OpenControls Logo

STIG Viewer

STIGViewer Support

Nutanix OS must limit the ability of nonprivileged users to grant other users direct access to the contents of their home directories/folders.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279585NXAC-OS-000132SV-279585r1192452_ruleCCI-002165medium
Description
Users' home directories/folders may contain information of a sensitive nature. Nonprivileged users should coordinate any sharing of information with a system administrator (SA) through shared resources.
STIGDate
Nutanix Acropolis GPOS Security Technical Implementation Guide2026-02-24

Related Frameworks

1 mapping across 2 frameworks
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AC-3(13)Attribute-based Access Control
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
CM-11(2)Software Installation with Privileged Status
1.00
CM-6Configuration Settings
1.00
CM-7(2)Prevent Program Execution
1.00
CM-7(5)Authorized Software — Allow-by-exception
1.00

+5 more (top 10 by confidence shown)

CCI1 mapping
CCI-002165
1.00

Details

Check Text (C-279585r1192452_chk)

Verify Nutanix OS has assigned home directory of all local interactive users has a mode of "0750" or less permissive using the following command. $ ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd) drwxr-x---. 3 admin admin 4096 Nov 6 2020 /home/admin drwxr-x---. 26 nutanix nutanix 4096 Aug 17 08:02 /home/nutanix If home directories referenced in "/etc/passwd" do not have a mode of "0750" or less, this is a finding.

Fix Text (F-84043r1192451_fix)

For AOS, Prism Central, and Files, configure any interactive users home directory to have a mode of 0750 or less using the following command. $ sudo chmod 0750 [path to interactive user's home directory] For AHV, this setting is a default setting set by the vendor and is not supported to be changed in the field. If any interactive user accounts exist then something has been modified and the hypervisor OS VM must be rebuilt from source.