RE: want to allow easy home access to iSeries

[Steve Martinson <smartinson66@xxxxxxxxx>]

Luke,

I just wanted to throw in here that if your environment is subject to the
PCI DSS, remote access to the CDE (cardholder data environment) MUST be via
two-factor authentication.  This is the case for any non-CDE subnet that
access the "in-scope" subnets, thus implying that two-factor is needed
internally as well, not just from the outside world (Internet-routable
networks).

Paul's suggestion of a certificate for RDP sessions is a good one, as long
as it's not the same certificate for every user.  They have to be unique.
 Oh, and having to enter two different passwords along the way does not
count as two-factor.