October 2011 - Freeradius-Users - lists.freeradius.org

Build RPM
by Victor Guk 07 Nov '11

07 Nov '11

Hi, I want to install freeradius on RHEL5. I downloaded tar.bz2.(version 2.1.12) Run *rpmbuild -ba freeradius.spec*, but get an error: ......... ......... Requires(rpmlib): rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 ???????? ?? ?????????????(?) ????(?): /usr/lib/rpm/check-files /var/tmp/freeradius-2.1.12-1-root-root ??????: ?????????(?) ?????????????(?) (?? ?? ???????????(?)) ????(?): /usr/share/man/man1/smbencrypt.1.gz /usr/share/man/man5/checkrad.5.gz /usr/share/man/man8/radconf2xml.8.gz /usr/share/man/man8/radcrypt.8.gz /usr/share/man/man8/radsniff.8.gz /usr/share/man/man8/rlm_dbm_cat.8.gz /usr/share/man/man8/rlm_dbm_parse.8.gz ?????? ?????? ???????: ?????????(?) ?????????????(?) (?? ?? ???????????(?)) ????(?): /usr/share/man/man1/smbencrypt.1.gz /usr/share/man/man5/checkrad.5.gz /usr/share/man/man8/radconf2xml.8.gz /usr/share/man/man8/radcrypt.8.gz /usr/share/man/man8/radsniff.8.gz /usr/share/man/man8/rlm_dbm_cat.8.gz /usr/share/man/man8/rlm_dbm_parse.8.gz What am I doing wrong. What's the problem?

6 12

Anybody can confirm this?
by tonimanel 04 Nov '11

04 Nov '11

Hi, I have two servers A and B configured. I have some doubts: I would like to get to copy accounting data (same set of information) from A to B. I have configured this and works fine (copy-acct-to-home-server & proxy.conf), BUT in radacct table of server B, the records have different acctstartime and different acctstoptime from server A. I know that this happens because server B catchs its time and records it (exists a delay - few seconds). In other post, suggest me modify sql queries to get this (I should catch time of packet that send A - Event-Timestamp, and record it). For do this, I have thought in to check "Packet-Src-IP-Address" and if it is equal to B's address, I have to use my query modified. I have a problem, "Event-Timestamp" has the follows format: "Oct 26 2011 13:03:14 CEST" and I want to get yyyy-mm-dd HH:MM:ss (mysql format and current format of freeradius' dates). Do you know how can I do it? I can't believe that I can't do this more easy... Any suggestions? I have to think that I will get it... Thanks and regards! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Anybody-can-confirm-this-tp4939606p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

FreeRADIUS Beginner's Guide
by Ian Pilcher 02 Nov '11

02 Nov '11

I'm a complete newbie to RADIUS, looking to make use of the features of my new "smart" switches and wireless access point to secure my home network, so the title certainly sounds right. Has anyone had a look at this book yet? If so, what are your thoughts? Thanks! -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com "If you're going to shift my paradigm ... at least buy me dinner first." ========================================================================

6 9

Need help with Freeradius and 802.1X
by johnboy68 02 Nov '11

02 Nov '11

I have searched the forum but can't find what I'm looking for. Here is my scenario: Users with Vista machines and the 802.1X supplicant configured Windows Server 2008 with Active Directory Other network connected devices and 'unknown' computers 100% Cisco LAN/WAN Here is what I want to do: Dynamic VLAN assignment based on 802.1X with Freeradius able to use Active Directory for the computers with the supplicant configured and also be able to use MySQL to do MAC authentication bypass for known devices like printers that can't use a supplicant. I don't have much experience with Freeradius but I feel this is something that would be a "normal" 802.1X configuration. Any help on how to configure this environment would be greatly appreciated. Thanks, John -- View this message in context: http://freeradius.1045715.n5.nabble.com/Need-help-with-Freeradius-and-802-1… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Proxy decision based on LDAP lookups and Radius_client match.
by Frank Skovboel 01 Nov '11

01 Nov '11

Hi, I have been asked to build a radius proxy using freeradius, and I'm completely new to freeradius, and with the flexibility in freeradius I'm having a hard time figuring out how to accomplish my goal, or if it's even possible to do. Objective: I need to verify that the user that tries to login from Company A really is an employee of Company A, and not an employee of Company B. For this purpose I have access each company's AD and of cause I know what radius clients belong to each company. Once I have validated that the user exists in the Company's AD, I then have to proxy it to another radius server where the users OTP will be validated, and from that give an access-accept or access-reject. If the user does not exist in the Company's AD, freeradius should send an access-reject and not proxy it to the OTP radius. I imagine the flow is some thing like: 1) User from Company A tries to login 2) Company A's VPN sends a radius request to Freeradius 3) Freeradius looks at the Radius_client IP and finds the right AD. 4) Freeradius does an LDAP bind to Company A's AD, and checks if the user exists. 5) If user exists request is proxied to the OTP radius, if the user does not exists access-reject is sent from Freeradius. I have freeradius setup to proxy the request to the OTP radius server today, without any checks. As I said I'm completely new to Freeradius, and not sure what files I need to configure or what to put in them, so any help is highly appreciated. -- Thank you, Frank Skovboel

2 5

add field in radcheck table
by gary 01 Nov '11

01 Nov '11

2 8

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 31 Oct '11

31 Oct '11

add that in (actually tried that before as well), still does not work, but the logging looks a little different now: ***** [ldap] performing user authorization for marguin2 [ldap] expand: (uid=%u) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... rlm_ldap: userPassword -> Password-With-Header == "{CRYPT}tGS8HbszeyDmM" [ldap] looking for reply items in directory... rlm_ldap: radiusFilterId -> Filter-Id = "wireless" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ***** so now the password is not clear text in the log as it was before but still seeing that no good password error....but then there is that line towards the bottom that sasys user authorized to use remote access... do i need to configure Filter-Id or something in the sites-enabled/default or innertunnel or something like that? -m On 10/31/2011 12:19 PM, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: cisco WAP/FreeRadius/OpenLDAP (Phil Mayers) > 2. RE: IPv6 ready? (Sergio NNX) > 3. Re: IPv6 ready? (Phil Mayers) > 4. RE: IPv6 ready? (Sergio NNX) > 5. Re: IPv6 ready? (Phil Mayers) > 6. Re: IPv6 ready? (Johan Meiring) > 7. RE: IPv6 ready? (Sergio NNX) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 31 Oct 2011 14:53:02 +0000 > From: Phil Mayers<p.mayers(a)imperial.ac.uk> > Subject: Re: cisco WAP/FreeRadius/OpenLDAP > To: freeradius-users(a)lists.freeradius.org > Message-ID:<4EAEB64E.5080300(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 31/10/11 14:03, Matthew Arguin wrote: >> Phil, >> I just confirmed that it is tagged with the {CRYPT} or {SHA} (i have >> tried both). also, i changed the user that is binding to be the manager >> CN which has full access to the ldap for mod etc to rule that out. > Ah. I've just seen that you are running 2.1.7 from your original email. > > The default LDAP attribute mappings were updated after that version to > include this line in "ldap.attrmap": > > checkitem Password-With-Header userPassword > > ...you should: > > a. Add that line to your "ldap.attrmap", see if it makes any difference > b. Plan an upgrade to 2.1.12 > > > ------------------------------ > > Message: 2 > Date: Mon, 31 Oct 2011 15:32:07 +0000 > From: Sergio NNX<sfhacker(a)hotmail.com> > Subject: RE: IPv6 ready? > To:<freeradius-users(a)lists.freeradius.org> > Message-ID:<BAY147-W5460081D972A7B951D126CCD60(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > Thank you all for your help. I added two more listen blocks in radiusd.conf and I updated detail { ... with the following: %{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} and it works but ..... (there's always a but). if we use an IPv6 address, then Packet-Src-APv6-Address value will be, for instance, 0:0:0:0:0:0:0:0, and the path becomes : > > ${radacctdir}/0:0:0:0:0:0:0:0/detail-%Y%m%d.log > > but FR crashes since it cannot create a folder with that name. Is there any way of overcoming this issue? replace : with . or so??? > > Thanks again for your help. > > Sergio. > >> Date: Mon, 31 Oct 2011 08:52:46 +0000 >> From: A.L.M.Buxey(a)lboro.ac.uk >> To: freeradius-users(a)lists.freeradius.org >> Subject: Re: IPv6 ready? >> >> Hi, >> >>> Just wondering if FR supports IPv6 addresses since I'm unable to start the >>> server when using IPv6. >> yes. we use it fine with IPv6 - both receiving and sending RADIUS packets. >> >>> Another question is: are you aware of any (client) tool for testing FR >>> when using IPv6 addresses? eapol_test doesn't seem to know anything about >>> :: or ::1 >> eapol_test - use hostnames (eg in /etc/hosts ?) ? >> >>> Do the below lines from radiusd.conf require any change when IPv6? >>> >>> ... >>> ... >>> detail { >>> detailfile = >>> ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d.log >> yes, Client-IP-Address doesnt exist in IPv6 world - you can use one of the source >> address attributes instead >> >> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

2 1

AD integration
by Whitlow, Michael 31 Oct '11

31 Oct '11

Hello, I just got Freeradius running on Ubuntu and have successfully configured integration Active Directory using Samba and NTLM_AUTH. When I run "radtest" against Freeradius and put in AD credentials, it is successful. My next goal is to configure Freeradius to assign 802.1X VLANs for a wireless environment. In other words, users who are a member of ADGROUP1 get assigned vlan # 111, and users who are a member of ADGROUP2 get assigned vlan #222. I am unclear which direction to go to accomplish this. Any help would be greatly appreciated. Thanks much Mike Whitlow

8 20

Assert Failed on Proxing
by andreapepa 31 Oct '11

31 Oct '11

Hi all, As you can see from the attached log, i was tring to do some proxy test, the server crashed attempting to proxy against a not running freeradius proxy.... ( i was only testing proxy action not authentication on other FR servers) is it normal? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.25.18.123 port 39869, id=98, length=215 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa(a)newradius.it" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy auth_by_SSID {...} +++? if (Called-Station-Id != /:WiNET-TR5G/ && User-Name =~ /cpe/ ) ? Evaluating (Called-Station-Id != /:WiNET-TR5G/ ) -> TRUE ? Evaluating (User-Name =~ /cpe/) -> FALSE +++? if (Called-Station-Id != /:WiNET-TR5G/ && User-Name =~ /cpe/ ) -> FALSE ++- policy auth_by_SSID returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/172.25.18.123/auth-detail-20111021 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.25.18.123/auth-detail-20111021 [auth_log] expand: %t -> Fri Oct 21 11:57:05 2011 ++[auth_log] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "newradius.it" for User-Name = "apepa(a)newradius.it" [suffix] Found realm "newradius.it" [suffix] Adding Stripped-User-Name = "apepa" [suffix] Adding Realm = "newradius.it" [suffix] Proxying request from user apepa to realm newradius.it [suffix] Preparing to proxy authentication request to realm "newradius.it" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{Stripped-User-Name} -> apepa [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-none}} -> apepa [sql] sql_set_user escaped user --> 'apepa' rlm_sql (sql): Reserving sql socket id: 43 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'apepa' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='apepa' ORDER BY priority rlm_sql_postgresql: query: SELECT GroupName FROM radusergroup WHERE UserName='apepa' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 [sql] expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 [sql] User found in group TNNET [sql] expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'TNNET' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 7 , fields = 5 rlm_sql (sql): Released sql socket id: 43 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Proxying request 0 to home server 172.25.200.161 port 1812 Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. rad_recv: Access-Request packet from host 172.25.18.123 port 39869, id=98, length=215 Sending duplicate proxied request to home server 172.25.200.161 port 1812 - ID: 123 Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Waking up in 16.9 seconds. rad_recv: Access-Request packet from host 172.25.18.123 port 39869, id=98, length=215 Sending duplicate proxied request to home server 172.25.200.161 port 1812 - ID: 123 Sending Access-Request of id 123 to 172.25.200.161 port 1812 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "40:61:86:9C:6D:F9" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "apepa" NAS-Port = 2150629460 Acct-Session-Id = "80300054" Framed-IP-Address = 10.29.66.3 Vendor-14988-Attr-10 = 0x0a1d4203 CHAP-Challenge = 0xb68620a7e997208ee43593bf739602b6 CHAP-Password = 0x563096c0c85e3e1b1bec92d585dc44496b Service-Type = Login-User WISPr-Logoff-URL = "http://10.29.66.1/logout" NAS-Identifier = "AP Test Vincenzo" NAS-IP-Address = 172.25.18.123 Message-Authenticator := 0x00000000000000000000000000000000 Proxy-State = 0x3938 Waking up in 13.9 seconds. ASSERT FAILED event.c[1181]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL Abortito -- View this message in context: http://freeradius.1045715.n5.nabble.com/Assert-Failed-on-Proxing-tp4924319p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 14

Re: cisco WAP/FreeRadius/OpenLDAP
by Matthew Arguin 31 Oct '11

31 Oct '11

Phil, I just confirmed that it is tagged with the {CRYPT} or {SHA} (i have tried both). also, i changed the user that is binding to be the manager CN which has full access to the ldap for mod etc to rule that out. [ldap] performing user authorization for marguin2 [ldap] expand: (uid=%u) -> (uid=marguin2) [ldap] expand: ou=people,dc=currensee,dc=com -> ou=people,dc=currensee,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=currensee,dc=com, with filter (uid=marguin2) [ldap] checking if remote access for marguin2 is allowed by radiusFilterId [ldap] looking for check items in directory... [ldap] looking for reply items in directory... rlm_ldap: radiusFilterId -> Filter-Id = "wireless" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user marguin2 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 at this point i am wondering if i have not done something with that radiusFilterId value... meaning do something to permit that that filter is permitted to auth etc. -m On 10/28/2011 10:40 AM, freeradius-users-request(a)lists.freeradius.org wrote: > On 28/10/11 13:46, Matthew Arguin wrote: >> > right now, the user that i am testing with has a password that is CRYPT. > Ok. But does it look like this: > > userPassword: xxyyeeyeetwe > > or this: > > userPassword: {crypt}xxyyeqetew > > This matters. > > > ------------------------------ -- Matthew Arguin Currensee, Inc. 54 Canal St, 4th Floor Boston, MA 02114 (617) 986-4758 (Office) _________________________________________________________________________ This email and any files transmitted with it are confidential and intended solely for the addressee. If you received this email in error, please do not disclose the contents to anyone; kindly notify the sender by return email and delete this email and any attachments from your system. © 2011 Currensee Inc. is a member of the National Futures Association (NFA) Member ID 0403251 | Over the counter retail foreign currency (Forex) trading may involve significant risk of loss. It is not suitable for all investors and you should make sure you understand the risks involved before trading and seek independent advice if necessary. Performance, strategies and charts shown are not necessarily predictive of any particular result and past performance is no indication of future results. Investor returns may vary from Trade Leader returns based on slippage, fees, broker spreads, volatility or other market conditions. Currensee Inc | 54 Canal St 4th Floor | Boston, MA 02114 | +1.617.624.3824

2 1