SUMMARY: Secure way to do GPG signing on server?

["David U." <davidu@everydns.net>]

Well I've already gotten a bunch of responses and a couple solutions.

Here's a couple of comments:
"Signing on the server?  Insecure as hell." -Don
"Switch email clients" -Alton

And then Joe Rice told me about Anubis: http://anubis.sourceforge.net/

"Anubis is an outgoing mail processor. Anubis can edit outgoing mail
headers, encrypt and/or sign mail with the GNU Privacy Guard, build secure
SMTP tunnels (Simple Mail Transport Protocol) using the TLS/SSL encryption
even if your mail user agent doesn't support it."

In short:
it is a mail proxy much like an ofmipd and can run a .anubisrc as the user
who authenticates.  This will work for real users who have shells and allow
them to securely keep their gpg key private and still sign on the fly.

Don's comments were correct however, Signing on the server is sub-optimal
and the reason I wish to do it is because I use IMAP for my mail and check
via ssh, outlook express, webmail, etc and I would like one unified way to
sign messages.

Thanks,
davidu

David U. wrote:
> Hi,
>
> I was wondering if there is a known way or idea of how to accomplish
> remote gpg signing of emails in a pretty secure fashion.
>
> Essentially I would like to be able to sign email when using outlook
> express and for various reasons gpgoe (the plugin) is not an option.
>
> Does anyone know of a decent way to sign email on send before they
> hit the SMTP level of my mail server?
>
> I am using qmail and the machine is "relatively" private in the sense
> that only admins have shell.
>
> Any ideas? (Is it just too insecure to even try?)
>
> Thanks,
> David U.
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers@linuxmanagers.org
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers