PHP Send email over SSH

Question

Hello

We have a website that emails the contents of a contact form to our client. We would like to change this to make it a bit more secure (sensitive data can be sent over the contact form), we have encrypted the page with an SSL certificate so the only weak link we have at the moment is the email.

We already have an SSH connection setup to our client's servers and I was wondering if anyone knows if it is possible to send an email (possibly with attachments) over that connection?

Our web server is a linux machine and we are able to install applications ourselves. The client's server is a unix server, however their email system is Microsoft Exchange.

We've discussed PGP and it is not an option for our client, they will not install it on their systems.

Thanks for any help.

Peter

Answer 1

If the client's server is configured so the "mail" command works you ought to be able to use that. And it is easy to test: ssh in and try it.

Otherwise, you probably want to go with smtp over SSL with encryption direct to their mail server.

Answer 2

To make my answer clearer I see three (3) systems here.

1. The webserver running the PHP script; later refered as the WebServer
2. The Unix server running on your client site; later refered to as the UnixServer
3. The Exchange server running on your client site; later refered to as the ExchangeServer

What you could do is use autossh to tunnel a connection from the WebServer through the UnixServer server with an endpoint at ExchangeServer. It is no end-to-end encrypton since you would not have an encrypted link from the UnixServer to the ExchangeServer it gets you closer to your goal.

Full documentation on autossh can be found here

The basic steps for the setup would be this:

A. Setup passwordless authentication from the WebServer to the UnixServer. You'll have to be carefull to protect the RSA key generated otherwise you've just opened a gaping hole on their system. Ideally run autossh under an unprivilege user and have the account used on the UnixServer to be unprivileged as well. Make sure you test the connection before you start using autossh

B. Setup your ssh options for keepalive (autossh is a fallback option). Make sure that the ~/.ssh/config file for the user launching autossh has these option setup:

TCPKeepAlive yes
ClientAliveInterval 60 
ServerAliveInterval 15 
ServerAliveCountMax 3

C. Setup autossh. Linux.com as an articile about it here and debianadmin.com as one here.

Answer 3

I'd be inclined to store the information securely on the server, and email a notification to the user who then can login and see this request (and all other recent ones?) in the web page.

You don't have to mess around with trying to make email secure and working with systems that aren't in your domain of expertise, you can secure your PHP app properly, and take advantage of security features already easily available in browsers.

Answer 4

ssh -L $LOCAL_LISTEN_PORT:$EXCHANGE_SERVER_IP:25 username@sshdserver

http://www.ssh.com/support/documentation/online/ssh/adminguide/32/Port_Forwarding.html