Web and email on the same machine?

for ecommerce

[Tonearm]

I was told that due to PCI Compliance requirements I can't run an email server on the same machine as a web server if the web server is used for ecommerce credit card payments. Is that true?

[robzilla]

That's part of the Payment Card Industry Data Security Standards (PCI DSS) requirements, yes.

System configuration standards used for general provisioning, hardening, securing and locking-down of system components are to include the following procedures:
o Changing of all vendor-supplied defaults and elimination of unnecessary default accounts
o Implementing only one primary function per server to prevent functions that require different security levels from co-existing on the same server

[pcicompliance.stanford.edu...]

Always best to ask your auditor, of course.

[Tonearm]

Can I separate them into different VMs on the same machine?

[justpassing]

Can I separate them into different VMs on the same machine?

Always best to ask your auditor, of course.

[Essex_boy]

Thats a basic question, always keep them seperate

[robzilla]

Can I separate them into different VMs on the same machine?

Maybe, that's probably not uncommon.