STIGQter STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.

DISA Rule

SV-279620r1192503_rule

Vulnerability Number

V-279620

Group Title

SRG-OS-000125-GPOS-00065

Rule Version

NXAC-OS-000184

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure SSH.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

4. For AHV configure SSH, then restart the SSH for the changes to take effect.

$ sudo salt-call state.sls security/KVM/sshdKVM
$ sudo systemctl restart sshd

Check Contents

Verify Nutanix OS is configured to use only MACs employing FIPS 140-3-approved algorithms using the following command.

$ sudo grep -i ciphers /etc/crypto-policies/back-ends/opensshserver.config
CRYPTO_POLICY=Ciphers=aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com

If the cipher entries in the "opensshserver.config" file have any hashes other than shown here, the order differs from the example above, or they are missing or commented out, this is a finding.

Vulnerability Number

V-279620

Documentable

False

Rule Version

NXAC-OS-000184

Severity Override Guidance

Verify Nutanix OS is configured to use only MACs employing FIPS 140-3-approved algorithms using the following command.

$ sudo grep -i ciphers /etc/crypto-policies/back-ends/opensshserver.config
CRYPTO_POLICY=Ciphers=aes256-ctr,aes192-ctr,aes128-ctr,aes256-gcm@openssh.com,aes128-gcm@openssh.com

If the cipher entries in the "opensshserver.config" file have any hashes other than shown here, the order differs from the example above, or they are missing or commented out, this is a finding.

Check Content Reference

M

Target Key

5730