[ILUG] Re: SSL installation...

[adam beecher]

> You're server is in the states though.  So a state side person would
> have to do the installation etc.
>
You sure Sean? I would have thought it was the owner of the software and
location of the server that were the issues. Raven tell me, "You will need
to base it off of where your server is placed. Because it is in the United
States export restrictions will apply to you." However, Stronghold say, "As
a non US-citizen you can buy Stronghold from us at C2Net Europe and import
it for installation in the USA." And then they go on to say, "This however
makes it difficult for us to offer full technical-support. Our US office
cannot offer support to a non US citizen and we you will not be able to
request support from our European office for a server located in the US. You
will also not be able to re-export the software at any time." Lovely huh?
Then again, support doesn't bother me, I want to use mod_ssl anyway.

So one says it's citizenship, the other says it's where the machine is
located. You'd think of all people, *they* would know. Stronghold suggested
that I get an agent in the U.S. do do the job for me, but I'm not a very
trusting person, nor am I a very rich person. My partner works out of
Washington (I think he's a resident), but he's not "up" on the
administration side of things, so that's not an option. Bugger anyway!

ROCK => me <= HARD PLACE

> Going from 40/128 bit is ok (in the configs somewhere), Need to let
> user decide on encryption level.  Guessing where the user is from isn't
> worth it as its too hard, (a .com could be from anywhere).  Completely
> secure - put it on seperate machine, turn off everything save the server
> and ssh for access.
>
I was probably a little unclear on that, I just didn't want to get into
another of my LARGE emails (like this one) and have people get in a huff
about it. I just need to set up a catch-all secure domain (a la Vservers
safeserver.com) for my client sites and a fairly hefty shopping site I'm
launching early next year. I guess I was overstating the "completely" bit -
I just need the server to be secure, with no holes, and no
Johnny-come-lately wandering around with my shadow password file on a floppy
and my directory structure in his head.

However, there are so many configurable options, all it did was confuse me -
ideally I'd just like a box with a switch and a red light on it -> SSL
On/Off. :) I realise that 40 bit isn't 100% secure, but I reckon it's secure
enough. As to letting the users decide, well, they have enough decisions to
make as it is. I'm not an expert though, so I suppose I should just shut up
now. Oh, and getting a second machine is a no-go - this one's costing me
enough as it is!

> I'd take it, but the export laws of the states deny me.
>
Yes, but DO THEY? And what about the relaxation of the laws that everybody's
either bitching or applauding about at the moment? Anyway, if you change
your mind, or if you find out any more information, please let me know on
adam at iewebs.com. Confidentiality expected and assured. :)

Thanks for your reply,
adam


__________________________________________

adam beecher - CEO & Core Geek - ieWebs
.plan
workmail ... adam at iewebs.com
workweb ... http://ieWebs.com
phone ... 353 86 2529887
fax ... 353 86 8544767
snail ... Box 81, Eglinton St, Cork, IRELAND
__________________________________________