← Back to Nutanix Acropolis Application Server Security Technical Implementation Guide

V-279438

CAT II (Medium)

Nutanix AOS must authenticate users individually prior to using a group authenticator.

Rule ID

SV-279438r1191100_rule

STIG

Nutanix Acropolis Application Server Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-004045

Discussion

To ensure individual accountability and prevent unauthorized access, application server users (and any processes acting on behalf of application server users) must be individually identified and authenticated. A group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Application servers must ensure individual users are authenticated prior to authenticating via role or group authentication. This is to ensure there is nonrepudiation for actions taken.

Check Content

Confirm the Nutanix VM application server is set to use enterprise user management systems. Envoy Reverse Proxy does not support group authenticators.

1. Log in to Prism Element.
2. Click the gear icon in the upper-right corner.
3. Navigate to Authentication settings.

If an Active Directory or OpenLDAP servers are not configured, this is a finding.

Fix Text

Configure the Nutanix VM application server to use an enterprise user management system to authenticate individual users.

1. Log in to Prism Element.
2. Click the gear icon in the upper-right corner.
3. Navigate to Authentication settings.
4. Add an Active Directory or OpenLDAP server to the directory list.

Alternatively, individual local users can be created within Prism.

1. Log in to Prism Element.
2. Click the gear icon in the upper-right corner.
3. Navigate to Local User Management.
4. Select "+ New Users".