gpg-remailer

gpg-remailer._CurVers_.tar.gz

_CurYrs_

gpg-remailer(1)

gpg-remailer(1)

gpg-remailer._CurVers_.tar.gz gpg-remailer - reencrypt PGP/GPG maill

_CurYrs_

NAME

gpg-remailer - forward re-encrypted/signed PGP/GPG encrypted/signed mail to a group

SYNOPSIS

gpg-remailer [OPTIONS]

DESCRIPTION

Gpg-remailer decrypts received PGP/GPG messages, verifies the received signature, and re-encrypts the e-mail for a well defined group of recipients.

Using gpg-remailer the list of members of a group of people who want to exchange encrypted and authenticated e-mails can be maintained at one location, allowing the members of the group to specify just one e-mail address to send PGP/GPG signed and encrypted e-mail to.

Gpg-remailer reads incoming e-mail from its standard input stream and sends the processed input as a signed and encrypted PGP/GPG e-mail, encrypted for every member of the group, to one or more e-mail addresses. The address the signed and encrypted mail is sent to could, e.g., be a mailing list address.

A configuration file as well as command line options can be used to fine-tune gpg-remailer's behavior.

RETURN VALUE

Gpg-remailer always returns 0 to the operating system to prevent unknown mailer error messages in the MTA's logs. However, when gpg-remailer ends prematurely an error message is written to the standard error stream.

REQUIREMENTS

In order to use gpg-remailer the following requirements must be met (all commands should be issued by the root user):

THE PSEUDO USER'S PGP KEY RINGS

Some additional suggestions:

OPTIONS

If available, single letter options are listed between parentheses following their associated long-option variants. Single letter options require arguments if their associated long options require arguments as well.

CONFGURATION FILE

The default configuration file is ~/etc/gpg-remailer.rc under the pseudo user's home directory. Its path may be altered using a program option.

Empty lines are ignored. Information at and beyond #-characters is interpreted as comment and is ignored as well.

All directives in the configuration file obey the pattern 


    directive: value

A line may at most contain one directive, but white space (including comment at the end of the line) is OK. Several directives may be specified multiple times; otherwise the first occurrence of a directive is used. All directives are interpreted case insensitively, but their values are used as specified. E.g., DeBUG: true is as good as debug: true, but debug: TRUE is not recognized. Non-empty lines not starting with a recognized directive are silently ignored.

The following directives are supported (default values are shown between parentheses; when none is specified there is no default). When equivalent command line options are used then they overrule the configuration file specifications.

)

FORMATS

Although using PGP/GPG in e-mail is established technology, various formats of the e-mail are possible. Currently gpg-remailer recognizes the following formats:

Below a description is given of the actual contents of PGP encrypted en decrypted files.

All PGP encrypted e-mail shows the following headers (the boundary values will differ over different e-mail messages): 


Content-Type: multipart/encrypted; protocol="application/pgp-encrypted";
        boundary="+QahgC5+KEYLbs62"
Content-Disposition: inline
All PGP encrypted e-mail shows the following organization (the lines are used to separate the e-mail organization from the text of this man-page and are not actually present in the e-mail or in the decrypted information; empty lines, where shown, are required): 

----------------------------------------------------------------------
    mail headers

--+QahgC5+KEYLbs62
Content-Type: application/pgp-encrypted
Content-Disposition: attachment

Version: 1

--+QahgC5+KEYLbs62
Content-Type: application/octet-stream
Content-Disposition: inline; filename="msg.asc"

-----BEGIN PGP MESSAGE-----
...
-----END PGP MESSAGE-----

--+QahgC5+KEYLbs62--
----------------------------------------------------------------------
Note that boundaries consist of

The various PGP encrypted e-mail formats differ in the way they organize the decrypted information.

Simple Encrypted Messages.

During decryption the signature is verified, and the result of the verification is written to the standard error stream. The decrypted message itself contains but one message, organized as follows: 


----------------------------------------------------------------------
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

decrypted text of the message
----------------------------------------------------------------------

Multi-part Encrypted Messages.

During decryption the signature is verified, and the result of the verification is written to the standard error stream. The decrypted message itself contains multiple messages, organized as follows: 


----------------------------------------------------------------------
Content-Type: multipart/mixed; boundary="f+W+jCU1fRNres8c"
Content-Disposition: inline

--f+W+jCU1fRNres8c
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Text of the first attachment

--f+W+jCU1fRNres8c
Content-Type: application/pdf
Content-Disposition: attachment; filename="attachment.pdf"
Content-Transfer-Encoding: base64

text of the attachment.pdf in base64 encoding

--f+W+jCU1fRNres8c--
----------------------------------------------------------------------
Multiple attachments might follow in the same way.

Encrypted Messages Containing Detached Signatures.

During decryption the signature is not verified (but the recipient(s) is (are) shown) and the decrypted file is organized as follows: 


----------------------------------------------------------------------
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature";
        boundary="=-TNwuMvq+TfajHhvqBuO7"

--=-TNwuMvq+TfajHhvqBuO7
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Text of the message

--=-TNwuMvq+TfajHhvqBuO7
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
... signature text
-----END PGP SIGNATURE-----

--=-TNwuMvq+TfajHhvqBuO7--
----------------------------------------------------------------------
The last part represents the detached signature, The contents section must be separated from the decrypted file (named, e.g., decrypted) (creating, e.g., the file contents). That latter file's signature may then be verified using the command 

    gpg --verify decrypted contents
resulting in the signature verification written to the standard error (as usual). The contents start immediately following the first boundary, and continues up to, but not including, the new line just before the next boundary. )

FILES

Default locations are shown. Configuration options may change these locations.

SEE ALSO

addgroup(1), adduser(1), chmod(1), chown(1), gpg(1), sudo(1),

BUGS

None reported

AUTHOR

Frank B. Brokken (f.b.brokken@rug.nl).