Difference between revisions of "Freeside:1.7:Documentation:Administration:Encrypted Credit Cards"

Revision as of 05:50, 24 August 2006

Q. Hey I can't use this, the credit cards are stored in plain text! What if I get hacked!?!

First off, if you are a small ISP and you follow Ivan's direction, you're pretty safe. You're keeping your DB behind the firewall and not using default passwords, etc. Right? Nothing is fool-proof however and putting layers of difficulty between your customer information and a hacker, disgruntled employee, etc. is generally a good idea. Note however that no matter how good the encryption is, you still need to secure your boxes and protect your data. A persistant hacker will be able to decrypt given enough time on your system. All good security policies apply here. If in doubt, find someone who can help you to secure your systems.

I've heard people in IRC and on the mailing list lament that Freeside doesn't encrypt the credit cards. It turns out that the functionality is there, but the guy who wrote it didn't document it outside of the perldoc. Since I'm that guy, and this seems to be the best place to do it, here goes.

The following steps are for Crypt::OpenSSL::RSA - Although there are hooks for other encryption engines, I'm using OpenSSL. I would also set up a 'dev' system to try this out on! There is nothing worse than encrypting credit cards and not having the correct key to decrypt them.

To Set Up Encrypted Credit Cards:

1. Make sure that you're running a version of freeside the supports it. (_ivan - When did this go mainstream?)
2. Make sure that Crypt::OpenSSL::RSA is compiled anbd working.
3. Generate the public and private keys.

      use Crypt::OpenSSL::RSA;
      $length = 2048;
      $rsa = Crypt::OpenSSL::RSA->generate_key($length);
      print "Public:\n $rsa->get_private_key_string();
      print "Private:\n $rsa->get_public_key_string();

1. Open the config screen and edit your configuration.
   • Set the module to Crypt::OpenSSL::RSA
   • Set encryption to on (check it)
   • Set the public and private keys
2. Save and restart the web server - just in case.

The next credit card you insert will be encrypted. Old data will remain decrypted until the credit card is updated. Yes that is broken, and yes I will fix it, and no I don't know when, but it will be soon - because you're not the only one with this problem.

Good luck!

- Huntsberg