PCI DSS 2.0 Requirement 5.1 states:
5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).
This requirement (although I'm not 100% positive it is the only one) caused IT security team in our company to request all the workstations able to connect somehow to the production environment (and probably all the CHD servers) to have antivirus and firewall installed.
In my opinion if the workstation's or server's only OS is GNU/Linux (Debian Wheezy in this case) this requirement is somewhat bonkers. As far as I know the main purpose of AV software running on Linux distros is to detect Windows malware, not to mention that none of those tools offers "live" protection. The best protection you can get is scheduled scan (and, since requirement 5.1.1 that is quite a problem).
Moreover Firewalls are required on all workstations too (PCI DSS 1.4). The funny part is that while virtually all Linux installations have firewalls (iptables), virtually none of them have any rules.
Can you pass PCI DSS without installing antivirus on all linux workstations and servers?
Can you pass PCI DSS without installing additional firewalls or configuring iptables on all linux workstations?
ADDED: If the AV is needed, what about requirement 5.1.1?
5.1.1 Ensure that all anti-virus programs are capable of detecting, removing, and protecting against all known types of malicious software.
I don't think there is Linux AV able to do "live protection", as in scanning everything the user runs or is about to run. At least not compatible with recent kernels.
POST-CERTIFICATION UPDATE: Our company is now PCI DSS 3.0 certified and we did not have to install antivirus on every computer running GNU/Linux. We did not have to argue with the assessor, as they said straight away that AV is not required on Linux workstation in their opinion.