March 2009 - Freeradius-Users - lists.freeradius.org

Re: freeradius and mikrotik auth problem pppoe error 691
by Lazar Cherveniakov 20 Mar '09

20 Mar '09

Everything looks fine in IP addresses, but the problem is still the same. Here again the log of Mikrotik and freeradius: Mikrotik debug log 01:33:40 pppoe,info PPPoE connection established from 00:15:AF:1F:23:1A 01:33:40 pppoe,ppp,info <pppoe-0>: waiting for call... 01:33:40 radius,debug new request 53:02 code=Access-Request service=ppp called-id=pppoe-in 01:33:40 radius,debug sending 53:02 to 192.168.200.2:1812 01:33:40 radius,debug,packet sending Access-Request with id 8 to 192.168.200.2:1812 01:33:40 radius,debug,packet Signature = 0x83d0415d6b98f0421df6bb83a01bdb28 01:33:40 radius,debug,packet Service-Type = 2 01:33:40 radius,debug,packet Framed-Protocol = 1 01:33:40 radius,debug,packet NAS-Port = 10 01:33:40 radius,debug,packet NAS-Port-Type = 15 01:33:40 radius,debug,packet User-Name = "lacho" 01:33:40 radius,debug,packet Calling-Station-Id = "00:15:AF:1F:23:1A" 01:33:40 radius,debug,packet Called-Station-Id = "pppoe-in" 01:33:40 radius,debug,packet NAS-Port-Id = "ether1" 01:33:40 radius,debug,packet CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e 01:33:40 radius,debug,packet CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba01 01:33:40 radius,debug,packet 18 01:33:40 radius,debug,packet NAS-Identifier = "TEST-RADIUS" 01:33:40 radius,debug,packet NAS-IP-Address = 192.168.200.4 01:33:41 radius,debug resending 53:02 01:33:41 radius,debug,packet sending Access-Request with id 8 to 192.168.200.2:1812 01:33:41 radius,debug,packet Signature = 0x83d0415d6b98f0421df6bb83a01bdb28 01:33:41 radius,debug,packet Service-Type = 2 01:33:41 radius,debug,packet Framed-Protocol = 1 01:33:41 radius,debug,packet NAS-Port = 10 01:33:41 radius,debug,packet NAS-Port-Type = 15 01:33:41 radius,debug,packet User-Name = "lacho" 01:33:41 radius,debug,packet Calling-Station-Id = "00:15:AF:1F:23:1A" 01:33:41 radius,debug,packet Called-Station-Id = "pppoe-in" 01:33:41 radius,debug,packet NAS-Port-Id = "ether1" 01:33:41 radius,debug,packet CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e 01:33:41 radius,debug,packet CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba01 01:33:41 radius,debug,packet 18 01:33:41 radius,debug,packet NAS-Identifier = "TEST-RADIUS" 01:33:41 radius,debug,packet NAS-IP-Address = 192.168.200.4 01:33:41 radius,debug resending 53:02 01:33:41 radius,debug,packet sending Access-Request with id 8 to 192.168.200.2:1812 01:33:41 radius,debug,packet Signature = 0x83d0415d6b98f0421df6bb83a01bdb28 01:33:41 radius,debug,packet Service-Type = 2 01:33:41 radius,debug,packet Framed-Protocol = 1 01:33:41 radius,debug,packet NAS-Port = 10 01:33:41 radius,debug,packet NAS-Port-Type = 15 01:33:41 radius,debug,packet User-Name = "lacho" 01:33:41 radius,debug,packet Calling-Station-Id = "00:15:AF:1F:23:1A" 01:33:41 radius,debug,packet Called-Station-Id = "pppoe-in" 01:33:41 radius,debug,packet NAS-Port-Id = "ether1" 01:33:41 radius,debug,packet CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e 01:33:41 radius,debug,packet CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba01 01:33:41 radius,debug,packet 18 01:33:41 radius,debug,packet NAS-Identifier = "TEST-RADIUS" 01:33:41 radius,debug,packet NAS-IP-Address = 192.168.200.4 01:33:41 radius,debug timeout for 53:02 01:33:41 pppoe,ppp,info <pppoe-lacho>: terminating... - user lacho authentication failed - radius timeout (6) 01:33:41 pppoe,ppp,info <pppoe-lacho>: disconnected Freeradius debug log: Sending Access-Accept of id 7 to 192.168.200.4 port 32768 Acct-Interim-Interval = 300 Session-Timeout = 31 Mikrotik-Xmit-Limit = 1073217536 Framed-IP-Address = 10.8.15.44 Mikrotik-Recv-Limit = 1073217536 Framed-IP-Netmask = 255.255.255.255 Thu Mar 19 12:37:16 2009 : Debug: Finished request 3 Thu Mar 19 12:37:16 2009 : Debug: Going to the next request Thu Mar 19 12:37:16 2009 : Debug: Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.200.4:32768, id=8, length=144 Thu Mar 19 12:37:31 2009 : Debug: --- Walking the entire request list --- Thu Mar 19 12:37:31 2009 : Debug: Cleaning up request 3 ID 7 with timestamp 49c2205c Thu Mar 19 12:37:31 2009 : Debug: Waking up in 31 seconds... Thu Mar 19 12:37:31 2009 : Debug: Threads: total/active/spare threads = 5/0/5 Thu Mar 19 12:37:31 2009 : Debug: Thread 5 got semaphore Thu Mar 19 12:37:31 2009 : Debug: Thread 5 handling request 4, (1 handled so far) Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 10 NAS-Port-Type = Ethernet User-Name = "lacho" Calling-Station-Id = "00:15:AF:1F:23:1A" Called-Station-Id = "pppoe-in" NAS-Port-Id = "ether1" CHAP-Challenge = 0xe3c819400560adadbf019f209dc42f7e CHAP-Password = 0x01dad26d1d56167a1899b3e9c8a8ba0118 NAS-Identifier = "TEST-RADIUS" NAS-IP-Address = 192.168.200.4 Thu Mar 19 12:37:31 2009 : Debug: Processing the authorize section of radiusd.conf Thu Mar 19 12:37:31 2009 : Debug: modcall: entering group authorize for request 4 Thu Mar 19 12:37:31 2009 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 4 Thu Mar 19 12:37:31 2009 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 4 Thu Mar 19 12:37:31 2009 : Debug: modcall[authorize]: module "preprocess" returns ok for request 4 Thu Mar 19 12:37:31 2009 : Debug: modsingle[authorize]: calling pre_auth (rlm_exec) for request 4 Thu Mar 19 12:37:31 2009 : Debug: Exec-Program output: Auth-Type := Accept Thu Mar 19 12:37:31 2009 : Debug: Exec-Program-Wait: value-pairs: Auth-Type := Accept rad_recv: Access-Request packet from host 192.168.200.4:32768, id=8, length=144 Thu Mar 19 12:37:31 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 8 due to unfinished request 4 Thu Mar 19 12:37:31 2009 : Debug: rl_next: returning NULL Thu Mar 19 12:37:31 2009 : Debug: Waking up in 31 seconds... Thu Mar 19 12:37:31 2009 : Debug: Threads: total/active/spare threads = 5/1/4 Thu Mar 19 12:37:32 2009 : Debug: Exec-Program: returned: 0 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: returned from pre_auth (rlm_exec) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall[authorize]: module "pre_auth" returns ok for request 4 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall[authorize]: module "mschap" returns noop for request 4 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: calling files (rlm_files) for request 4 Thu Mar 19 12:37:32 2009 : Debug: users: Matched entry DEFAULT at line 52 Thu Mar 19 12:37:32 2009 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall[authorize]: module "files" returns ok for request 4 Thu Mar 19 12:37:32 2009 : Debug: modcall: leaving group authorize (returns ok) for request 4 Thu Mar 19 12:37:32 2009 : Debug: rad_check_password: Found Auth-Type Accept Thu Mar 19 12:37:32 2009 : Debug: rad_check_password: Auth-Type = Accept, accepting the user Thu Mar 19 12:37:32 2009 : Debug: Exec-Program output: Acct-Interim-Interval = 300, Session-Timeout = 31, Mikrotik-Xmit-Limit = 1073217536, Framed-IP-Address = 10.8.15.38, Mikrotik-Recv-Limit = 1073217536, Framed-IP-Netmask = 255.255.255.255, Thu Mar 19 12:37:32 2009 : Debug: Exec-Program-Wait: value-pairs: Acct-Interim-Interval = 300, Session-Timeout = 31, Mikrotik-Xmit-Limit = 1073217536, Framed-IP-Address = 10.8.15.38, Mikrotik-Recv-Limit = 1073217536, Framed-IP-Netmask = 255.255.255.255, rad_recv: Access-Request packet from host 192.168.200.4:32768, id=8, length=144 Thu Mar 19 12:37:32 2009 : Error: Discarding duplicate request from client TEST-RADIUS:32768 - ID: 8 due to unfinished request 4 Thu Mar 19 12:37:32 2009 : Debug: --- Walking the entire request list --- Thu Mar 19 12:37:32 2009 : Debug: Waking up in 5 seconds... Thu Mar 19 12:37:32 2009 : Debug: Exec-Program: returned: 0 Sending Access-Accept of id 8 to 192.168.200.4 port 32768 Acct-Interim-Interval = 300 Session-Timeout = 31 Mikrotik-Xmit-Limit = 1073217536 Framed-IP-Address = 10.8.15.38 Mikrotik-Recv-Limit = 1073217536 Framed-IP-Netmask = 255.255.255.255 Thu Mar 19 12:37:32 2009 : Debug: Finished request 4 Thu Mar 19 12:37:32 2009 : Debug: Going to the next request Thu Mar 19 12:37:32 2009 : Debug: Thread 5 waiting to be assigned a request Thu Mar 19 12:37:37 2009 : Debug: --- Walking the entire request list --- Thu Mar 19 12:37:37 2009 : Debug: Cleaning up request 4 ID 8 with timestamp 49c2206b Thu Mar 19 12:37:37 2009 : Debug: Nothing to do. Sleeping until we see a request. Thu Mar 19 12:37:37 2009 : Debug: Threads: total/active/spare threads = 5/0/5 mikrotik ip [admin@TEST-RADIUS] > ip address print Flags: X - disabled, I - invalid, D - dynamic # ADDRESS NETWORK BROADCAST INTERFACE 0 192.168.200.4/24 192.168.200.0 192.168.200.255 ether1 radius server ip`s # ifconfig eth0 Link encap:Ethernet HWaddr 00:19:66:4E:F4:E8 inet addr:192.168.200.3 Bcast:192.168.200.255 Mask:255.255.255.0 inet6 addr: fe80::219:66ff:fe4e:f4e8/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:67047606 errors:2 dropped:0 overruns:0 frame:0 TX packets:1327141 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:480659514 (458.3 MiB) TX bytes:570459851 (544.0 MiB) Interrupt:17 eth0:1 Link encap:Ethernet HWaddr 00:19:66:4E:F4:E8 inet addr:192.168.200.2 Bcast:192.168.200.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:17 eth0:3 Link encap:Ethernet HWaddr 00:19:66:4E:F4:E8 inet addr:212.70.XX.XX Bcast:212.XX.XX.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:17 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:37293 errors:0 dropped:0 overruns:0 frame:0 TX packets:37293 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:1787220 (1.7 MiB) TX bytes:1787220 (1.7 MiB) And watch as I can not understand where is the problem? Radius everything looks okay More ideas? Thank you P.S. witout firewall # iptables -L -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Thanks -- Lazar Cherveniakov Micro computers system - Lazkom LIVE FREE OR DIE ------------------------------------- Powered by Mail.BG - http://mail.bg

4 3

Modify User-Name to upper Case (rewrite/unlang)
by Eric Martell 20 Mar '09

20 Mar '09

Hi, I am searching through the forum and did not got a right suggestion. I am doing LDAP authentication and getting macaddress as User-Name in the following format. User-Name = "001e.5283.34aa" I want to convert that to "001E528334AA" => convert to uppercase.and remove the dots. Is there any function I can use such as, ldap { User-Name := User-Name.toUpperCase().replace('.',''); } Please guide me to the documentation. Thanks and Regards. Eric.

1 0

Bandwidth limit
by Gunza 20 Mar '09

20 Mar '09

Dear All, I have installed Mikrotik Router OS server for PPPoE and I have installed Ubuntu Server 8.10 with Freeradius+My Sql server. I want to create user with bandwith limit in mysql database. Anybody please help me.

5 7

unlang question
by Bruce_M_Richardson＠biscuits.com 20 Mar '09

20 Mar '09

Hi, I have freeRADIUS 2.0.5 authenticating against LDAP via eap and this has been working perfectly since last year. Now a I have a new requirement to authenticate another set of users in the same LDAP tree onto a different service. These users will be visitors to our site and will have the user names Visitor1 ... Visitor(nn) I do not want visitors to be able to get onto the original service, and I do not want normal users to get onto the visitor service. My thoughts are to set up a new virtual server and add an 'if' statement to look for the visitor user names, and reject or allow as necessary. something like this in the new virtual server if ( Stripped-User-Name != /visitor[0-9]?[0-9]/i ) { reject } and the inverse for the old service. if ( Stripped-User-Name =~ /visitor[0-9]?[0-9]/i ) { reject } Is this syntax correct ? and where do I put it? Thanks for your time ...regards, Bruce Richardson Please consider the environment - do you really need to print this email? ________________________________________________________________________________________ This e-mail and any attachments are confidential and solely for the use of the intended recipient. They may contain material protected by legal professional or other privilege. If you receive it in error, please delete it from your system, make no copies of it, do not disclose its contents to any third party or use it for your own or any other person's benefit. Please advise the sender of its receipt as soon as possible. Although this email and its attachments are believed to be free of any virus or other defect, it is the responsibility of the recipient to ensure that they are virus free and no responsibility is accepted by the company for any loss or damage arising from receipt or use thereof. Any opinions expressed that do not relate to the official business of the company are those of the author, not the United Biscuits group of companies. United Biscuits (UK) Limited Registered in England number 2506007 Registered Office: Hayes Park, Hayes End Road, Hayes, Middlesex, UB4 8EE ________________________________________________________________________________________

4 7

radclient: problem with exit code 0 and 1
by oz 20 Mar '09

20 Mar '09

Hello, for monitoring our radius-servers, I use radclient for a long time in a script. After migration to another platform, radclient seems to work else, than before. If a monitored radiusd is down or the Auth of my monitoring-user fails, radclient gets an expected answer, but exits with status 0 in these cases. As far as I remember, in the past it was exit 1 (--> echo $?=1). I used to process exit 1 to indicate a problem with my radius-servers. Has this behaviour changed somewhere in the past? Or is it the wanted behaviour, that every valid answer to radclient exits with status 0 now? Take this for example: # /usr/bin/radclient -f /home/me/radpacket -x 192.168.x.x:1812 auth secret123 Sending Access-Request of id 248 to 192.168.x.x port 1812 User-Name = "test-user" Password = "XXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 radclient: no response from server for ID 248 # echo $? 0 ... I expected $? to be 1, because the server was down and did not respond, what indicates an error. I am running radclient from freeradius 1.1.3-3, Debian/etch amd64: # radclient -v radclient: $Id: radclient.c,v 1.72.2.1.2.5 2006/05/16 18:26:08 aland Exp $ built on Dec 17 2006 at 01:07:36 Any ideas? thnx

4 14

can the modules cause 'Exiting normally'?
by switchport＠hotmail.com 20 Mar '09

20 Mar '09

i write a likely rlm_sql module. test radius by the below shell, the auth_test file contain 8000 users. --------------------------- #!/bin/bash i=0 while true do date time ../radclient -p 16 -q -s -f auth_test 127.0.0.1:1812 auth xxxxxx i=`expr $i \+ 1` echo $i done ---------------------------- when tested xk or 1xk cycles, radius can 'Exiting normally' without no detail log. what wrong? the test shell echo ---------------------------- 3872 Fri Mar 20 09:01:09 CST 2009 Total approved auths: 8000 Total denied auths: 0 Total lost auths: 0 real 0m3.344s user 0m0.793s sys 0m1.245s 3873 Fri Mar 20 09:01:12 CST 2009 Total approved auths: 8000 Total denied auths: 0 Total lost auths: 0 real 0m3.352s user 0m0.778s sys 0m1.266s 3874 Fri Mar 20 09:01:16 CST 2009 Total approved auths: 8000 Total denied auths: 0 Total lost auths: 0 real 0m3.359s user 0m0.764s sys 0m1.277s 3875 Fri Mar 20 09:01:19 CST 2009 radclient: no response from server for ID 195 socket 3 Total approved auths: 7999 Total denied auths: 0 Total lost auths: 1 real 0m20.599s user 0m0.836s sys 0m1.477s 3876 Fri Mar 20 09:01:40 CST 2009 radclient: no response from server for ID 46 socket 3 radclient: no response from server for ID 162 socket 3 radclient: no response from server for ID 132 socket 3 radclient: no response from server for ID 81 socket 3 ... ----------------------------------------------------------------------------------- radius log show --------------------------------------------------------------------------------- Fri Mar 20 08:58:03 2009 : Error: Discarding conflicting packet from client localhost port 55746 - ID: 32 due to recent request 30648083. Fri Mar 20 08:58:57 2009 : Error: Discarding conflicting packet from client localhost port 54935 - ID: 39 due to recent request 30759434. Fri Mar 20 08:59:09 2009 : Error: Discarding conflicting packet from client localhost port 60967 - ID: 103 due to recent request 30770305. Fri Mar 20 08:59:43 2009 : Error: Discarding conflicting packet from client localhost port 58098 - ID: 131 due to recent request 30839295. Fri Mar 20 09:00:00 2009 : Error: Discarding conflicting packet from client localhost port 55258 - ID: 182 due to recent request 30862096. Fri Mar 20 09:00:14 2009 : Error: Discarding conflicting packet from client localhost port 42660 - ID: 47 due to recent request 30880046. Fri Mar 20 09:00:44 2009 : Error: Discarding conflicting packet from client localhost port 53858 - ID: 222 due to recent request 30932873. Fri Mar 20 09:01:22 2009 : Error: Discarding conflicting packet from client localhost port 44717 - ID: 195 due to recent request 31006705. Fri Mar 20 09:01:24 2009 : Info: Exiting normally. --------------------------------------------------------------------------------- radiusd.conf ---------------------------------------------------------------------------- thread pool { start_servers = 8 max_servers = 64 min_spare_servers = 4 max_spare_servers = 12 max_requests_per_server = 0 } -----------------------------------------------------------------------------

1 0

LDAP ntPassword and lmPassword help
by Padam J Singh 20 Mar '09

20 Mar '09

Hello, I have a LDAP server which contains ntPassword and lmPassword attributes like following: dn: uid=subs, ou=accounts, dc=test, dc=com uid: subs userPassword:: e01ENX03MmIwMTViNDhlOTU5ZTlkYWQ3MTAxNjNiYjJhZDkyMQ== mac: "" lmPassword: {ENC}9846B736BDDA9E7CAAD3B435B51404EE ntPassword: {ENC}22D6ADD4E9AD37B87B8EDB2C91E1EE67 objectClass: objDevices objectClass: top FR 2.1.1 is configured for doing 802.1x authentication. While doing the authentication, I obviously get Invalid NT-Password and Invalid LM-Password error. The error stems from the fact that the length is incorrect because of the additional {ENC} prefix. Is there some configuration where I can set something so it ignores the initial {ENC} while doing the password comparison? I cannot get rid of the {ENC} prefix. Thanks, Padam -- PGP Id 9EED2E09

3 2

packet freeradius-mysql for RH
by Martin Silvero 19 Mar '09

19 Mar '09

Hi list! I need the packets freeradius-mysql... I have this: freeradius-mysql-1.1.3-1.2.el5.i386.rpm but my freeradius is 2.1.3 and this rpm don´t work. I have Red Hat 5.1 Somebody have any idea where I get this packet? My problem is this: **Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" Errors initializing modules** I reed RedHat FAQ. I have "freeradius-mysql-2.1.3-1.fc9.i386.rpm", but is Fedora. I don´t find the solution. Any idea?

3 2

Reply-Name/Message with own values (FR 2.0.5)
by Jan Strauch 19 Mar '09

19 Mar '09

Hello world !!! First : I used the search, but it did not help me. I would like to change the reply-Messages of sqlcounter. Looked in the list and the www, but there was not really a useful info. And like always I can not solve the problem. Tried : sqlcounter Duration { counter-name = Duration check-name = Card-Duration sqlmod-inst = sql key = User-Name reset = never reply-message = "Hail Satan" query = "SELECT unix_timestamp(now())-min(unix_timestamp(acctstarttime)) FROM radacct WHERE UserName='%{%k}'" } and got : rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user test, check_item=1000, counter=20098 ++[Duration] returns reject Found Post-Auth-Type Reject <........> Sending Access-Reject of id 103 to 127.0.0.1 port 38075 Reply-Message = "Your maximum never usage time has been reached" the same with reply-name = Mikrotik-Xmit-Limit or reply-name = some other values Is there a list somewhere, where I can see the reply-names with corresponding reply-messages ? Is there a way to change these messages ? most of our customers are germans and their english is worse than mine. It would be nice to give them german messages and spanish for the spanish. Thanks Jan _______________________________________________________________________ DSL zum Nulltarif + 20 Euro Extraprämie bei Online-Bestellung über die DSL Freundschaftswerbung! http://dsl.web.de/?ac=OM.AD.AD008K15279B7069a

2 1

Mysql database on non standard port
by Guto Andreollo 19 Mar '09

19 Mar '09

Hello all! I'm trying to configure the mysql module to use a port different than 3306 to connect to the db server. I've tried setting the server string as "mysql-server.domain.com:12345" on sql.conf, but that's unfortunately not correct. Can anyone point me to the correct syntax? thanks all. --- Augusto G. Andreollo CCUEC/DCNET/SREDE Universidade Estadual de Campinas - UNICAMP +55 19 3521-2276 -- "Wit beyond measure is men's greatest treasure."

2 1