CIS Nutanix AHV Benchmark

This recommendation verifies that AOS is updated to latest LTS version on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check AOS version:
ncli cluster version
ncli cluster info | grep -E 'Version|Name|Cluster'
nucalm version 2>/dev/null

# Update AOS to latest LTS:
# Prism Central > LCM (Life Cycle Manager) > Inventory > Perform Inventory
# Select AOS update > Pre-check > Apply
# Or via CLI:
cluster --version

This recommendation verifies that cluster redundancy is configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster configuration:
ncli cluster get-params
nucalm cluster list
ncli cluster get-redundancy-state

# Configure cluster redundancy:
ncli cluster edit-params new-redundancy-factor=2

# Set cluster virtual IP:
ncli cluster set-external-ip-address external-ip-address=10.0.1.100

This recommendation verifies that role-based access control is configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Prism admin accounts:
ncli user list
nucalm user list 2>/dev/null
curl -sk -u admin https://prism.example.com:9440/PrismGateway/services/rest/v2.0/users/ | python3 -m json.tool | head -30

# Configure role-based access:
# Prism Central > Administration > Roles
# Create role with minimum permissions

# Change default admin password:
ncli user reset-password user-name=admin password=SecureP@ssw0rd!

# Enable directory integration:
ncli authconfig add-directory directory-type=ACTIVE_DIRECTORY name=corp-ad domain=corp.example.com directory-url=ldaps://dc1.corp.example.com:636

This recommendation verifies that Active Directory integration is configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication settings:
ncli authconfig list-directory
ncli authconfig get-client-auth

# Enable LDAP/AD authentication:
ncli authconfig add-directory \
  directory-type=ACTIVE_DIRECTORY \
  name=CorpAD \
  domain=corp.example.com \
  directory-url=ldaps://dc.corp.example.com:636

# Map AD groups to roles:
ncli authconfig add-role-mapping \
  role=ROLE_CLUSTER_ADMIN \
  type=GROUP \
  entity-type=DIRECTORY \
  entity-values=NutanixAdmins

This recommendation verifies that session timeout is configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check session settings:
curl -sk -u admin https://prism.example.com:9440/PrismGateway/services/rest/v1/authconfig | python3 -m json.tool | grep -i session

# Configure session timeout:
# Prism > Settings > UI Settings > Session Timeout
# Set: 15 minutes

ncli cluster edit-params session-timeout=900

This recommendation verifies that VLAN networks are used for segmentation on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check virtual switches:
acli net.list
acli net.get <network_name>
ncli network list

# Create isolated VLAN networks:
acli net.create prod_net vswitch=vs0 vlan=100
acli net.create mgmt_net vswitch=vs0 vlan=10
acli net.create backup_net vswitch=vs0 vlan=200

# Configure IP pools:
acli net.add_dhcp_pool prod_net start=10.0.100.50 end=10.0.100.200

This recommendation ensures that Flow microsegmentation policies are enforced on the Nutanix AHV hyperconverged infrastructure platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Nutanix AHV hyperconverged infrastructure platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check microsegmentation (Flow):
curl -sk -u admin https://prism.example.com:9440/api/microseg/v4.0.a1/config/policies | python3 -m json.tool | head -30

# Enable Flow microsegmentation:
# Prism Central > Network & Security > Security Policies
# Create security policy:
#   Category: AppType:Web
#   Inbound: Allow TCP 443 from Any
#   Inbound: Allow TCP 22 from Management
#   Default: Block All

# Apply policy:
# Mode: Enforce (not Monitor)

This recommendation verifies that Secure Boot and vTPM are enabled on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM configuration:
acli vm.list
acli vm.get <vm_name> | grep -E 'secure_boot|vtpm|credential_guard'

# Enable Secure Boot and vTPM:
acli vm.update <vm_name> secure_boot=true
acli vm.update <vm_name> vtpm=true machine_type=Q35

# Enable Credential Guard (Windows VMs):
acli vm.update <vm_name> credential_guard=true

This recommendation verifies that protection domains with snapshots are configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM snapshots and protection:
ncli protection-domain list
ncli protection-domain ls-entities protection-domain-name=<pd_name>

# Create protection domains:
ncli protection-domain create name=prod-pd
ncli protection-domain protect name=prod-pd vm-names=web01,db01

# Create snapshot schedule:
ncli protection-domain add-one-time-snapshot \
  name=prod-pd \
  snapshot-name=pre-change-$(date +%Y%m%d)

This recommendation verifies that resource quotas are set via projects on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VM resource limits:
acli vm.get <vm_name> | grep -E 'cores|memory|disk'

# Set resource quotas:
# Prism Central > Administration > Projects
# Create project with resource limits:
#   vCPUs: 100
#   Memory: 256 GB
#   Storage: 2 TB

# Per-VM limits via categories:
acli vm.update <vm_name> num_vcpus=4 memory=8G

This recommendation verifies that data-at-rest encryption is enabled on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check encryption at rest:
ncli cluster get-params | grep -i encrypt
ncli data-at-rest-encryption get-status

# Enable data-at-rest encryption:
ncli data-at-rest-encryption enable

# Configure external KMS:
ncli data-at-rest-encryption set-kms \
  kms-server-ip=kms.example.com \
  kms-server-port=5696

This recommendation verifies that storage containers have compression and fingerprinting on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check storage containers:
ncli container list
ncli container get name=<container_name>

# Configure storage container with compression and dedup:
ncli container create name=prod-container rf=2 \
  compression-enabled=true \
  compression-delay=0 \
  fingerprint-on-write=on

# Enable erasure coding for cold data:
ncli container edit name=prod-container erasure-code=on

This recommendation verifies that CVM SSH is hardened on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check CVM SSH configuration:
grep -E 'PermitRootLogin|PasswordAuthentication|MaxAuthTries' /etc/ssh/sshd_config
cat /home/nutanix/cluster/bin/.ssh_config 2>/dev/null

# Harden CVM SSH:
# /etc/ssh/sshd_config:
# PermitRootLogin no
# PasswordAuthentication no
# MaxAuthTries 4
# ClientAliveInterval 300
# ClientAliveCountMax 0

sudo systemctl restart sshd

# Change default nutanix user password:
ncli user reset-password user-name=nutanix

This recommendation verifies that SCMA security profile is enabled on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SCMA (Security Configuration Management Automation):
ncli cluster get-params | grep -i scma
cat /home/nutanix/security/scma/scma.conf 2>/dev/null

# Enable SCMA hardening:
# Prism > Settings > Security Configuration Management
# Enable SCMA with STIG or CIS profile

ncc health_server scma_status
ncc health_server scma_scan

This recommendation verifies that remote syslog forwarding is configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check syslog configuration:
ncli rsyslog-config ls
cat /etc/rsyslog.d/nutanix.conf 2>/dev/null

# Configure remote syslog:
ncli rsyslog-config set-server \
  server-name=siem.example.com \
  port=514 \
  network-protocol=TCP \
  module-name=STARGATE,PRISM,GENESIS

# Verify:
ncli rsyslog-config ls

This recommendation verifies that NCC health checks and alerts are configured on the Nutanix AHV hyperconverged infrastructure platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Nutanix AHV hyperconverged infrastructure platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check NCC health:
ncc health_checks run_all
ncc health_checks show-alerts

# Configure alert policies:
# Prism > Alerts > Alert Policies
# Email: admin@example.com
# SNMP: snmp-trap receiver

# Run health check:
ncc health_checks run_all --log_to_file=true

# Schedule regular checks:
# Prism > Health > Actions > Schedule NCC Check