STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-279625r1192338_rule

Vulnerability Number

V-279625

Group Title

SRG-OS-000142-GPOS-00071

Rule Version

NXAC-OS-000198

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Set the value of syncookies to 1.

1. For AOS, run the following command.

$ sudo salt-call state.sls security/CVM/iptables/init

2. For Prism Central, run the following command.

$ sudo salt-call state.sls security/PCVM/iptables/init

3. For Files, run the following command.

$ sudo salt-call state.sls security/AFS/iptables/init

4. For AHV, configure Nutanix AHV to use TCP syncookies using the following command.

$ sudo sysctl -w net.ipv4.tcp_syncookies=1

If "1" is not the system's default value, add or update the following line in "/etc/sysctl.conf":

net.ipv4.tcp_syncookies = 1

Check Contents

Verify Nutanix OS is configured to use syncookies.

1. For AOS, Prism Central, and Files, verify the saved value of TCP syncookies using the following command.

$ sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* | grep -v '#'
/etc/sysctl.d/99-salt.conf:net.ipv4.tcp_syncookies = 1

2. Verify AHV is configured to use syncookies using the following command.

$ sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1

$ sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* | grep -v '#'

If the value of syncookies is not set to "1", this is a finding.

Vulnerability Number

V-279625

Documentable

False

Rule Version

NXAC-OS-000198

Severity Override Guidance

Verify Nutanix OS is configured to use syncookies.

1. For AOS, Prism Central, and Files, verify the saved value of TCP syncookies using the following command.

$ sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* | grep -v '#'
/etc/sysctl.d/99-salt.conf:net.ipv4.tcp_syncookies = 1

2. Verify AHV is configured to use syncookies using the following command.

$ sysctl net.ipv4.tcp_syncookies
net.ipv4.tcp_syncookies = 1

$ sudo grep -i net.ipv4.tcp_syncookies /etc/sysctl.conf /etc/sysctl.d/* | grep -v '#'

If the value of syncookies is not set to "1", this is a finding.

Check Content Reference

M

Target Key

5730