I won't lie, I am not a security expert and I am likely one of them guys in them companies whom working life proficiency is to slowly become little annoying. I work for a company complying with PCI DSS standard and the company slowly starts rolling changes for the compliance with PCI DSS 4.0 standard.

As a sysadmin, it looks like one of the first victims to fall are going to be our Linux jump servers. Originally, there was some talk that it is just due to a new requirement for an MFA on said systems, but that is doable just fine. It would be a bit annoying just compared to everything magically working thanks to SSH key authentication, but with built-in caching I believe it might only require doing so two-three times a day, which is an inconvenience which I believe all of us could live with. The issue is that then another talk about SSH tunnels emerged and here's where I hoped someone from the community who lives and breaths PCI DSS compliance might shed more light on this "requirement" as I have a feeling something might have been lost in the translation and maybe this is not a correct information.

Does PCI DSS 4.0 compliance prohibit any existence of SSH jumps and SSH tunnels respectively, given any such server would implement MFA for SSH?

  • You should call out the specific aspects of the standard that you think might conflict. Ideally, quote, with links to relevant sections. However, the financial industry uses SSH all over the place, including for ACH, so I'd be shocked if the standard prohibits it in any significant way.
    – CBHacking
    Commented May 20 at 1:21

1 Answer 1


I am not a PCI DSS 4.0 expert, however I havent found any thing in the specs that prohibit the use of a Bastion (or jump host).

I have found you can't mix them. (so a bastion for PCI DSS 4.0 compliant use, and another for other use)

In my opinion it would also be nuts to not allow bastion hosts... due to there additional security and auditing properties.

PCI DSS 4.0 Scoping-and-Segmentation

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .