Nutanix OS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.

Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain access to an account.

Verify Nutanix OS enforces a delay of at least four seconds between console logon prompts following a failed logon attempt using the following command.

$ sudo grep -i fail_delay /etc/login.defs FAIL_DELAY 4

If the value of "FAIL_DELAY" is not set to "4" or greater, or the line is commented out, this is a finding.

Configure the use of complex passwords for Nutanix OS VMs.

1. For AOS, configure the use of complex passwords using the following command.

$ sudo salt-call state.sls security/CVM/pamCVM.sls

2. For Prism Central, configure the use of complex passwords using the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM.sls

3. For Files, configure the use of complex passwords using the following command.

$ sudo salt-call state.sls security/AFS/pamAFS.sls

4. For Prism Central, configure the use of complex passwords using the following command.

$ ncli cluster edit-hypervisor-security-params enable-high-strength-password=true