STIGQter STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions.

DISA Rule

SV-279619r1192185_rule

Vulnerability Number

V-279619

Group Title

SRG-OS-000393-GPOS-00173

Rule Version

NXAC-OS-000176

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure the system to run in FIPS mode.

1. For AOS, configure FIPS mode using the following command.

$ sudo salt-call state.sls security/CVM/fipsCVM

2. For Prism Central, configure FIPS mode using the following command.

$ sudo salt-call state.sls security/PCVM/fipsPCVM

3. For Files, configure FIPS mode using the following command.

$ sudo salt-call state.sls security/AFS/fipsAFS

4. For AHV, configure FIPS mode using the following command.

$ sudo salt-call state.sls security/KVM/fipsKVM

Check Contents

Confirm that the Nutanix OS OpenSSL library is configured to only use DOD-approved TLS encryption using the following command.

$ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config
TLS.MinProtocol = TLSv1.2
DTLS.MinProtocol = DTLSv1.2

If the "TLS.MinProtocol" is set to anything older than "TLVSv1.2" or the "DTLS.Min.Protocol" is set to anything older than DTLSv1.2, this is a finding.

Vulnerability Number

V-279619

Documentable

False

Rule Version

NXAC-OS-000176

Severity Override Guidance

Confirm that the Nutanix OS OpenSSL library is configured to only use DOD-approved TLS encryption using the following command.

$ sudo grep -i MinProtocol /etc/crypto-policies/back-ends/opensslcnf.config
TLS.MinProtocol = TLSv1.2
DTLS.MinProtocol = DTLSv1.2

If the "TLS.MinProtocol" is set to anything older than "TLVSv1.2" or the "DTLS.Min.Protocol" is set to anything older than DTLSv1.2, this is a finding.

Check Content Reference

M

Target Key

5730