Difference between revisions of "Freeside:2.1:Documentation:Administration:Encrypted Credit Cards"

From Freeside
Jump to: navigation, search
(New page: == Setup == <b>Q.</b> Hey I can't use this, the credit cards are stored in plain text! What if I get hacked!?! First off, if you are a small ISP and you follow Ivan's direction, you're ...)
 
(→‎Setup)
 
Line 1: Line 1:
 
== Setup ==
 
== Setup ==
  
−
<b>Q.</b> Hey I can't use this, the credit cards are stored in plain text!  What if I get hacked!?!
+
The following steps are for Crypt::OpenSSL::RSA.
−
 
 
−
First off, if you are a small ISP and you follow Ivan's direction, you're pretty safe.  You're keeping your DB behind the firewall and not using default passwords, etc.  Right?  Nothing is fool-proof however and putting layers of difficulty between your customer information and a hacker, disgruntled employee, etc. is generally a good idea.  Note however that no matter how good the encryption is, you still need to secure your boxes and protect your data.  A persistent hacker will be able to decrypt given enough time on your system.  All good security policies apply here.  If in doubt, find someone who can help you to secure your systems.
 
−
 
 
−
I've heard people in IRC and on the mailing list lament that Freeside doesn't encrypt the credit cards.  It turns out that the functionality is there, but the guy who wrote it didn't document it outside of the perldoc.  Since I'm that guy, and this seems to be the best place to do it, here goes.
 
−
 
 
−
The following steps are for Crypt::OpenSSL::RSA - Although there are hooks for other encryption engines, I'm using OpenSSL.  <b>I would also set up a 'dev' system to try this out on!</b>  There is nothing worse than encrypting credit cards and not having the correct key to decrypt them.
 
  
 
To Set Up Encrypted Credit Cards:
 
To Set Up Encrypted Credit Cards:
  
−
# Make sure that you're running a version of freeside the supports it. (_ivan - When did this go mainstream?)
 
 
# Make sure that Crypt::OpenSSL::RSA is compiled and working.
 
# Make sure that Crypt::OpenSSL::RSA is compiled and working.
−
# Verify Schema Changes
 
−
## freeside-upgrade doesn't appear to modify columns based on only changing the size
 
−
## payinfo fields used to be varchar(80), need to be 512
 
−
## If you don't modify this, you'll get DB errors when you try to insert payments, or card information
 
 
# Generate the public and private keys.  Here's the script - I'll add it to cvs...
 
# Generate the public and private keys.  Here's the script - I'll add it to cvs...
 
#*NOTE: Create a new file named something like keygen.pl and add the following into the file:
 
#*NOTE: Create a new file named something like keygen.pl and add the following into the file:
Line 42: Line 31:
 
# Save and restart the web server.
 
# Save and restart the web server.
  
−
The next credit card you insert will be encrypted.  Old data will remain decrypted until the credit card is updated.  Yes that is broken, and yes I will fix it, and no I don't know when, but it will be soon - because you're not the only one with this problem.
+
The next credit card you insert will be encrypted.  Old data will remain decrypted until the credit card is updated (unless replacement is scripted).
−
 
 
−
Good luck!
 
−
 
 
−
- [[User:Huntsberg|Huntsberg]]
 
  
 
== Limitations ==
 
== Limitations ==

Latest revision as of 13:48, 10 January 2011

Setup

The following steps are for Crypt::OpenSSL::RSA.

To Set Up Encrypted Credit Cards:

  1. Make sure that Crypt::OpenSSL::RSA is compiled and working.
  2. Generate the public and private keys. Here's the script - I'll add it to cvs...
    • NOTE: Create a new file named something like keygen.pl and add the following into the file:
#!/usr/bin/perl

use Crypt::OpenSSL::RSA;

$length = 2048;

$rsa = Crypt::OpenSSL::RSA->generate_key($length);

print "Public:\n". $rsa->get_public_key_string();

print "Private:\n". $rsa->get_private_key_string();
  1. Once the file is created run it
    • "root@freeside# perl keygen.pl" and you should get your public and private keys as the output.
  2. Open the freeside config screen (configuration->settings) and edit your configuration.
    • Set the module to Crypt::OpenSSL::RSA
    • Set encryption to on (check it)
    • Set the public and private keys
  3. Save and restart the web server.

The next credit card you insert will be encrypted. Old data will remain decrypted until the credit card is updated (unless replacement is scripted).

Limitations

The following items don't yet work on a "front-end" machine without the private key. Eventually we could queue a job for these to be processed by a "back-end" machine.

  • "Bill now" can't run card/echeck collections
  • No "Process payment" link on customer view
Retrieved from "http://www.freeside.biz/mediawiki/index.php?title=Freeside:2.1:Documentation:Administration:Encrypted_Credit_Cards&oldid=6235"