Nutanix AOS pam_unix.so module must be configured in the password-auth file to use a FIPS 140-2 approved cryptographic hashing algorithm for system authentication.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254222	NUTX-OS-001380	SV-254222r971535_rule		High

Description
Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.

Description

Unapproved mechanisms used for authentication to the cryptographic module are not verified and therefore, cannot be relied upon to provide confidentiality or integrity, and DoD data may be compromised. Operating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoD requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system.

STIG	Date
Nutanix AOS 5.20.x OS Security Technical Implementation Guide	2024-06-18

Details

Check Text ( C-57707r846752_chk )
Verify that the pam_unix.so module is configured to use SHA512. $ sudo grep password /etc/pam.d/password-auth \| grep pam_unix password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok $ sudo grep password /etc/pam.d/system-auth \| grep pam_unix password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok If "sha512" is not an option in both outputs, or is commented out, this is a finding.

Check Text ( C-57707r846752_chk )

Verify that the pam_unix.so module is configured to use SHA512.

$ sudo grep password /etc/pam.d/password-auth | grep pam_unix
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

$ sudo grep password /etc/pam.d/system-auth | grep pam_unix
password sufficient pam_unix.so sha512 shadow try_first_pass use_authtok

If "sha512" is not an option in both outputs, or is commented out, this is a finding.

Fix Text (F-57658r846753_fix)
Configure the pam.d modules to comply with FIPS 140-2: 1. Enable high-strength passwords: $ ncli cluster edit-cvm-security-params enable-high-strength-password=true 2. After enabling the high-strength passwords, the system will process the salt stack to enable the DoD versions of the pam.d files. Recheck the Check Text for compliance. To run the salt command manually to enable the pam.d auth files, run the following command (high-strength passwords must be set to true): $ sudo salt-call state.sls security/CVM/pamCVM

Fix Text (F-57658r846753_fix)

Configure the pam.d modules to comply with FIPS 140-2:

1. Enable high-strength passwords:
$ ncli cluster edit-cvm-security-params enable-high-strength-password=true

2. After enabling the high-strength passwords, the system will process the salt stack to enable the DoD versions of the pam.d files. Recheck the Check Text for compliance.

To run the salt command manually to enable the pam.d auth files, run the following command (high-strength passwords must be set to true):
$ sudo salt-call state.sls security/CVM/pamCVM