I am curious to know if we require separate update server in our cloud based PCI environment. In our current setup webserver, appserver, dbserver, logserver, and jump server are independent instance. I am not sure if we can directly update (packages) of these Centos Linux servers from yum or we need local update server(Spacewalk) which sync from outside software repos and then sync packages internally.


PCI requires, among other things, separation of production and test environments; change controls; and patch management/rollout policies. Patch your test environment first, and place the patch(es)/updates into production in accordance with your shop's change control and patch management policies. Document everything including the URLs or IP addresses at which you obtained your update packages.

  • So patching can took place directly from internet, no need to maintain local update server in PCI environment – Vishesh May 5 '14 at 8:06
  • PCI-DSS doesn't appear to have any specific requirement on this point. – user35648 May 5 '14 at 8:10

Your servers should not be connecting directly to the internet so it would be much better to have a local yum repository such as Spacewalk for your CentOS systems. There are some systems I don't see in your list above you may want to consider: user authentication server (LDAP), NTP server, internal vulnerability scanning server, file integrity monitoring server.

You could have a DMZ with you web server, an internal network with your application and database servers, a jump server environment and a supporting infrastructure environment. Your Spacewalk server can be used to manage updates for all systems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.