1

I won't lie, I am not a security expert and I am likely one of them guys in them companies whom working life proficiency is to slowly become little annoying. I work for a company complying with PCI DSS standard and the company slowly starts rolling changes for the compliance with PCI DSS 4.0 standard.

As a sysadmin, it looks like one of the first victims to fall are going to be our Linux jump servers. Originally, there was some talk that it is just due to a new requirement for an MFA on said systems, but that is doable just fine. It would be a bit annoying just compared to everything magically working thanks to SSH key authentication, but with built-in caching I believe it might only require doing so two-three times a day, which is an inconvenience which I believe all of us could live with. The issue is that then another talk about SSH tunnels emerged and here's where I hoped someone from the community who lives and breaths PCI DSS compliance might shed more light on this "requirement" as I have a feeling something might have been lost in the translation and maybe this is not a correct information.

Does PCI DSS 4.0 compliance prohibit any existence of SSH jumps and SSH tunnels respectively, given any such server would implement MFA for SSH?

Improve this question

1 Answer 1

Reset to default
0

I am not a PCI DSS 4.0 expert, however I havent found any thing in the specs that prohibit the use of a Bastion (or jump host).

I have found you can't mix them. (so a bastion for PCI DSS 4.0 compliant use, and another for other use)

In my opinion it would also be nuts to not allow bastion hosts... due to there additional security and auditing properties.

PCI DSS 4.0 Scoping-and-Segmentation

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .