STIGQter: STIG Summary: Nutanix Acropolis GPOS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

Nutanix AHV must store only encrypted representations of passwords.

DISA Rule

SV-279686r1192615_rule

Vulnerability Number

V-279686

Group Title

SRG-OS-000073-GPOS-00041

Rule Version

NXAC-OS-000273

Severity

CAT I

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

10

Fix Recommendation

Configure the high-strength password requirements using the following command.

$ ncli cluster edit-hypervisor-security-params enable-high-strength-password=true

Check Contents

1. Verify Nutanix AHV is configured to store encrypted representation of passwords and that the encryption meets required standards using the following command.

$ sudo grep password /etc/pam.d/system-auth /etc/pam.d/password-auth
/etc/pam.d/system-auth-ac:password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
/etc/pam.d/password-auth:password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

Output should match the example; if it does not this is a finding.

$ sudo grep -i encrypt /etc/login.defs
ENCRYPT_METHOD SHA512

If the "/etc/login.defs" file does not contain the required output, this is a finding.

2. Run the command:

$ sudo grep -i sha512 /etc/libuser.conf
crypt_style = sha512

If the "/etc/libuser.conf" file does not contain the required output, this is a finding.

Vulnerability Number

V-279686

Documentable

False

Rule Version

NXAC-OS-000273

Severity Override Guidance

1. Verify Nutanix AHV is configured to store encrypted representation of passwords and that the encryption meets required standards using the following command.

$ sudo grep password /etc/pam.d/system-auth /etc/pam.d/password-auth
/etc/pam.d/system-auth-ac:password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok
/etc/pam.d/password-auth:password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

Output should match the example; if it does not this is a finding.

$ sudo grep -i encrypt /etc/login.defs
ENCRYPT_METHOD SHA512

If the "/etc/login.defs" file does not contain the required output, this is a finding.

2. Run the command:

$ sudo grep -i sha512 /etc/libuser.conf
crypt_style = sha512

If the "/etc/libuser.conf" file does not contain the required output, this is a finding.

Check Content Reference

M

Target Key

5730