STIGQter STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must protect against or limit the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.

DISA Rule

SV-279626r1192509_rule

Vulnerability Number

V-279626

Group Title

SRG-OS-000420-GPOS-00186

Rule Version

NXAC-OS-000199

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Restrict using functions, ports, protocols, and/or services as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.

1. For AOS, use the following command.

$ sudo salt-call state.sls security/CVM/iptables/init

2. For Prism Central, use the following command.

$ sudo salt-call state.sls security/PVCM/iptables/init

3. For Files, use the following command.

$ sudo salt-call state.sls security/AFS/iptables/init

Check Contents

For AHV, this requirement is Not Applicable.

Verify Nutanix OS protects against or limits the effects of DoS attacks by ensuring that a rate-limiting measures are enabled using the following command.

$ /sbin/sysctl -a | grep 'net.ipv4.tcp_invalid_ratelimit'
net.ipv4.tcp_invalid_ratelimit = 500

If "net.ipv4.tcp_invalid_ratelimit" has a value greater than "1000" or equal to "0", this is a finding.

Vulnerability Number

V-279626

Documentable

False

Rule Version

NXAC-OS-000199

Severity Override Guidance

For AHV, this requirement is Not Applicable.

Verify Nutanix OS protects against or limits the effects of DoS attacks by ensuring that a rate-limiting measures are enabled using the following command.

$ /sbin/sysctl -a | grep 'net.ipv4.tcp_invalid_ratelimit'
net.ipv4.tcp_invalid_ratelimit = 500

If "net.ipv4.tcp_invalid_ratelimit" has a value greater than "1000" or equal to "0", this is a finding.

Check Content Reference

M

Target Key

5730