Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-28 Thread Karanbir Singh
Hi Arun, On 05/26/2012 04:06 PM, Arun Khan wrote: I have submitted my proposal to the client and I am sure I will discover a lot more if the proposal is accepted and I begin the implementation. What are the chances that you might consider adding to the CentOS wiki on the PCI/DSS issues and

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-28 Thread Arun Khan
On Sun, May 27, 2012 at 11:25 PM, Eero Volotinen eero.voloti...@iki.fi wrote: ... snip .. Just remember that PCI DSS is not self service process, you usually need to use PCI QSA (Qualified Security Assessor) to complete your PCI process. Yes, indeed. I am very well aware of it. In the OP

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-28 Thread Kwan Lowe
Rui: On Sat, May 26, 2012 at 3:36 AM, Rui Miguel Silva Seabra r...@1407.orgwrote: On Fri, 25 May 2012 22:52:13 +0530 Arun Khan knu...@gmail.com wrote: I have a client project to implement PCI/DSS compliance. Some advice from my practical professional knowledge... Excellent post...

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-28 Thread Arun Khan
Hi Karanbir, On Mon, May 28, 2012 at 8:46 PM, Karanbir Singh mail-li...@karan.org wrote: Hi Arun, On 05/26/2012 04:06 PM, Arun Khan wrote: I have submitted my proposal to the client and I am sure I will discover a lot more if the proposal is accepted and I begin the implementation. What

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-27 Thread Eero Volotinen
2012/5/26 Arun Khan knu...@gmail.com: Thanks to all who responded to my query.   Collectively, you raised my awareness PCI/DSS, related tool sets and such. I have submitted my proposal to the client and I am sure I will discover a lot more if the proposal is accepted and I begin the

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-26 Thread Rui Miguel Silva Seabra
On Fri, 25 May 2012 22:52:13 +0530 Arun Khan knu...@gmail.com wrote: I have a client project to implement PCI/DSS compliance. Some advice from my practical professional knowledge... The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-26 Thread Rui Miguel Silva Seabra
On Fri, 25 May 2012 13:47:12 -0400 m.r...@5-cent.us wrote: Arun Khan wrote: I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to be on different systems. In addition the

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-26 Thread Arun Khan
Thanks to all who responded to my query. Collectively, you raised my awareness PCI/DSS, related tool sets and such. I have submitted my proposal to the client and I am sure I will discover a lot more if the proposal is accepted and I begin the implementation. @ Rui Miguel Silva Seabra -

[CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Arun Khan
I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to be on different systems. In addition the auditor has also stipulated that there be a NTP server, a patch server, The Host OS on

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread m . roth
Arun Khan wrote: I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to be on different systems. In addition the auditor has also stipulated that there be a NTP server, a patch

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Ken godee
wow, seems like quite a lot. What level of PCI/DSS compliance are you going for? The only other thing I might add Are you hosting the hardware? If it's hosted else where then the facility that's hosting the hardware needs to be PCI/DSS complaint. On 5/25/2012 10:22 AM, Arun Khan wrote: I

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread m . roth
Ken godee wrote: wow, seems like quite a lot. Heh. When I was working for the company, I had a guy who sat in easy earshot who was one of their folks who dealt with questions from companies and businesses. The *easiest* one, the lowest level, was 60 or 63 questions. The serious, highest one was

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Eero Volotinen
2012/5/25 Arun Khan knu...@gmail.com: I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to be on different systems. requirement one primary function per server. In addition the

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Arun Khan
On Fri, May 25, 2012 at 11:27 PM, Ken godee k...@perfect-image.com wrote: wow, seems like quite a lot. What level of PCI/DSS compliance are you going for? I have to check this with the client. Credit card information will be encrypted and stored in client's own db. The only other thing I

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Arun Khan
Hi Eero, On Sat, May 26, 2012 at 1:12 AM, Eero Volotinen eero.voloti...@iki.fi wrote: 2012/5/25 Arun Khan knu...@gmail.com: I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application middleware (tomcat), the db server have to

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Eero Volotinen
2012/5/26 Arun Khan knu...@gmail.com: Hi Eero, On Sat, May 26, 2012 at 1:12 AM, Eero Volotinen eero.voloti...@iki.fi wrote: 2012/5/25 Arun Khan knu...@gmail.com: I have a client project to implement PCI/DSS compliance. The PCI/DSS auditor has stipulated that the web server, application

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Ken godee
What level of PCI/DSS compliance are you going for? I have to check this with the client. Credit card information will be encrypted and stored in client's own db. Yup, this is exactly what they don't want people to do and I believe in the future they'll strive for just a handful of

Re: [CentOS] PCI/DSS compliance on CentOS

2012-05-25 Thread Eero Volotinen
2012/5/26 Ken godee k...@perfect-image.com: What level of PCI/DSS compliance are you going for? I have to check this with the client.   Credit card information will be encrypted and stored in client's own db. Yup, this is exactly what they don't want people to do and I believe in the future