STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must define default permissions for all authenticated users so the user can only read and modify their own files.

DISA Rule

SV-279583r1192449_rule

Vulnerability Number

V-279583

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

NXAC-OS-000130

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

1. For AOS, configure the default permissions "UMASK" to "077" using the following command.

salt-call state.sls security/CVM/shellCVM

2. For Prism Central, configure the default permissions "UMASK" to "077" using the following command.

salt-call state.sls security/PCVM/shellPCVM

3. For Files, configure the default permissions "UMASK" to "077" using the following command.

salt-call state.sls security/AFS/shellAFS

4. For AHV, configure the default permissions "UMASK" to "077" using the following command.

salt-call state.sls security/KVM/shellKVM

Check Contents

Verify Nutanix AOS defines default permissions for all authenticated users in such a way that the user can only read and modify their own files using the following command.

$ sudo grep -i umask /etc/login.defs
UMASK 077

If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing, or commented out, this is a finding.

Vulnerability Number

V-279583

Documentable

False

Rule Version

NXAC-OS-000130

Severity Override Guidance

Verify Nutanix AOS defines default permissions for all authenticated users in such a way that the user can only read and modify their own files using the following command.

$ sudo grep -i umask /etc/login.defs
UMASK 077

If the value for the "UMASK" parameter is not "077", or the "UMASK" parameter is missing, or commented out, this is a finding.

Check Content Reference

M

Target Key

5730