August 2008 - Freeradius-Users - lists.freeradius.org

FW: [RTX] POPS in Brasil
by José Soler 29 Aug '08

29 Aug '08

Stig, Jonathan, Have you moved on this one? Regards, jose From: José Soler Sent: 28 August 2008 11:14 To: 'Stig Skaugvoll' Cc: Claus Futtrup; Jonathan Schutte Subject: FW: [RTX] POPS in Brasil Stig, Can you take AP1 below and contact T-Systems /DTAG? RTX needs this information asap since it will determine what is the best location to install the core of the system. Thanks, jose From: José Soler Sent: 27 August 2008 17:18 To: 'jsr(a)rtx.com'; 'dvi(a)rtx.com'; 'mbd(a)rtx.com'; 'cto(a)rtx.com'; Claus Futtrup; 'Stig Skaugvoll'; Jonathan Schutte Cc: 'elias(a)emlacie.com.br' Subject: [RTX] Minutes technical meeting 270808- GoIPInt premises Participants: - RTX: Dalia Vitkauskaite, Morten Bundgaard, Carsten Toft, (Jørgen S Rosenkilde). (Elias + Palle in conference) - GoIPInt: Claus Futtrup, José Soler, (Peter Futtrup, Jonathan Schutte, Stig Skaugvoll) Action points and responsible company (RTX / GoIP) person listed (initials) below. è GoIPInt to request DT availability and location of POP (for international termination) in Brasil and forward to RTX (AP1: js/cf). è Number Portability issues: RTX to provide to GoIPInt information regarding regulative conditions in Brasil and inter operator procedures for number portability .(AP2:Elias) è Collect Call: RTX to provide GoIPInt information of how the Collect Call service is implemented in Maraba for the Nortelpa/Midas solution. (AP3: Elias). Additionally, GoIPInt to provide RTX with details of necessary conditions/requirements to implement service in GoIPInt platform (AP4: js/cf) è Billing: RTX to provide deeper details of interface with Servcom billing system.(AP5: Elias). Additionally GoIP to send details/example of feeds from GoIPInt rating system towards a likely Billing system. (AP6: cf). è Test setup (Anatel's): GoIP to provide feedback by 28th August regarding possibility of server purchase in Dk, preconfiguration and shipping to Brasil (Canaa) together with travelling person and proforma bill (for customs) (AP7: ss/jsc). è RTX to send to GoIPInt details of HTTP-based interface for customer creation in HLR (AP8: dvi). è Other services where mentioned in call with Elias (i.e. calling card like top-up functionality). A complete description of the features desired in the system needs to be settled-agreed as base for discussion and to realistically estimate implementation costs and schedules. GoIPInt to present a complete functionality / features description of the system (AP9: ss/ jsc). RTX to provide a complete description of desired functionality: call-related, administration operation related, customer access related, etc. (AP10: cto) è GoIP to confirm available voice codecs in DEC bases. GoIP platform can work with the following unlicensed ones: G711, G726, GSM, iLBC, Speex, and the following licensed ones: G723, G729.(AP11:dvi) è It was confirmed after discussion that local gateway redundancy will NOT be part of the solution if it is not a legal/regulative requirement. Alternative centralized redundant solutions might be considered. RTX to confirm this. (AP12: elias/cto) è RTX and GoIPInt to perform further tests on signaling for different cases during week 36. (AP13: cf/dvi/mbd) No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.9/1636 - Release Date: 26/08/2008 19:09 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.10/1638 - Release Date: 27/08/2008 19:06 No virus found in this outgoing message. Checked by AVG. Version: 7.5.524 / Virus Database: 270.6.12/1640 - Release Date: 28/08/2008 18:58

1 0

Hafiz Pussah recommends FastWeb to find scholarship money
by hafizpus＠yahoo.com 29 Aug '08

29 Aug '08

Hey! Hafiz Pussah knows you?re looking for money for college and wants you to find it on FastWeb. What can you get from becoming a member of FastWeb? ? Find scholarships just for you ? Search for colleges ? Get financial aid advice ? Locate internship and part-time job opportunities FastWeb has a ton of other great tools. And the best part? It?s all free. Visit FastWeb to find cash for college today! http://www.fastweb.com/ib/vmremuinew-1f/DWGTXBLGMJ4O -- FastWeb respects your online time and privacy. If you do not wish to receive future emailed opportunities to join FastWeb, simply click on the following link to let us know: http://www.fastweb.com/o3/vmremuinew/FREERADIUS%2dUSERS%40LISTS%2eFREERADIU… Copyright 2008 FastWeb, LLC All rights reserved. FastWeb, LLC, 444 N. Michigan Avenue, Suite 3000, Chicago, IL 60611

1 0

Fwd: MSCHAP module returns OK, authentication fails..
by James Yale 29 Aug '08

29 Aug '08

>> EAP-MSCHAPV2: Invalid authenticator response in success request > > Upgrade Samba. If you're not using at least 3.2.1, upgrade to that. > >> http://jim.geezas.com/stuff/radius-debugging/ *-failure.log), the >> message authenticator does seem to be invalid, > > No. eapol_test is saying that the MSCHAP response is invalid. > >> Has anyone seen this problem before, or am I looking in the wrong place? > > Others have seen exactly the same thing in the past weeks. Upgrading > Samba fixed it. > > Alan DeKok. > - I've upgraded to the testing version of samba for FC9, 3.2.1 which unfortunately didn't resolve the issue - still getting the 'Invalid authenticator response in success request' problem. jim@florence:~$ /usr/sbin/winbindd -V Version 3.2.1-18.fc9 Is there a known good version of Samba, or could the problem lie elsewhere? I've included the server output from the MSCHAP module trying the authentication for reference. +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for jim2 with NT-Password expand: --username=%{mschap:User-Name:-None} -> --username=jim2 rlm_mschap: No NT-Domain was found in the User-Name. expand: --domain=%{mschap:NT-Domain:-CURRICULUM} -> --domain=CURRICULUM mschap2: ee expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c48639cf15fbe669 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0b4b18f4afaa63f4147e4250c8c907f3248ba67e7ee976a0 Exec-Program output: NT_KEY: 1847BA6C5854C261219362F18B4923E4 Exec-Program-Wait: plaintext: NT_KEY: 1847BA6C5854C261219362F18B4923E4 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d39313431454342383036383441464346413533303131384242454445363435373037323941383039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40622130416a3b8e9b04d3d502f1f161 PEAP: Processing from tunneled session code 0xa13a0d0 11 EAP-Message = 0x010800331a0307002e533d39313431454342383036383441464346413533303131384242454445363435373037323941383039 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40622130416a3b8e9b04d3d502f1f161 PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 127.0.0.1 port 35048 EAP-Message = 0x0108005b19001703010050a25e02bf01a7f7f6ca355df2cec89e3c2508b47b180497a05669336d0ac233f14b38ed612205594956295de1abbda4f5e4f8f03753d57524e01a42e5d29cabcf7996143335211d76065176783a7bb8ec Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5899ddd95f91c4e2ae146201bfc3a1be Finished request 7. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 0 with timestamp +5 Cleaning up request 1 ID 1 with timestamp +5 Cleaning up request 2 ID 2 with timestamp +5 Cleaning up request 3 ID 3 with timestamp +5 Cleaning up request 4 ID 4 with timestamp +5 Cleaning up request 5 ID 5 with timestamp +5 Cleaning up request 6 ID 6 with timestamp +5 Cleaning up request 7 ID 7 with timestamp +5 Ready to process requests. Thanks, James

3 3

User-Password required Authentication problem
by Syed Anwarul Hasan 28 Aug '08

28 Aug '08

Hi Alan and all, Thanks Alan for you earlier reply. I have a problem for Authenticating Radius server with Openldap backend. In the ldap.attrmap I added the line *checkitem User-Password userPassword *and also under modules in ldap module I have set_auth_type=yes for binding LDAP for authentication for User-Password. Also in the Sites-enabled dir under default file, I have added in the Authorize section I added, *update control { Auth-Type :=ldap } ldap* *And also enabled pap module with auto-header yes option. * So, after configuring in this manner,still I was not able to authenticate. Please help in this regard.* SYED #### Radius Debug Output:* r*ad_check_password: Found Auth-Type ldap auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use " (null)". ++[ldap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject* +- entering group REJECT expand: %{User-Name} -> hasan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated *Sending Access-Reject of id 225 to 127.0.0.1 port 1033* *#using radtest:* *radtest hasan thales localhost 1 testing123*

3 9

multiple Certificate Authority
by kas mataz 28 Aug '08

28 Aug '08

Due to acquisition of companies, we now need to support multiple Certificate Authorities. Wireless is successful in v2.0.5 using EAP-TLS with one eap instance for Company1, but when I add a second eap instance for Company2, eap fails for Company1. Is there a means to evaluate the certificate Issuer in the early part of the communication using a unlang statement? Is there a specific key word to use for the certificate issuer? It seems like the configuration needs just a few changes to be successful. rad_recv: Access-Request packet from host 10.252.255.18 port 32770, id=37, length=1507 User-Name = "Test User (Company 1)" Calling-Station-Id = "00-13-CE-DD-D4-85" Called-Station-Id = "00-0A-85-65-3E-80:WIFI3D" NAS-Port = 29 NAS-IP-Address = 10.252.255.18 NAS-Identifier = "wc-05" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "798" EAP-Message = 0x021f05110d800000050716030104d70b0003c70003c40003c1308203bd308202a5a00302010202030124b5300d06092a864886f70d0101050500306f310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a4275726c696e67616d65310c300a060355040a130344484c3110300e060355040b130753797374656d73311630140603550403130d44484c20476c6f62616c204341301e170d3036313231353232353933345a170d3038313231343232353933345a30818a3110300e060355040a130764686c2e636f6d310b3009060355040b13027573310b300906035504071302616d311f30 EAP-Message = 0x1d060355040313164a756479204d2046656c646572202844484c205553293122302006092a864886f70d01090116134a7564792e46656c6465724064686c2e636f6d31173015060a0992268993f22c64010113076a66656c64657230819f300d06092a864886f70d010101050003818d0030818902818100a90faf75166496dd2657307e9bc3164667ef4af9a0ce20e74a8f644f1d6b6afb240524313173ab41aca3f8d7fc4ff39f592225e8f93f70e9cbe17e2adde9e2968cc7bca1284feb0b81edf6acdf0fc5f110b781ac305c7dd08e0e524582a8e6830640f88ad3a60f664ec40d7133c055a9802d4e51c65738bfbeec981b914c3f310203010001 EAP-Message = 0xa381c93081c6301106096086480186f84201010404030205a0300e0603551d0f0101ff0404030205e0301e0603551d110417301581134a7564792e46656c6465724064686c2e636f6d301f0603551d230418301680143d81b8eebd05dc3676e024514dcb1965bb18d470303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f616d636d732e64686c2e636f6d2f6f63737030290603551d250422302006082b0601050507030206082b06010505070304060a2b0601040182370a0304300d06092a864886f70d010105050003820101001e6887c1a6f58d4289d05e778a93b755135e81a0c2ac624818c4afb186 EAP-Message = 0x258b022f175db3da3f7d990fa4d1044b38c08ebfbcea646257025443ad25daefb981ed60ffcfbc568586fb8c2ae402185463afe81169e043abf9b5782f67a8319b713157330e9438e5e4741d876669b856e44139eb1c67279cb2ee16ee39d9b7fc12c0f8564c55108ba0cca991120818dcbce5304121ea67db9e33ac77cdd52aa17daaac07cee4465c70b236271d4ad59a5d9d6183c049c8941b45366952a50446b36f0101baef2f3928aaa5eaade4fc5fb571a0535f20e36738b1b5a417e29fdf4031904d48430a4bc63e26c80c7f88637247469fdcd89f5ff30811e93a472f174bd41000008200803467644319b1f3681185cf76bae98b20bf5a529d EAP-Message = 0xe395dd3d0f7f1d3e6c91c6cdaca8855c52c6f9bd84893ea1a2ae848e75070f9b1fb8ead9d2470b536737f5f6ccac4acbf6d4aec4703dfee89910c3046ec9fd06ce57c0498eb126328108c9e578d21dcd374012d34210adee04397867d450bcb787bd298ad08321a5ebcde3c70f0000820080150c570d4ee2d59103b622f1c7716f94e2313c0b4c731a9799c430963864866adce8964454c8e2c5d6ab9520262e962cf9b99ce14445c5b39100449055a505eba616a0f754290af94a70ad426edaa42fc8f91fddcf776974f6ac533efbb5372c2e244cd53ea61ac66f7cf8a5d775970cbfd3e17e971822426538143efacca6681403010001011603010020 EAP-Message = 0xfaa0905d8a278e3e6cbf563aa4ff516825708a612fd32bbd672373f61ac45934 State = 0x4edb29434bc424a7b8988b8f343c1e87 Message-Authenticator = 0x0a71963cc3baec5c6ac16ecbaaea6bb0 +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "Test User (Company 1)", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: Entering ldap_groupcmp() expand: dc=external -> dc=external expand: (uid=%u) -> (uid=Test User \28Company 1\29) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=external, with filter (uid=Test User \28Company 1\29) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop expand: %{Huntgroup-Name} -> WIRELESS ++- entering switch %{Huntgroup-Name} +++- entering case WIRELESS rlm_eap: EAP packet type response id 31 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++++[eap_company1] returns updated rlm_eap: EAP packet type response id 31 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++++[eap_useram] returns updated rlm_eap: EAP packet type response id 31 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation +++- case WIRELESS returns updated ++- switch %{Huntgroup-Name} returns updated rlm_checkval: Item Name: Calling-Station-Id, Value: 00-13-CE-DD-D4-85 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop rad_check_password: Found Auth-Type eap_company1 rad_check_password: Found Auth-Type eap_company2 Warning: Found 2 auth-types on request for user 'Test User (Company 1)' auth: type "eap_company2" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 1287 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 03cb], Certificate chain-depth=1, error=0 --> User-Name = Test User (Company 1) --> BUF-Name = Company1 Global CA --> subject = /C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA --> issuer = /C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA --> verify return:1 rlm_eap_tls: Certificate issuer (/C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA) does not match specified value (/O=Parent-company/O=Child-company/OU=Division/CN=Company2 User CA PS)! chain-depth=0, error=0 --> User-Name = Test User (Company 1) --> BUF-Name = Test User (Company 1) --> subject = /O=company1.com/OU=us/L=am/CN=Test User (Company 1)/emailAddress=Test.User(a)company1.com/UID=tuser --> issuer = /C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA --> verify return:0 rlm_eap_tls:>>> TLS 1.0 Alert [length 0002], fatal certificate_unknown TLS Alert write:fatal:certificate unknown TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap_company2] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Test User (Company 1) attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 37 to 10.252.255.18 port 32770 EAP-Message = 0x041f0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1647. Going to the next request ../etc/raddb/sites-available/default authorize { preprocess suffix files switch "%{Huntgroup-Name}" { case HARDWARE1 { internal-uid } case HARDWARE2 { internal-mail } case HARDWARE3 { external-uid } case WIRELESS { eap_company1 eap_company2 } } checkval expiration } authenticate { internal-uid internal-mail external-uid eap_company1 eap_company2 } preacct { preprocess acct_unique suffix } accounting { detail radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { } ../modules/eap_company1 eap eap_company1 { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = private_key_file = ${certdir}/radius-co1.server.com.key certificate_file = ${certdir}/radius-co1.server.com.pem CA_file = ${cadir}/company1.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 check_crl = yes CA_path = /opt/freeradius/etc/raddb/certs check_cert_issuer = "/C=US/ST=State/L=City/O=Company1/OU=Unit/CN=Company1 Global CA" check_cert_cn = %{User-Name} cipher_list = "DEFAULT" } copy_request_to_tunnel = no } ../modules/eap_company2 eap eap_company2 { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = private_key_file = ${certdir}/radius-co2.server.key certificate_file = ${certdir}/radius-co2.server.pem CA_file = ${cadir}/chain-company2.pem dh_file = ${certdir}/dh random_file = ${certdir}/random fragment_size = 1024 check_crl = yes CA_path = /opt/freeradius/etc/raddb/certs check_cert_issuer = "/O=Parent-company/O=Child-company/OU=Division/CN=Company2 User CA PS" check_cert_cn = %{User-Name} cipher_list = "DEFAULT" } copy_request_to_tunnel = no } Regards, Kas _________________________________________________________________ Be the filmmaker you always wanted to be—learn how to burn a DVD with Windows®. http://clk.atdmt.com/MRT/go/108588797/direct/01/

2 1

Re: Release of 2.1.0?
by Alan DeKok 28 Aug '08

28 Aug '08

Arran Cudbard-Bell wrote: > New administrative components. The default schemas and configs will need > altering if you want it to work straight off, that's usually done in a > major release. It's been long enough since 2.0.5. I'd like to do something soon. > Ah no, this is EAP-TLS session resumption. The feature supported by the > native supplicant is PEAP Fast-Reconnect, which is something entirely > different. I have a strange feeling of deja vu, have we had this > discussion before ? I don't think fast-reauth is very different. It's pretty much the same thing. Both client && server cache various SSL magic, and then use that to bypass the full SSL setup. I've tested it with PEAP && wpa_supplicant. It seems to work. Alan DeKok.

1 0

Per device/user attributes
by Gene Hinds 28 Aug '08

28 Aug '08

Hello, I have recently installed freeradius and set it up to use a mysql database which will store username, passwords and attributes. My current goal is to limit user access and privileges into Cisco, and other types, of routers when support personnel SSH/telnet into them. I currently have the general access working well enough but I am having problems in figuring out how to do something I thought would be simple. I am trying to determine how to have freeradius respond with different attributes for a user depending on what device he telnets into. If he is a level 1 tech and telnets into a customer router I want him to have admin rights but if he telnets into a Core router I want him to only have Cisco level 1 access. Since these are naturally different attributes the response from freeradius needs to be different depending on the routers sending the request. From reading it seems this is possible with some rules in possibly the "radcheck" table but I cannot fully grasp the concept. Can someone please give me some direct documentation or configuration examples on this issue? I seem to know just just enough to get myself in trouble so the more detailed the instructions the better. Thanks

3 2

Two factor authentication using pam module
by Robert Svensson 28 Aug '08

28 Aug '08

Hi, I'm using the radius pam module to authenticate users connecting to an ftp server. The proprietary radius server that we are using expects, after a successful user name / password check, an access challenge in the form numbers displayed on a token. My problem is that I can't figure out how I should configure the pam module to handle the radius challenge. Is this this possible at all? The debug out put: Aug 28 16:40:48 radiuspam vsftpd: pam_radius_auth: Got user name john Aug 28 16:40:48 radiuspam vsftpd: pam_radius_auth: Sending RADIUS request code 1 Aug 28 16:40:49 radiuspam vsftpd: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -642636992. Aug 28 16:40:54 radiuspam vsftpd: pam_radius_auth: Got RADIUS response code 11 Aug 28 16:40:54 radiuspam vsftpd: pam_radius_auth: Got response to challenge code 3 Aug 28 16:40:54 radiuspam vsftpd: pam_radius_auth: authentication failed As you can see, the pam module doesn't wait for user input to the challenge response (code 11). Instead, it sends an invalid challenge response that the radius server rejects. Any help is greatly appreciated Thanx Robert

1 0

RE: � Official Update 2008!
by Microsoft XP 28 Aug '08

28 Aug '08

1 0

freeradius for Cisco accounting
by ICHIRO Yamaguchi 28 Aug '08

28 Aug '08

Hi,I'm Ichiro Yamaguchi from Japan. I installed freeradius ver.1.1.7 on Solaris 10(sparc). I want to use this radius server for Cisco AAA accounting function. I could not catch any information how to setup radius server for cisco accounting function. Please show me any information about this. Router configuration about accounting is below aaa accounting delay-start aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa accounting connection default start-stop group radius aaa accounting system default start-stop group radius Thank you. Ichiro Yamaguchi

2 1