STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must be configured to prohibit or restrict using functions, ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

DISA Rule

SV-279597r1192559_rule

Vulnerability Number

V-279597

Group Title

SRG-OS-000096-GPOS-00050

Rule Version

NXAC-OS-000151

Severity

CAT II

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Restrict using functions, ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.

1. For AOS, run the following command.

$ sudo salt-call state.sls security/CVM/iptables/init

2. For Prism Central, run the following command.

$ sudo salt-call state.sls security/PVCM/iptables/init

3. For Files, run the following command.

$ sudo salt-call state.sls security/AFS/iptables/init

4. For AHV, run the following command.

$ sudo salt-call state.sls security/KVM/iptablesKVM

Check Contents

1. Verify Nutanix OS prohibits or restricts using functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments using the following command.

$ sudo iptables -S

2. If IPv6 is in use, run the following command.

$ sudo ip6tables -S

3. Review the site or program PPSM CAL; Verify the services allowed by the firewall match the PPSM Component Local Service Assessment (CLSA).

If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM CAL, this is a finding.

Vulnerability Number

V-279597

Documentable

False

Rule Version

NXAC-OS-000151

Severity Override Guidance

1. Verify Nutanix OS prohibits or restricts using functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments using the following command.

$ sudo iptables -S

2. If IPv6 is in use, run the following command.

$ sudo ip6tables -S

3. Review the site or program PPSM CAL; Verify the services allowed by the firewall match the PPSM Component Local Service Assessment (CLSA).

If there are additional ports, protocols, or services that are not in the PPSM CLSA, or there are ports, protocols, or services that are prohibited by the PPSM CAL, this is a finding.

Check Content Reference

M

Target Key

5730