STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must require the change of at least 50 percent of the total number of characters when passwords are changed.

DISA Rule

SV-279608r1192322_rule

Vulnerability Number

V-279608

Group Title

SRG-OS-000072-GPOS-00040

Rule Version

NXAC-OS-000165

Severity

CAT II

CCI(s)

• CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.

Weight

10

Fix Recommendation

Configure Nutanix OS to use complex password by running the following command.

1. For AOS, enter the following command.

$ sudo salt-call state.sls security/CVM/pamCVM.sls

2. For Prism Central, enter the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM.sls

3. For Files, enter the following command.

$ sudo salt-call state.sls security/AFS/pamAFS.sls

4. For AHV OS CVM, enter the following command.

$ ncli cluster edit-hypervisor-security-params enable-high-strength-password=true

Check Contents

1. Verify Nutanix AOS is configured to require complex passwords using the following command. Note: The values to require for complex passwords is located in "/etc/security/pwquality.conf".

$ sudo grep difok /etc/security/pwquality.conf
difok = 8

If the value of "difok" is set to less than "8", this is a finding.

2. Verify Nutanix AOS is configured to require complex passwords using the following command.

$ sudo grep minclass /etc/security/pwquality.conf
minclass = 4

If the value of "minclass" is set to less than "4", this is a finding.

3. Verify Nutanix AOS is configured to require complex passwords using the following command.

$ sudo grep maxrepeat /etc/security/pwquality.conf
maxrepeat = 2

If the value of "maxrepeat" is set to more than "2", this is a finding.

4. Verify Nutanix AOS is configured to require complex passwords using the following command.

$ sudo grep maxclassrepeat /etc/security/pwquality.conf
maxclassrepeat = 4

If the value of "maxclassrepeat" is set to more than "4", this is a finding.

Vulnerability Number

V-279608

Documentable

False

Rule Version

NXAC-OS-000165

Severity Override Guidance

1. Verify Nutanix AOS is configured to require complex passwords using the following command. Note: The values to require for complex passwords is located in "/etc/security/pwquality.conf".

$ sudo grep difok /etc/security/pwquality.conf
difok = 8

If the value of "difok" is set to less than "8", this is a finding.

2. Verify Nutanix AOS is configured to require complex passwords using the following command.

$ sudo grep minclass /etc/security/pwquality.conf
minclass = 4

If the value of "minclass" is set to less than "4", this is a finding.

3. Verify Nutanix AOS is configured to require complex passwords using the following command.

$ sudo grep maxrepeat /etc/security/pwquality.conf
maxrepeat = 2

If the value of "maxrepeat" is set to more than "2", this is a finding.

4. Verify Nutanix AOS is configured to require complex passwords using the following command.

$ sudo grep maxclassrepeat /etc/security/pwquality.conf
maxclassrepeat = 4

If the value of "maxclassrepeat" is set to more than "4", this is a finding.

Check Content Reference

M

Target Key

5730