PGP

Anon

Hi, me again.

I'm trying to encrypt a string using PHP - can anyone tell me why:

<?php

function encryptccdetails($msg)
{
//set the environment variable for PGPPATH
putenv("PGPPATH=/home/ambitire/.pgp");

//generate token for unique filenames
$tmpToken = md5(uniqid(rand()));

//create vars to hold paths and filenames
$plainTxt = "/home/ambitire/reservationsnetwork_html/respix/" . "$tmpToken" . "data";
$crypted = "/home/ambitire/reservationsnetwork_html/respix/" . "$tmpToken" . "pgpdata";

//open file and dump in plaintext contents
$fp = fopen($plainTxt, "w+");
fputs($fp, $msg);
fclose($fp);

//invoke PGP to encrypt file contents
//system("/usr/local/bin/pgpe -r 'Julie Meloni <julie@thickbook.com>' -o $crypted -a $plainTxt");
system("/usr/local/bin/pgpe -r 'Reservations Network <info@reservationsnetwork.ie>' -o $crypted -a $plainTxt");

//open file and read encrypted contents into var
$fd = fopen($crypted, "r");
$mail_cont = fread($fd, filesize($crypted));
fclose($fd);

//delete files!
unlink($plainTxt);
unlink($crypted);

echo $mail_cont;
return $mail_cont;

}
?>

<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body bgcolor="#FFFFFF">
<?php

//$plainTxt = "/home/ambitire/reservationsnetwork_html/respix/" . "$tmpToken" . "data";
//$crypted = "/home/ambitire/reservationsnetwork_html/respix/" . "$tmpToken" . "pgpdata";

$message=encryptccdetails('trythis');

?>
<table width="100%" border="0">
<tr>
<td>did this work?</td>
<td><?php echo $message?></td>
</tr>
</table>
</body>

gives the errors:

Warning: fopen("/home/ambitire/reservationsnetwork_html/respix/pgpdata","r") - No such file or directory in /usr/local/apache/secure/ambitire/public_html/resnet/enc.php3 on line 25

Warning: Supplied argument is not a valid File-Handle resource in /usr/local/apache/secure/ambitire/public_html/resnet/enc.php3 on line 26

Warning: Supplied argument is not a valid File-Handle resource in /usr/local/apache/secure/ambitire/public_html/resnet/enc.php3 on line 27

Warning: Unlink failed (No such file or directory) in /usr/local/apache/secure/ambitire/public_html/resnet/enc.php3 on line 31

I think it's the path. The path I give is on the non-secure server and the script is runnign on a secure server. However the ISP doesn't think it is - so I'm stuck!

Regards and thanx!

Elizabeth

robertjackson

Hi Elizabeth,

PGPPATH has always given me problems. So you might be right.

A couple of questions:

Can you run the encryption from the shell? I've found that usually helps.

Also, the first warning (the line 25 one) says the file /path/to/pgpdata doesn't exist. Shouldn't the file be named something like /path/to/valueOfTmpToken.pgpdata? Perhaps echoing $tmpToken might help debug.

Can you also check using the shell that the plaintext file is being created with the name you specify (with the $tmpToken).

One other point, you might want to use a folder above your document_root to store the temporary file. (You can also use pipes or popen instead of a temporary file - search phpbuilder for pipes and PGP).

Let us know what the problem was.

Good luck.

Rob

Anon

Thanks for your message

Can you tell me how I might use the shell instead? If that's better then I'd be glad to do so, especially if you've had problems yourself!

Meanwhile I try the path too.

Regards

Elizabeth

robertjackson

Hi Elizabeth,

By using the shell, I was suggesting that you telnet into your server (the username and password that you use for ftp might allow you to do this - you'll have to check with your ISP since not all hosting packages allow shell/telnet access).

Once you log in, you should be able to list your files ('ls' is the command) and change directories ('cd ..' to go up one; 'cd directory_name' to move down one level). This will allow you to see what files are being written (i.e. your plainTxt file before encryption and the cryptedTxt file after encryption - comment out your unlink command for this debugging).

In your code (first post of this thread), you have the line:
system("/usr/local/bin/pgpe -r 'Reservations Network <info@reservationsnetwork.ie>' -o $crypted -a $plainTxt");.
Try running the stuff between the double quotes from your shell and see if it works.

Also from the shell, you can get help about pgp by typing something like:
/usr/local/bin/pgp -h
or perhaps
/usr/local/bin/pgpe -h

You can also try listing the keys in your keyring. The above help listings might tell you the option for that. Or try
/usr/local/bin/pgpk -h.

Hope this helps. Let us know.

Rob

Anon

Thanks, I was just misunderstanding something there.

I do have telnet access (actually it's SSH), but only to the unsecure server.

So whilst the above would surely work that way, it doesn't work when I run it from the secure server.

I'm really getting stuck here!

It's basically the file create command that is giving the error.

Is there any way of using PGP without opening a file? Such as doing everything in variables? That would probably work.

Regards

Elizabeth

robertjackson

Hi Elizabeth,

When you say the file create command is giving the error, are you referring to the creation of the plain text file?

Is so, try searching phpbuilder for a thread about pgp, pipes and popen. That should allow you to pass a variable to pgp without the plain text file.

Rob

Anon

Yes, I took a look already and I found this:

$msg="Text to encrypt";
$pp = popen("/opt/PGP/pgp -eaf $userID -o myfile.output", w);
fputs($pp, $msg,strlen($msg));
pclose($pp);

$fp = fopen("myfile.output", r);
while (!feof ($fp)) {
$msg_crypted .= fgets($fp, 512);
}
fclose($fp);

which I thought looked great because it used a variable for the text to be encrypted and it seems to be more simple (well it's shorter anyway!)

However, it seemed to need to create a file for the crypted result, and this had me stuck again (with the same problem - being unable to create the file)

I'm very new with PGP (you can probably tell that!) is there a way of producing a variable back from it, instead of a file?

Regards

Elizabeth

Anon

Hi again

It looks like the problem was on the ISP server which doesn't seem to want to work with a php3 file, but works with a cgi file.

So, now I've got to write the thing as a cgi file and include it to get the result back to my php3 file.

Thanks for all your help. I'm hoping this will now work, although I have a few more bits to do on it!

Regards

Elizabeth

robertjackson

Just to follow-up, this same solution appeared today at:
http://www.phpbuilder.com/forum/read.php3?num=1&id=125232&thread=107712

I you can't use PHP, I have some rather inelegant Perl code that works should you need something to get you going in that direction.

Rob

robertjackson

Hi,

I've also been looking for a way to trap the output of PGP into a PHP variable (without the file). However, I haven't found a way to do it.

Rob

Anon

Dear Rob

It looks like Paul had the same problem as me! - and there was me complaining to the ISP!!

I think I'll try the cgi route if I can, although the ISP seems to have a problem with the cgi file on the secure server, which I'm asking them about.

thanks for your help. I will be back in distress for the perl solution if I cant do the cgi one!

Regards

Elizabeth