<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I'm still trying to sort out how systems are supposed to do IP authorizations over SSL with the way some of the standards are worded (such as 1.3.5 requiring outbound traffic to <span class="Apple-style-span" style="font-family: Arial; font-size: 9px; "><font class="Apple-style-span" face="Helvetica" size="3">only access IP addresses within the DMZ.) As for using a proxy, I've heard some interpretation that ANY system that touches the cardholder data environment then falls under PCI scope, meaning that *it* wouldn't be able to access the internet directly, either. PCI is a big mess, and while the vagaries make it so that you aren't too restricted, it also leaves a lot of holes for interpretation.</font></span><div><span class="Apple-style-span" style="font-family: Arial; font-size: 9px; "><font class="Apple-style-span" face="Helvetica" size="3"></font></span><br><div>That being said, is a local satellite server in your budget? We've decided to get one here locally for other reasons (my PCI systems are still Solaris at the moment), but I see having a local Sat. system as being one more plus in keeping traffic outside to a minimum.</div><div><br></div><div>jef<br><div><div><div><div><div><br></div><div><br><div><div>On Nov 21, 2008, at 7:05 AM, Andy Loughran wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>Guys,<br><br>I have a a cluster of 3 Servers.. two are CentOS, and one is RHEL5 ( the<br>DB server). Due to PCI regulations the DB server cannot have any direct<br>access to the internet (inbound, or outbound).<br><br>Do you think the best practice would be to run a reverse-proxy from the<br>firewall CentOS machine to the rhn update servers, then connect the DB<br>to that.. or do RHEL have a more sophisticated method. (As I doubt I'm<br>the only one person running a PCI compliant RHEL5 server).<br><br>Looking forward to responses.<br><br>Regards,<br><br>Andy<br><br></div></blockquote></div><br></div></div></div></div></div></div></div></body></html>