STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must enable an application firewall.

DISA Rule

SV-279586r1192556_rule

Vulnerability Number

V-279586

Group Title

SRG-OS-000480-GPOS-00232

Rule Version

NXAC-OS-000133

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.
• CCI-001774 - Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.

Weight

10

Fix Recommendation

1. For AOS, configure fapolicyd.service using the following command.

$ sudo salt-call state.sls security/CVM/fapolicydCVM.sls

2. For Prism Central, configure fapolicyd.service using the following command.

$ sudo salt-call state.sls security/PCVM/fapolicydPCVM.sls

3. For Files, configure fapolicyd.service using the following command.

$ sudo salt-call state.sls security/AFS/fapolicydAFS.sls

4. Configure AHV to restrict using SSH using the following command.

$ sudo salt-call state.sls security/KVM/iptables/init

Check Contents

1. Verify AOS, Prism Central, and Files has "fapolicyd" installed and is configured for deny-all, permit by exception policy using the following command.

$ sudo systemctl status fapolicyd.service
fapolicyd.service - File Access Policy Daemon
Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; vendor preset: disabled)
Active: active (running)

$ sudo grep permissive /etc/fapolicyd/fapolicyd.conf
permissive = 0

$sudo tail /etc/fapolicyd/compiled.rules
deny_audit perm=any pattern=ld_so : all
deny_audit perm=any all : ftype=application/x-bad-elf
allow perm=open all : ftype=application/x-sharedlib trust=1
deny perm=any all : all

2. For AHV, verify iptables services are "Loaded" and "Active".

$ sudo service iptables status
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: active (exited) since Mon 2021-08-02 15:02:12 CDT; 2 weeks 6 days ago
Main PID: 1250 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/iptables.service

3. If IPv6 is in use, run the following command.

$ sudo service ip6tables status
ip6tables.service - IPv6 firewall with ip6tables
Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; enabled; vendor preset: disabled)
Active: active (exited) since Mon 2021-08-02 15:02:12 CDT; 2 weeks 6 days ago
Main PID: 1313 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/ip6tables.service

If an application firewall is not configured or is not installed or enabled, this is a finding.

Vulnerability Number

V-279586

Documentable

False

Rule Version

NXAC-OS-000133

Severity Override Guidance

1. Verify AOS, Prism Central, and Files has "fapolicyd" installed and is configured for deny-all, permit by exception policy using the following command.

$ sudo systemctl status fapolicyd.service
fapolicyd.service - File Access Policy Daemon
Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; vendor preset: disabled)
Active: active (running)

$ sudo grep permissive /etc/fapolicyd/fapolicyd.conf
permissive = 0

$sudo tail /etc/fapolicyd/compiled.rules
deny_audit perm=any pattern=ld_so : all
deny_audit perm=any all : ftype=application/x-bad-elf
allow perm=open all : ftype=application/x-sharedlib trust=1
deny perm=any all : all

2. For AHV, verify iptables services are "Loaded" and "Active".

$ sudo service iptables status
iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
Active: active (exited) since Mon 2021-08-02 15:02:12 CDT; 2 weeks 6 days ago
Main PID: 1250 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/iptables.service

3. If IPv6 is in use, run the following command.

$ sudo service ip6tables status
ip6tables.service - IPv6 firewall with ip6tables
Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; enabled; vendor preset: disabled)
Active: active (exited) since Mon 2021-08-02 15:02:12 CDT; 2 weeks 6 days ago
Main PID: 1313 (code=exited, status=0/SUCCESS)
CGroup: /system.slice/ip6tables.service

If an application firewall is not configured or is not installed or enabled, this is a finding.

Check Content Reference

M

Target Key

5730