STIGQter STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must audit all activities performed during nonlocal maintenance and diagnostic sessions.

DISA Rule

SV-279614r1192501_rule

Vulnerability Number

V-279614

Group Title

SRG-OS-000392-GPOS-00172

Rule Version

NXAC-OS-000172

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. For AOS, configure the audit rules using the following command.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules using the following command.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules using the following command.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules using the following command.

$ sudo salt-call state.sls security/KVM/auditKVM

Check Contents

Verify Nutanix OS audits all required activities performed during nonlocal maintenance and diagnostic sessions using the following commands.

$ sudo grep -i /usr/sbin/semanage /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -i /usr/sbin/setsebool /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -i /usr/bin/chcon /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -iw /usr/sbin/setfiles /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change

$ sudo grep -i /var/run/faillock /etc/audit/audit.rules
-w /var/run/faillock/ -p wa -k logins

$ sudo grep -i /var/log/lastlog /etc/audit/audit.rules
-w /var/log/lastlog -p wa -k logins

If any of the commands listed do not return any output, this is a finding.

Vulnerability Number

V-279614

Documentable

False

Rule Version

NXAC-OS-000172

Severity Override Guidance

Verify Nutanix OS audits all required activities performed during nonlocal maintenance and diagnostic sessions using the following commands.

$ sudo grep -i /usr/sbin/semanage /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -i /usr/sbin/setsebool /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -i /usr/bin/chcon /etc/audit/audit.rules
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=4294967295 -k secobjects

$ sudo grep -iw /usr/sbin/setfiles /etc/audit/audit.rules
-a always,exit -F path=/usr/sbin/setfiles -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged-priv_change

$ sudo grep -i /var/run/faillock /etc/audit/audit.rules
-w /var/run/faillock/ -p wa -k logins

$ sudo grep -i /var/log/lastlog /etc/audit/audit.rules
-w /var/log/lastlog -p wa -k logins

If any of the commands listed do not return any output, this is a finding.

Check Content Reference

M

Target Key

5730