STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must configure pam_uni.so module to use SHA-512 for authentication to a cryptographic module.

DISA Rule

SV-279613r1192499_rule

Vulnerability Number

V-279613

Group Title

SRG-OS-000120-GPOS-00061

Rule Version

NXAC-OS-000170

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

1. For AOS, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/CVM/pamCVM

2. For Prism Central, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM

3. For Files, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/AFS/pamAFS

4. Configure AHV to disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/KVM/pamKVM

Check Contents

Verify pam_uni.so module is configured to use SHA-512 using the following command.

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

If "sha512" is missing or commented out, this is a finding.

Vulnerability Number

V-279613

Documentable

False

Rule Version

NXAC-OS-000170

Severity Override Guidance

Verify pam_uni.so module is configured to use SHA-512 using the following command.

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

If "sha512" is missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5730