STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must have the fapolicyd.service installed and active.

DISA Rule

SV-279592r1192602_rule

Vulnerability Number

V-279592

Group Title

SRG-OS-000368-GPOS-00154

Rule Version

NXAC-OS-000141

Severity

CAT II

CCI(s)

• CCI-001764 - Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.

Weight

10

Fix Recommendation

1. For AOS, configure fapolicyd.service using the following command.

$ sudo salt-call state.sls security/CVM/fapolicydCVM.sls

2. For Prism Central, configure fapolicyd.service using the following command.

$ sudo salt-call state.sls security/PCVM/fapolicydPCVM.sls

3. For Files, configure fapolicyd.service using the following command.

$ sudo salt-call state.sls security/AFS/fapolicydAFS.sls

4. Configure AHV to restrict the use of SSH using the following command.

$ sudo salt-call state.sls security/KVM/iptables/init

Check Contents

Verify in Nutanix OS that fapolicyd is installed and active using the following command.

$ sudo yum list installed fapolicyd
Installed Packages
fapolicyd.x86_64

$ sudo systemctl status fapolicyd.service
fapolicyd.service - File Access Policy Daemon
Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; vendor preset: disabled)
Active: active (running)

If fapolicyd is not installed and active, this is a finding.

Vulnerability Number

V-279592

Documentable

False

Rule Version

NXAC-OS-000141

Severity Override Guidance

Verify in Nutanix OS that fapolicyd is installed and active using the following command.

$ sudo yum list installed fapolicyd
Installed Packages
fapolicyd.x86_64

$ sudo systemctl status fapolicyd.service
fapolicyd.service - File Access Policy Daemon
Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; vendor preset: disabled)
Active: active (running)

If fapolicyd is not installed and active, this is a finding.

Check Content Reference

M

Target Key

5730