OpenControls Logo

STIG Viewer

STIGViewer Support

Nutanix OS must install and use SSH for remote access.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-279628NXAC-OS-000203SV-279628r1192513_ruleCCI-002420medium
Description
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information. Ensuring the confidentiality of transmitted information requires the operating system to take measures in preparing information for transmission. This can be accomplished via access control and encryption. Satisfies: SRG-OS-000425-GPOS-00189, SRG-OS-000074-GPOS-00042, SRG-OS-000425-GPOS-00189, SRG-OS-000113-GPOS-00058, SRG-OS-000426-GPOS-00190, SRG-OS-000112-GPOS-00057
STIGDate
Nutanix Acropolis GPOS Security Technical Implementation Guide2026-02-24

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-01Use of Cryptographic Controls
0.50
CRY-01.3Pre/Post Transmission Handling
0.50
DCH-10Media Use
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (35) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
AU-10(1)Association of Identities
1.00
AU-10(2)Validate Binding of Information Producer Identity
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00

+25 more (top 10 by confidence shown)

CCI1 mapping
CCI-002420
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-01
0.50
PR.DS-02
0.50
PR.DS-10
0.50

Details

Check Text (C-279628r1192513_chk)

Verify Nutanix OS has SSH loaded and active using the following command. Note: The default Protocol version of the ssh daemon is 2, which provides the necessary mitigations to prevent replay attacks. $ sudo systemctl status sshd sshd.service - OpenSSH server daemon Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled) Active: active (running) since Tue 2015-11-17 15:17:22 EST; 4 weeks 0 days ago Main PID: 1348 (sshd) CGroup: /system.slice/sshd.service 1053 /usr/sbin/sshd -D If "sshd" does not show a status of "active" and "running", this is a finding. If the "SSH server" package is not installed, this is a finding.

Fix Text (F-84086r1192342_fix)

However, Nutanix AOS has the OpenSSH-Server package preinstalled as part of its base package set. If the package is not installed, some corruption has taken place and the CVM must be rebuilt. Configure SSH to meet DOD standard, if already installed on the OS instance. 1. For AOS, configure SSH, then restart the SSH for the changes to take effect using the following command. $ sudo salt-call state.sls security/CVM/sshdCVM $ sudo systemctl restart sshd 2. For Prism Central, configure SSH, then restart the SSH for the changes to take effect using the following command. $ sudo salt-call state.sls security/PCVM/sshdPCVM $ sudo systemctl restart sshd 3. For Files, configure SSH, then restart the SSH for the changes to take effect using the following command. $ sudo salt-call state.sls security/AFS/sshdAFS $ sudo systemctl restart sshd 4. For AHV configure SSH, then restart the SSH for the changes to take effect using the following command. $ sudo salt-call state.sls security/KVM/sshdKVM $ sudo systemctl restart sshd