STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix OS must install and use SSH for remote access.

DISA Rule

SV-279628r1192513_rule

Vulnerability Number

V-279628

Group Title

SRG-OS-000425-GPOS-00189

Rule Version

NXAC-OS-000203

Severity

CAT II

CCI(s)

• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

However, Nutanix AOS has the OpenSSH-Server package preinstalled as part of its base package set. If the package is not installed, some corruption has taken place and the CVM must be rebuilt.

Configure SSH to meet DOD standard, if already installed on the OS instance.

1. For AOS, configure SSH, then restart the SSH for the changes to take effect using the following command.

$ sudo salt-call state.sls security/CVM/sshdCVM
$ sudo systemctl restart sshd

2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect using the following command.

$ sudo salt-call state.sls security/PCVM/sshdPCVM
$ sudo systemctl restart sshd

3. For Files, configure SSH, then restart the SSH for the changes to take effect using the following command.

$ sudo salt-call state.sls security/AFS/sshdAFS
$ sudo systemctl restart sshd

4. For AHV configure SSH, then restart the SSH for the changes to take effect using the following command.

$ sudo salt-call state.sls security/KVM/sshdKVM
$ sudo systemctl restart sshd

Check Contents

Verify Nutanix OS has SSH loaded and active using the following command.

Note: The default Protocol version of the ssh daemon is 2, which provides the necessary mitigations to prevent replay attacks.

$ sudo systemctl status sshd
sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
Active: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago
Main PID: 1348 (sshd)
CGroup: /system.slice/sshd.service
1053 /usr/sbin/sshd -D

If "sshd" does not show a status of "active" and "running", this is a finding.

If the "SSH server" package is not installed, this is a finding.

Vulnerability Number

V-279628

Documentable

False

Rule Version

NXAC-OS-000203

Severity Override Guidance

Verify Nutanix OS has SSH loaded and active using the following command.

Note: The default Protocol version of the ssh daemon is 2, which provides the necessary mitigations to prevent replay attacks.

$ sudo systemctl status sshd
sshd.service - OpenSSH server daemon
Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled)
Active: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago
Main PID: 1348 (sshd)
CGroup: /system.slice/sshd.service
1053 /usr/sbin/sshd -D

If "sshd" does not show a status of "active" and "running", this is a finding.

If the "SSH server" package is not installed, this is a finding.

Check Content Reference

M

Target Key

5730