Nutanixの機能中枢であるCVMは、クラスターのコントロールセンターであることから、サイバー攻撃者が狙う標的にもなりやすい特徴があります。パスワードの変更や、クラスターロックダウンで侵入を防ぐアプローチを行う必要は、セキュリティ対策の一丁目・一番地であることに変わりがありませんが、ゼロトラストの思想からいけば、万が一侵入されてた場合における対策も考えておく必要があります。
Nutanixは、段階的にBashシェルアクセスを廃止する方向になっています。
AOS 7.5 ・・・ CVMへのシェルアクセス制限機能を追加
AOS 7.6 ・・・ CVMへNuService Menu追加（AHVは、デフォルトでSSH接続禁止）
次のバージョン ・・・ デフォルトでCVMへのBashシェル廃止
この実装により米国国防情報局（DISA）のSTIG組織と連携して、RHELベースのSTIGからネットワークアプライアンスベースのSTIGへの準拠になります。
今まで、独自のスクリプトをCVMに入れて運用していたなど様々CVMをカスタマイズした運用をされている場合は、早期にCVM外でオペレーションを行うように改善が必要となります。（そもそもCVM内部で独自のスクリプトなどを動作させることはサポート対象外です）
本日は、AOS7.6で追加されたNuService Menuを紹介します。
CVMにSSHで、「admin」ユーザでログインすると以下のメニューが表示されます。
============================
NuService Menu:
============================
Option 1: Execute Commands
Option 2: Log Viewer
Option 3: Launch Admin Shell
Option 4: Configure Settings
Option 5: Help
Option X: Exit
============================
Choice:
ここで、必要な操作メニューを開きます。まずは、1番のコマンド実行を確認してみます。
============================
Execute Commands:
============================
Option 1: CVM
Option 2: AHV
Option B: Go Back to Main Menu
============================
Choice:
CVMは、CVMでの制限されたシェルアクセス、AHVは、AHVにおける限定されたコマンドを提供するようです。まずは、CVM側のシェルに入ってみます。
--- Allowed Commands Mode ---
Type 'help' for available commands, or 'exit' to return to main menu
acli
afs
arping
cerebro_cli
change_ahv_hostname
change_cvm_display_name
change_cvm_hostname
change_cvm_vlan
check_temporary_full_bash_access_expiration
chronyc tracking
cluster restart_genesis
cluster start
cluster status
cluster stop
collect_perf
configure_restricted_access
convert_cluster_status
cvm_shutdown
date
df
disable_full_bash_access
dmesg
ecli
exit
foundation_service
genesis
help
history
install_host_package
intersight_info
iptables --check
iptables --list
iptables --list-rules
iptables -C
iptables -L
iptables -S
last
lcm_cancel_updates
lcm_leader
lcm_node_recovery
lcm_upgrade_status
list_disks
logbay
manage_bad_passwords.py
manage_bootloader_fix
manage_ipv6
manage_ovs
md5sum
modify_firewall
ncc
ncli
network_segment_status --last_task
nfs_ls
nodetool -h 0 ring
nslookup
nsx_t_manager -l
nutanix_pulse_packet_helper.py
panacea_cli
progress_monitor_cli
rolling_restart
rsync
sar
scp
set_remote_diagnostics_status
smartctl
snapshot_tree_printer
storcli64 /call/eall show
stretch_params_printer
upgrade_status
Tabキーで実行できるコマンドを確認してみました。従来のシェルのようにcpとかsshとかは使えなくなっています。CVMオペレーションでよく利用していたallsshも使えなくなっています。
では、AHV側のコマンド実行画面も見てみましょう。
--- AHV Commands Mode ---
Type 'help' for available commands, or 'exit' to return to main menu
exit ovs-appctl fdb/flush shutdown -h now
help ovs-appctl fdb/show update-cvm-config
history ovs-vsctl get
nvidia-smi ovs-vsctl set
AHV側は、かなり実行できるコマンドが制限されています。許可されているのは、GPU周りのコマンドと仮想スイッチ周りの操作程度でしょうか..。
続いて、2番目のLog Viewerを見てみましょう。
Select an option:
A. File Explorer (with filename filtering)
B. Content Search (string in filtered files)ここちらは、AかBをメニューで選択します。まずは、AのFile Explorerを見てみます。
ここでは、「/home/nutanix/data/logs」配下に配置されるログが一覧で表示されます。
File Filter:
Modified date Size File name
2026-09-26 11:07:20 7.8MB sysstats/top.INFO
2026-09-26 11:07:20 7.8MB sysstats/top.INFO.20260926-013152
2026-09-26 11:07:20 9.6MB insights_server.ntnx-sgh950xpcv-a-cvm.nutanix.log.
2026-09-26 11:07:20 12.9MB health_server.log.20260926-013412Z
2026-09-26 11:07:20 65.2KB acropolis-publisher.out
2026-09-26 11:07:20 853.0KB zookeeper.out
2026-09-26 11:07:20 9.6MB insights_server.INFO
2026-09-26 11:07:20 12.9MB health_server.log
2026-09-26 11:07:20 17.7MB cassandra/cassandra_gc.1790386341.log
2026-09-26 11:07:20 65.2KB acropolis-publisher.out.20260926-104946Z
2026-09-26 11:07:20 853.0KB zookeeper.out.20260926-012946Z
2026-09-26 11:07:19 20.3MB stargate.ntnx-sgh950xpcv-a-cvm.nutanix.log.INFO.20
2026-09-26 11:07:19 374.4KB mantle.INFO
2026-09-26 11:07:19 228.2KB cluster_health.out
2026-09-26 11:07:19 20.3MB stargate.INFO
2026-09-26 11:07:19 228.2KB cluster_health.out.20260926-013412Z
2026-09-26 11:07:19 374.4KB mantle.ntnx-sgh950xpcv-a-cvm.nutanix.log.INFO.2026
2026-09-26 11:07:18 33.4KB sysstats/ping_gateway.INFO.20260926-013144
2026-09-26 11:07:18 33.4KB sysstats/ping_gateway.INFO
2026-09-26 11:07:18 5.6MB sysstats/iotop.INFO.20260926-013147
2026-09-26 11:07:18 1.1MB genesis.out.20260926-011857Z
2026-09-26 11:07:18 1.1MB genesis.out
...こ
ここで、開きたいログを選択しEnterキーを押します。File Filerは、ファイル名を入れると部分一致でファイルを検索しリストをフィルターしてくれます。（フィルター部分はBackspaceキーが使えないので注意が必要です）
ログを開くとログビューワーが起動します。
2026-09-26 01:18:57,439Z rolled over log file
2026-09-26 01:18:57,433Z INFO 9813 /src/bigtop/infra/infra_server/cluster/service_monitor/service_monitor.c:256 main: /home/nutanix/bin/service_monitor: appending fatal messages to /home/nutanix/data/logs/genesis.FATAL
2026-09-26 01:18:57,433Z INFO 9813 /src/bigtop/infra/infra_server/cluster/service_monitor/service_monitor.c:87 StartServiceMonitor: Launched child with pid: 9815
2026-09-26 01:18:57,433Z INFO 9815 /src/bigtop/infra/infra_server/cluster/service_monitor/service_monitor.c:158 StartService: Starting service with cmd: /home/nutanix/cluster/bin/genesis
2026-09-26 01:18:57,433Z ERROR 9815 /src/bigtop/infra/infra_server/cluster/service_monitor/nxenv.c:81 GetHostPortListFromFile: Failed to get host port list call errno() to get error
2026-09-26 01:18:57,434Z ERROR 9815 /src/bigtop/infra/infra_server/cluster/service_monitor/nxenv.c:107 RefreshZkHostPortList: Failed to get host port list error: No such file or directory
2026-09-26 01:18:57,434Z ERROR 9815 /src/bigtop/infra/infra_server/cluster/service_monitor/service_monitor.c:161 StartService: Could not refresh the value of zk host port list
2026-09-26 01:19:02,305Z INFO 95996224 server.py:313 GENESIS START
q to go Back | / to Search | h for Help | 'genesis.out'
「/」で検索ができるあたりは、viチックな動作になっています。
hキーでヘルプを見てみます。
SUMMARY OF LESS COMMANDS
Commands marked with * may be preceded by a number, N.
Notes in parentheses indicate the behavior if N is given.
A key preceded by a caret indicates the Ctrl key; thus ^K is ctrl-K.
h H Display this help.
q :q Q :Q ZZ Exit.
---------------------------------------------------------------------------
MOVING
e ^E j ^N CR * Forward one line (or N lines).
y ^Y k ^K ^P * Backward one line (or N lines).
f ^F ^V SPACE * Forward one window (or N lines).
b ^B ESC-v * Backward one window (or N lines).
z * Forward one window (and set window to N).
w * Backward one window (and set window to N).
ESC-SPACE * Forward one window, but don't stop at end-of-file.
d ^D * Forward one half-window (and set half-window to N).
u ^U * Backward one half-window (and set half-window to N).
ESC-) RightArrow * Right one half screen width (or N positions).
ESC-( LeftArrow * Left one half screen width (or N positions).
ESC-} ^RightArrow Right to last column displayed.
ESC-{ ^LeftArrow Left to first column.
F Forward forever; like "tail -f".
ESC-F Like F but stop when search pattern is found.
r ^R ^L Repaint screen.
R Repaint screen, discarding buffered input.
---------------------------------------------------
Default "window" is the screen height.
Default "half-window" is half of the screen height.
---------------------------------------------------------------------------
SEARCHING
/pattern * Search forward for (N-th) matching line.
?pattern * Search backward for (N-th) matching line.
n * Repeat previous search (for N-th occurrence).
N * Repeat previous search in reverse direction.
ESC-n * Repeat previous search, spanning files.
ESC-N * Repeat previous search, reverse dir. & spanning files.
ESC-u Undo (toggle) search highlighting.
ESC-U Clear search highlighting.
&pattern * Display only matching lines.
---------------------------------------------------
A search pattern may begin with one or more of:
^N or ! Search for NON-matching lines.
^E or * Search multiple files (pass thru END OF FILE).
^F or @ Start search at FIRST file (for /) or last file (for ?).
^K Highlight matches, but don't move (KEEP position).
^R Don't use REGULAR EXPRESSIONS.
^W WRAP search if no match found.
---------------------------------------------------------------------------
JUMPING
g < ESC-< * Go to first line in file (or line N).
G > ESC-> * Go to last line in file (or line N).
p % * Go to beginning of file (or N percent into file).
t * Go to the (N-th) next tag.
T * Go to the (N-th) previous tag.
{ ( [ * Find close bracket } ) ].
} ) ] * Find open bracket { ( [.
ESC-^F * Find close bracket .
ESC-^B * Find open bracket .
---------------------------------------------------
Each "find close bracket" command goes forward to the close bracket
matching the (N-th) open bracket in the top line.
Each "find open bracket" command goes backward to the open bracket
matching the (N-th) close bracket in the bottom line.
m Mark the current top line with .
M Mark the current bottom line with .
' Go to a previously marked position.
'' Go to the previous position.
^X^X Same as '.
ESC-M Clear a mark.
---------------------------------------------------
A mark is any upper-case or lower-case letter.
Certain marks are predefined:
^ means beginning of the file
$ means end of the file
---------------------------------------------------------------------------
CHANGING FILES
:e [file] Examine a new file.
^X^V Same as :e.
:n * Examine the (N-th) next file from the command line.
:p * Examine the (N-th) previous file from the command line.
:x * Examine the first (or N-th) file from the command line.
:d Delete the current file from the command line list.
= ^G :f Print current file name.
---------------------------------------------------------------------------
MISCELLANEOUS COMMANDS
- Toggle a command line option [see OPTIONS below].
-- Toggle a command line option, by name.
_ Display the setting of a command line option.
__ Display the setting of an option, by name.
+cmd Execute the less cmd each time a new file is examined.
!command Execute the shell command with $SHELL.
|Xcommand Pipe file between current pos & mark X to shell command.
s file Save input to a file.
v Edit the current file with $VISUAL or $EDITOR.
V Print version number of "less".
---------------------------------------------------------------------------
OPTIONS
Most options may be changed either on the command line,
or from within less by using the - or -- command.
Options may be given in one of two forms: either a single
character preceded by a -, or a name preceded by --.
-? ........ --help
Display help (from command line).
-a ........ --search-skip-screen
Search skips current screen.
-A ........ --SEARCH-SKIP-SCREEN
Search starts just after target line.
-b [N] .... --buffers=[N]
Number of buffers.
-B ........ --auto-buffers
Don't automatically allocate buffers for pipes.
-c -C .... --clear-screen --CLEAR-SCREEN
Repaint by clearing rather than scrolling.
-d ........ --dumb
Dumb terminal.
-D xcolor . --color=xcolor
Set screen colors.
-e -E .... --quit-at-eof --QUIT-AT-EOF
Quit at end of file.
-f ........ --force
Force open non-regular files.
-F ........ --quit-if-one-screen
Quit if entire file fits on first screen.
-g ........ --hilite-search
Highlight only last match for searches.
-G ........ --HILITE-SEARCH
Don't highlight any matches for searches.
--old-bot
Revert to the old bottom of screen behavior.
-h [N] .... --max-back-scroll=[N]
Backward scroll limit.
-i ........ --ignore-case
Ignore case in searches that do not contain uppercase.
-I ........ --IGNORE-CASE
Ignore case in all searches.
-j [N] .... --jump-target=[N]
Screen position of target lines.
-J ........ --status-column
Display a status column at left edge of screen.
-k [file] . --lesskey-file=[file]
Use a lesskey file.
-K ........ --quit-on-intr
Exit less in response to ctrl-C.
-L ........ --no-lessopen
Ignore the LESSOPEN environment variable.
-m -M .... --long-prompt --LONG-PROMPT
Set prompt style.
-n ........ --line-numbers
Don't use line numbers.
-N ........ --LINE-NUMBERS
Use line numbers.
-o [file] . --log-file=[file]
Copy to log file (standard input only).
-O [file] . --LOG-FILE=[file]
Copy to log file (unconditionally overwrite).
-p [pattern] --pattern=[pattern]
Start at pattern (from command line).
-P [prompt] --prompt=[prompt]
Define new prompt.
-q -Q .... --quiet --QUIET --silent --SILENT
Quiet the terminal bell.
-r -R .... --raw-control-chars --RAW-CONTROL-CHARS
Output "raw" control characters.
-s ........ --squeeze-blank-lines
Squeeze multiple blank lines.
-S ........ --chop-long-lines
Chop (truncate) long lines rather than wrapping.
-t [tag] .. --tag=[tag]
Find a tag.
-T [tagsfile] --tag-file=[tagsfile]
Use an alternate tags file.
-u -U .... --underline-special --UNDERLINE-SPECIAL
Change handling of backspaces.
-V ........ --version
Display the version number of "less".
-w ........ --hilite-unread
Highlight first new line after forward-screen.
-W ........ --HILITE-UNREAD
Highlight first new line after any forward movement.
-x [N[,...]] --tabs=[N[,...]]
Set tab stops.
-X ........ --no-init
Don't use termcap init/deinit strings.
-y [N] .... --max-forw-scroll=[N]
Forward scroll limit.
-z [N] .... --window=[N]
Set size of window.
-" [c[c]] . --quotes=[c[c]]
Set shell quote characters.
-~ ........ --tilde
Don't display tildes after end of file.
-# [N] .... --shift=[N]
Set horizontal scroll amount (0 = one half screen width).
--file-size
Automatically determine the size of the input file.
--follow-name
The F command changes files if the input file is renamed.
--incsearch
Search file as each pattern character is typed in.
--line-num-width=N
Set the width of the -N line number field to N characters.
--mouse
Enable mouse input.
--no-keypad
Don't send termcap keypad init/deinit strings.
--no-histdups
Remove duplicates from command history.
--rscroll=C
Set the character used to mark truncated lines.
--save-marks
Retain marks across invocations of less.
--status-col-width=N
Set the width of the -J status column to N characters.
--use-backslash
Subsequent options use backslash as escape char.
--use-color
Enables colored text.
--wheel-lines=N
Each click of the mouse wheel moves N lines.
---------------------------------------------------------------------------
LINE EDITING
These keys can be used to edit text being entered
on the "command line" at the bottom of the screen.
RightArrow ..................... ESC-l ... Move cursor right one character.
LeftArrow ...................... ESC-h ... Move cursor left one character.
ctrl-RightArrow ESC-RightArrow ESC-w ... Move cursor right one word.
ctrl-LeftArrow ESC-LeftArrow ESC-b ... Move cursor left one word.
HOME ........................... ESC-0 ... Move cursor to start of line.
END ............................ ESC-$ ... Move cursor to end of line.
BACKSPACE ................................ Delete char to left of cursor.
DELETE ......................... ESC-x ... Delete char under cursor.
ctrl-BACKSPACE ESC-BACKSPACE ........... Delete word to left of cursor.
ctrl-DELETE .... ESC-DELETE .... ESC-X ... Delete word under cursor.
ctrl-U ......... ESC (MS-DOS only) ....... Delete entire line.
UpArrow ........................ ESC-k ... Retrieve previous command line.
DownArrow ...................... ESC-j ... Retrieve next command line.
TAB ...................................... Complete filename & cycle.
SHIFT-TAB ...................... ESC-TAB Complete filename & reverse cycle.
ctrl-L ................................... Complete filename, list all.
HELP -- END -- Press g to see it again, or q when doneオペレーション的には、「less」コマンドと同じような感じに見受けられます。
ヘルプは、「q」キーで終了できます。
では、もう一つのメニューである「B. Content Search (string in filtered files)」も見てみたいと思います。
Search String: <keywoedを入力>
File Filter:
TAB/UP/DOWN to switch fields | ENTER to search | ESC to Menu
Search Stringに文字を入力すると、その文字が該当するログを探して一覧にしてくれます。
ここでは「nutanix」で、検索をしてみました。
Found 50 matches (Page 1/10):
File: using-gflags.log
-> 2026-09-25 15:41:02,670Z ERROR using-gflags:452 Could Not Acquire Lo... 2026-09-25 15:41:02,671Z ERROR using-gflags:463 Cluster is not started
File: using-gflags.log
2026-09-26 01:33:02,458Z INFO zookeeper_session.py:1028 ZK session e... -> 2026-09-26 01:33:02,460Z INFO using-gflags:409 Running Cmd using exe... 2026-09-26 01:33:02,485Z INFO zookeeper_session.py:308 using-gflags ...
File: using-gflags.log
2026-09-26 01:33:02,489Z INFO zookeeper_session.py:1028 ZK session e... -> 2026-09-26 01:35:02,118Z INFO using-gflags:409 Running Cmd using exe... 2026-09-26 01:35:02,188Z INFO zookeeper_session.py:308 using-gflags ...
File: using-gflags.log
2026-09-26 01:35:02,194Z INFO zookeeper_session.py:1028 ZK session e... -> 2026-09-26 01:38:02,711Z INFO using-gflags:409 Running Cmd using exe... 2026-09-26 01:38:13,563Z INFO zookeeper_session.py:308 using-gflags ...
File: using-gflags.log
2026-09-26 01:38:13,568Z INFO zookeeper_session.py:1028 ZK session e... -> 2026-09-26 02:15:02,437Z INFO using-gflags:409 Running Cmd using exe... 2026-09-26 02:15:02,622Z INFO zookeeper_session.py:308 using-gflags ...
UP/DOWN: navigate | ENTER: open | LEFT/RIGHT: page | ESC: returnこここで、選択したログを開くとログが表示されます。キーボードの右キーを押すと次ページの検索結果が表示されます。
これらのメニューは、「ESC」キーで前画面に戻ります。
では次に、メニュー３の「 Launch Admin Shell」を見てみましょう。
これを選択すると普通のBashシェルが表示されます。
Launching bash...
admin@NTNX-XAI911XPCV-A-CVM:10.185.153.213:~$
adminユーザとしてシェルに入ることができます。おそらくこの機能がAOS7.6の次のバージョンからロックされる流れになると思われます。
この辺りは、「configure_restricted_access」コマンドで挙動が変わるので、次回ご紹介したいと思います。
（参考）KB20212 / End of Support Life (EOSL) for SSH Bash Shell Access
https://portal.nutanix.com/kb/20212
