Nutanix Acropolis GPOS STIG

Nutanix Acropolis GPOS Security Technical Implementation Guide

The Nutanix Acropolis GPOS Security Technical Implementation Guide (V1 R2) has 106 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

106STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Sep 30 2026

Nutanix OS must generate audit records when successful/unsuccessful attempts to access security objects occur.

Nutanix Acropolis GPOS Security Technical Implementation Guide

Assessment Title

Rule Text

Nutanix OS must generate audit records when successful/unsuccessful attempts to access security objects occur.

Description

Discussion Text

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

Audit records can be generated from various components within the information system (e.g., module or policy filter).

The list of audited events is the set of events for which audits are generated. This set of events is typically a subset of the list of all events for which the system can generate audit records.

DoW has defined the list of events for which the operating system will provide an audit record generation capability as the following:

1) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels);

2) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system-level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system;

3) All account creations, modifications, disabling, and terminations; and

4) All kernel module load, unload, and restart actions.

Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000064-GPOS-00033, SRG-OS-000458-GPOS-00203, SRG-OS-000064-GPOS-00033, SRG-OS-000461-GPOS-00205

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-279554

Rule

SV-279554r1268902_rule

Severity

medium

Rule Version

NXAC-OS-000048

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify Nutanix OS auditing is configured to generate audit records for all successful and unsuccessful system changes using the following commands.

$ sudo grep -iw truncate /etc/audit/audit.rules
-a always,exit -F arch=b64 -S truncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S truncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S truncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S truncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw openat /etc/audit/audit.rules
-a always,exit -F arch=b64 -S openat -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S openat-F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S openat -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S openat -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S openat -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S openat -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw open /etc/audit/audit.rules
-a always,exit -F arch=b64 -S open -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S open-F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S open -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S open -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw open_by_handle_at /etc/audit/audit.rules
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S open_by_handle_at-F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S open_by_handle_at -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

$ sudo grep -iw ftruncate /etc/audit/audit.rules
-a always,exit -F arch=b64 -S ftruncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b64 -S ftruncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b64 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EACCES -F auid=0 -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid=0 -k access
-a always,exit -F arch=b32 -S ftruncate -F auid>=1000 -F auid!=4294967295 -k access
-a always,exit -F arch=b32 -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -k access

If the commands do not return the appropriate response line, as indicated above, or if the lines are commented out, this is a finding.

Implementation Procedure

Fix Text

1. For AOS, configure the audit rules.

$ sudo salt-call state.sls security/CVM/auditCVM

2. For Prism Central, configure the audit rules.

$ sudo salt-call state.sls security/PCVM/auditPCVM

3. For Files, configure the audit rules.

$ sudo salt-call state.sls security/AFS/auditAFS

4. For AHV, configure the audit rules.

$ sudo salt-call state.sls security/KVM/auditKVM

STIG check 28 of 106 in the Nutanix Acropolis GPOS STIG checklist

← Previous · V-279553Nutanix OS must provide audit record generation for successful and unsuccessful attempts to move, remove, or delete files and directories.Next · V-279555 →Nutanix OS must provide audit record generation capability for all account actions.