I got ahold of someone at suse who said to get suse-made RPMs from the German SuSE Mirror: ftp.gwdg.de:/pub/linux/suse/6.4/i386.de/suse/sec1/ (please use a mirror of course :-) But they also said this: "The answer I got back from the tech folks is that it is NOT legal for you to install and use packages containing crypto, except for those that are licensed from RSA." I'm not sure about the "Licensed from RSA" part - I know you have to but certificates for SSl (or something like that ;-) But I _know_ I've seen it written on SuSE's site somewhere that the reason the US CDs don't have Crypto is because, it's the US co that handles international orders, and so they wouldn't be able to ship the "stock" US SuSE distro out of the US with Crypto in it. Personally I think that's totally crazy - if the German Co would handle the International orders, then both the US people and the internationals would be able to have crypto (the ONLY problem I know of is that it's not legal to ship crypto _out_ of the US - I don't think other Countries have a problem importing it - not many anyway). The way it's set up now, both the US customers and the international customers don't get crypto, for no other reason then because SuSE has the US Division handling International orders. Makes me shake my head - is there a lack of CD burners in Germany? :-) Since it's the US that has the silly laws I think it would make a lot more sense to have suse.de handle they international stuff. Maybe Germany has laws that are as screwy as the US, I dunno.. My response + $.02 At 01:26 PM 8/20/2000 -0400, you wrote:

On Fri, 18 Aug 2000, Jonathan Wilson wrote:

...

I'm needing a few things like ssh and mod_ssl for SuSE 6.4 - the things that are left out of the US version.

I understand that they can't be included with the CD due to _export_ laws, but it's ok for me to download them into the US, for use in the US -

right?

...

So my question is, where's the proper place to get them from? I Can't find them on ftp.suse.com.

(note: I'm looking specifically for the SuSE-made rpms, not just rpms in general

SSH and openssh are available in the US for Unix and Win machines from: ftp://ftp.cis.fed.gov/pub/ or ftp://metalab.unc.edu/pub/packages/security/ There are various tar.gz and rpm files there. Building ssh from the tarballs is extremely easy. There is a list of worldwide mirrors for ssh at: http://www.ssh.com/products/ssh/download.html There is a licence required for commercial use of ssh.

I don't understand why SuSE do not have (open)ssh on their US CD's as the program is freely downloadable in the US and I have to go to metalab and get it each time I install a new SuSE version. Maybe it's the licence and not the laws. SuSE guys??

I believe openssh, openssl, mod_ssl and ssh are all downloadable as SuSE rpms from: ftp://ftp.gwdg.de/pub/linux/suse/6.4/i386.de/suse/sec1/

Regards,

--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com