Nutanix OS must configure pam_uni.so module to use SHA-512 for authentication to a cryptographic module.

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised.

Operating systems using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.

FIPS 140-3 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.

Verify pam_uni.so module is configured to use SHA-512 using the following command.

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

If "sha512" is missing or commented out, this is a finding.

1. For AOS, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/CVM/pamCVM

2. For Prism Central, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/PCVM/pamPCVM

3. For Files, disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/AFS/pamAFS

4. Configure AHV to disable inactive user accounts after the password expires using the following command.

$ sudo salt-call state.sls security/KVM/pamKVM