OpenControls Logo

STIG Viewer

STIGViewer Support

Nutanix OS must enable an application firewall.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279586NXAC-OS-000133SV-279586r1192556_ruleCCI-001764medium
Description
Firewalls protect computers from network attacks by blocking or limiting access to open network ports. Application firewalls limit which applications are allowed to communicate over the network. Satisfies: SRG-OS-000480-GPOS-00232, SRG-OS-000368-GPOS-00154, SRG-OS-000370-GPOS-00155
STIGDate
Nutanix Acropolis GPOS Security Technical Implementation Guide2026-02-24

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
CFG-02Secure Baseline Configurations
1.00
CFG-03Least Functionality
1.00
CFG-03.2Prevent Unauthorized Software Execution
1.00
CFG-05User-Installed Software
1.00
END-03Prohibit Installation Without Privileged Status
1.00
SEA-06Prevent Program Execution
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (44) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00

+34 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.7
1.00
CCI1 mapping
CCI-001764
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.PS-05
1.00

Who does this work

8 NICE work roles and 8 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-279586r1192556_chk)

1. Verify AOS, Prism Central, and Files has "fapolicyd" installed and is configured for deny-all, permit by exception policy using the following command. $ sudo systemctl status fapolicyd.service fapolicyd.service - File Access Policy Daemon Loaded: loaded (/usr/lib/systemd/system/fapolicyd.service; enabled; vendor preset: disabled) Active: active (running) $ sudo grep permissive /etc/fapolicyd/fapolicyd.conf permissive = 0 $sudo tail /etc/fapolicyd/compiled.rules deny_audit perm=any pattern=ld_so : all deny_audit perm=any all : ftype=application/x-bad-elf allow perm=open all : ftype=application/x-sharedlib trust=1 deny perm=any all : all 2. For AHV, verify iptables services are "Loaded" and "Active". $ sudo service iptables status iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled) Active: active (exited) since Mon 2021-08-02 15:02:12 CDT; 2 weeks 6 days ago Main PID: 1250 (code=exited, status=0/SUCCESS) CGroup: /system.slice/iptables.service 3. If IPv6 is in use, run the following command. $ sudo service ip6tables status ip6tables.service - IPv6 firewall with ip6tables Loaded: loaded (/usr/lib/systemd/system/ip6tables.service; enabled; vendor preset: disabled) Active: active (exited) since Mon 2021-08-02 15:02:12 CDT; 2 weeks 6 days ago Main PID: 1313 (code=exited, status=0/SUCCESS) CGroup: /system.slice/ip6tables.service If an application firewall is not configured or is not installed or enabled, this is a finding.

Fix Text (F-84044r1192555_fix)

1. For AOS, configure fapolicyd.service using the following command. $ sudo salt-call state.sls security/CVM/fapolicydCVM.sls 2. For Prism Central, configure fapolicyd.service using the following command. $ sudo salt-call state.sls security/PCVM/fapolicydPCVM.sls 3. For Files, configure fapolicyd.service using the following command. $ sudo salt-call state.sls security/AFS/fapolicydAFS.sls 4. Configure AHV to restrict using SSH using the following command. $ sudo salt-call state.sls security/KVM/iptables/init