Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

From PCI-DSS point of view, are using SSH keys for passwordless authentication secure enough?

TIA, Vitaly

share|improve this question
add comment

1 Answer 1

If your ssh service is open to the Internet, then you need two-factor authentication (8.3). This requirement applies to any account with access to any system on which cardholder data is present (except for accounts which only process transactions and only have access to the data they're processing at that time). You should also have two-factor authentication on your internal network (8.2).

The ssh key counts only as one factor, (something you know) even if it has its own passphrase.

This requirement will be missed by an external scan since it can't be tested for. But auditors who visit you on-site should look for it.

share|improve this answer
    
Michael, many thanks! –  Vitaly Jul 9 '13 at 12:05
    
Michael, many thanks! >then you need two-factor authentication (8.3). This requirement >applies to any account with access to any system on which >cardholder data is present (except for accounts which only process >transactions and only have access to the data they're processing >at that time). You should also have two-factor authentication on >your internal network (8. No, ssh isn't open to internet. Does it mean that for all servers except where cardholder data is present I can use either password or keys? And 2-factors auth for the cardholder server? –  Vitaly Jul 9 '13 at 12:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.