Freeside:1.7:Documentation:Administration:Encrypted Credit Cards

Setup

Q. Hey I can't use this, the credit cards are stored in plain text! What if I get hacked!?!

First off, if you are a small ISP and you follow Ivan's direction, you're pretty safe. You're keeping your DB behind the firewall and not using default passwords, etc. Right? Nothing is fool-proof however and putting layers of difficulty between your customer information and a hacker, disgruntled employee, etc. is generally a good idea. Note however that no matter how good the encryption is, you still need to secure your boxes and protect your data. A persistent hacker will be able to decrypt given enough time on your system. All good security policies apply here. If in doubt, find someone who can help you to secure your systems.

I've heard people in IRC and on the mailing list lament that Freeside doesn't encrypt the credit cards. It turns out that the functionality is there, but the guy who wrote it didn't document it outside of the perldoc. Since I'm that guy, and this seems to be the best place to do it, here goes.

The following steps are for Crypt::OpenSSL::RSA - Although there are hooks for other encryption engines, I'm using OpenSSL. I would also set up a 'dev' system to try this out on! There is nothing worse than encrypting credit cards and not having the correct key to decrypt them.

To Set Up Encrypted Credit Cards:

1. Make sure that you're running a version of freeside the supports it. (_ivan - When did this go mainstream?)
2. Make sure that Crypt::OpenSSL::RSA is compiled and working.
3. Verify Schema Changes
   1. freeside-upgrade doesn't appear to modify columns based on only changing the size
   2. payinfo fields used to be varchar(80), need to be 512
   3. If you don't modify this, you'll get DB errors when you try to insert payments, or card information
4. Generate the public and private keys. Here's the script - I'll add it to cvs...
   • NOTE: Create a new file named something like keygen.pl and add the following into the file:

#!/usr/bin/perl

use Crypt::OpenSSL::RSA;

$length = 2048;

$rsa = Crypt::OpenSSL::RSA->generate_key($length);

print "Public:\n". $rsa->get_public_key_string();

print "Private:\n". $rsa->get_private_key_string();

1. Once the file is created run it
   • "root@freeside# perl keygen.pl" and you should get your public and private keys as the output.
2. Open the freeside config screen (configuration->settings) and edit your configuration.
   • Set the module to Crypt::OpenSSL::RSA
   • Set encryption to on (check it)
   • Set the public and private keys
3. Save and restart the web server.

The next credit card you insert will be encrypted. Old data will remain decrypted until the credit card is updated. Yes that is broken, and yes I will fix it, and no I don't know when, but it will be soon - because you're not the only one with this problem.

Good luck!

- Huntsberg

Limitations

The following items don't yet work on a "front-end" machine without the private key. Eventually we could queue a job for these to be processed by a "back-end" machine.

• "Bill now" can't run card/echeck collections
• No "Process payment" link on customer view