Nutanix OS must enforce a delay of at least four seconds between logon prompts following a failed logon attempt.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-279581 | SRG-OS-000021-GPOS-00005 | NXAC-OS-000128 | SV-279581r1192447_rule | 2026-02-24 | 1 |
Description
Limiting the number of logon attempts over a certain time interval reduces the chances that an unauthorized user may gain access to an account.
ℹ️ Check
Verify Nutanix OS enforces a delay of at least four seconds between console logon prompts following a failed logon attempt using the following command.
$ sudo grep -i fail_delay /etc/login.defs
FAIL_DELAY 4
If the value of "FAIL_DELAY" is not set to "4" or greater, or the line is commented out, this is a finding.
✔️ Fix
Configure the use of complex passwords for Nutanix OS VMs.
1. For AOS, configure the use of complex passwords using the following command.
$ sudo salt-call state.sls security/CVM/pamCVM.sls
2. For Prism Central, configure the use of complex passwords using the following command.
$ sudo salt-call state.sls security/PCVM/pamPCVM.sls
3. For Files, configure the use of complex passwords using the following command.
$ sudo salt-call state.sls security/AFS/pamAFS.sls
4. For Prism Central, configure the use of complex passwords using the following command.
$ ncli cluster edit-hypervisor-security-params enable-high-strength-password=true