Newbie Question on PGP installation on a server & email

[Delphiwhat]

hi folks

just lookin a bit of advice/ help as i know nothing about PGP at the moment but i'm gonna have to learn quick.

I have a website (on unix apache) and want to use PGP to encrypt a html form before sending to me in an email.

I need to really sort out a few things.

Firstly installation of a PGP script on th server? can this be done, can it be downloaded?

Secondly my form is to collect credit card details
(hence the reason for the encryption) is this the best way to do this?

sorry if this all seems confused - but some am i (at the minute)

thanks

jc

 

[AHinMaine]

Does the server where the form that is being filled out use ssl? If not, why bother, security is already nonexistent.

--
Andy

http://www.nachoz.com

 

[Delphiwhat]

Yes SSL is in place with a secure form!

 

[AHinMaine]

Ok, then yes, it needs to be installed on the server. I'd recommend GnuPG. pgp 6.5.8 is probably easier to use, but IIRC it has a non-commercial use license.

you can get gpg at

http://www.gnupg.org.

There is also a perl module, GnuPG::Interface for perl scripting with it, but you could probably get by with a shell script just fine. You don't need a passphrase to encrypt something, just for decrypting

Anyway, just set up your keys (

gpg --gen-key

) on the server. In this case, you'll want to su to the same username that the webserver uses (you may have to edit the web users shell or home dir to allow them to "log in" this way) and then create the keys. Install pgp or gpg on your workstation where you check your mail and set up your keys. Then extract your public key in ascii format (easy to cut and paste). Select it, copy it, go over to the server, do this command as the web server user:

cat | gpg --import

Hit Enter
:aste your key::
Hit Enter
Hit CTRL-D

Now, on the server you can encrypt files using your public key id. If you built your keys using user@example.com for your id on your workstation, you would do this:

gpg -a -r user@example.com --encrypt filename.foo

Then mail the contents of "filename.foo.asc" to yourself where you can decrypt it.

--
Andy

http://www.nachoz.com