PCI Compliance- Two Factor Authentication (2FA) for remote administrators

[rbngan]

dmorris. So Untangle's official opinion is that our network setup is not required to have 2FA (or the 2FA PCI requirement does not apply) and I can continue to access from any remote internet system via single factor HTTPS authentication to my UT server which has access and control over my internal network which processes Cardholder data processing? That makes it easy and can continue to manage this remotely. Thanks

[jcoehoorn]

Umm... I don't think that's what anyone said. We said, "Revert to defaults so that remote administration is turned off and install OpenVPN."

[glock918]

I am happy with the way we do it. We use captive portal. So first I have to VPN (we use openvpn) in, then input a user name/pw for captive portal, THEN https into UT.

Hope this helps.

FYI, on the captive portal, on the pass list I have the static IP of all devices that are not mobile devices. Like thin clients, servers, switches, printers, cameras.

[jcoehoorn]

In that case, access to a machine with one of the passed IPs would count for the second factor.