STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must store only encrypted representations of passwords.

DISA Rule

SV-279604r1192604_rule

Vulnerability Number

V-279604

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

NXAC-OS-000161

Severity

CAT I

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

10

Fix Recommendation

Configure Nutanix OS to use complex password using the following command.

1. For AOS, enter the following command.

$ sudo salt-call state.sls security/CVM/pamCVM.sls

2. For Prism Central, enter the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM.sls

3. For Files, enter the following command.

$ sudo salt-call state.sls security/AFS/pamAFS.sls

Check Contents

1. Verify Nutanix OS is configured to store encrypted representation of passwords and that the encryption meets required standards using the following command.

$ sudo grep -i encrypt /etc/login.defs
ENCRYPT_METHOD SHA512

If the /etc/login.defs file does not contain the required output, this is a finding.

2. Confirm that the interactive user account passwords are using a strong password hash using the following command.

$ sudo cut -d: -f2 /etc/shadow

$6$hMKOdbToveIPcp$ybbhyd/bY/.nbce5H1Qc8Ji7ECmTZvs50ASDFHSY9XEW/TkK7Xer5xUYp7AHYzrk815rkJecsCDIMIgYXBQ9C/

Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated. If any interactive user passwords do not begin with "$6$", this is a finding.

3. Check that a minimum number of hash rounds is configured using the following command.

$ sudo grep -iE "^SHA_CRYPT_" /etc/login.defs
SHA_CRYPT_MAX_ROUNDS 5000

If the value of "SHA_CRYPT_MAX_ROUNDS" is not set to 5000 or more, this is a finding.

Vulnerability Number

V-279604

Documentable

False

Rule Version

NXAC-OS-000161

Severity Override Guidance

1. Verify Nutanix OS is configured to store encrypted representation of passwords and that the encryption meets required standards using the following command.

$ sudo grep -i encrypt /etc/login.defs
ENCRYPT_METHOD SHA512

If the /etc/login.defs file does not contain the required output, this is a finding.

2. Confirm that the interactive user account passwords are using a strong password hash using the following command.

$ sudo cut -d: -f2 /etc/shadow

$6$hMKOdbToveIPcp$ybbhyd/bY/.nbce5H1Qc8Ji7ECmTZvs50ASDFHSY9XEW/TkK7Xer5xUYp7AHYzrk815rkJecsCDIMIgYXBQ9C/

Password hashes "!" or "*" indicate inactive accounts not available for logon and are not evaluated. If any interactive user passwords do not begin with "$6$", this is a finding.

3. Check that a minimum number of hash rounds is configured using the following command.

$ sudo grep -iE "^SHA_CRYPT_" /etc/login.defs
SHA_CRYPT_MAX_ROUNDS 5000

If the value of "SHA_CRYPT_MAX_ROUNDS" is not set to 5000 or more, this is a finding.

Check Content Reference

M

Target Key

5730