OpenControls Logo

STIG Viewer

STIGViewer Support

Nutanix OS must audit all account change actions.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279541NXAC-OS-000018SV-279541r1192389_ruleCCI-000018medium
Description
Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create an account. Auditing account creation actions provides logging that can be used for forensic purposes. To address access requirements, many operating systems may be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000001-GPOS-00001
STIGDate
Nutanix Acropolis GPOS Security Technical Implementation Guide2026-02-24

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-15.4Automated Audit Actions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (49) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-16Security and Privacy Attributes
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(3)Mandatory Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+39 more (top 10 by confidence shown)

CCI1 mapping
CCI-000018
1.00

Details

Check Text (C-279541r1192389_chk)

Verify the OS is configured to audit all account change actions. Run the following command to verify account creation and modification is audited: $ sudo auditctl -l | grep "audit_account_changes" If the command does not return the following output, this is a finding. -w /etc/group -p wa -k audit_account_changes -w /etc/passwd -p wa -k audit_account_changes -w /etc/gshadow -p wa -k audit_account_changes -w /etc/shadow -p wa -k audit_account_changes -w /etc/security/opasswd -p wa -k audit_account_changes

Fix Text (F-83999r1191586_fix)

Configure Nutanix OS to audit all account change actions. 1. For AOS, configure the audit rules. $ sudo salt-call state.sls security/CVM/auditCVM 2. For Prism Central, configure the audit rules. $ sudo salt-call state.sls security/PCVM/auditPCVM 3. For Files, configure the audit rules. $ sudo salt-call state.sls security/AFS/auditAFS 4. For AHV, configure the audit rules. $ sudo salt-call state.sls security/KVM/auditKVM