← Back to Nutanix Acropolis GPOS Security Technical Implementation Guide

V-279613

CAT II (Medium)

Nutanix OS must configure pam_uni.so module to use SHA-512 for authentication to a cryptographic module.

Rule ID

SV-279613r1192499_rule

STIG

Nutanix Acropolis GPOS Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000803

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised. Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DOD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.

Check Content

Verify pam_uni.so module is configured to use SHA-512 using the following command.

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok

If "sha512" is missing or commented out, this is a finding.

Fix Text

1. For AOS, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/CVM/pamCVM

2. For Prism Central, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM

3. For Files, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/AFS/pamAFS

4. Configure AHV to disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/KVM/pamKVM