Prism Central, and Files, verify the "dictcheck" parameter is set to "1", or is commented out using the following command.

$ sudo grep -i dictcheck /etc/security/pwquality.conf
dictcheck = 1

2. For AHV, verify the output contains "pam_pwquality.so" with the option of "required" or "requisite" using the following commands.

$ sudo grep pwquality.so /etc/pam.d/password-auth
password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3 authtok_type=

If Nutanix OS VMs are not configured to prevent dictionary attacks, this is a finding.

Vulnerability Number

V-279580

Documentable

False

Rule Version

NXAC-OS-000127

Severity Override Guidance

Verify Nutanix OS prevents dictionary attacks.

1. For AOS, Prism Central, and Files, verify the "dictcheck" parameter is set to "1", or is commented out using the following command.

$ sudo grep -i dictcheck /etc/security/pwquality.conf
dictcheck = 1

2. For AHV, verify the output contains "pam_pwquality.so" with the option of "required" or "requisite" using the following commands.

$ sudo grep pwquality.so /etc/pam.d/password-auth
password requisite pam_pwquality.so try_first_pass local_users_only enforce_for_root retry=3 authtok_type=

If Nutanix OS VMs are not configured to prevent dictionary attacks, this is a finding.

Check Content Reference

M

Target Key

5730