- Freeradius-Users - lists.freeradius.org

Minor typo in master/raddb/mods-available/mschap
by James J J Hooper 08 Apr '12

08 Apr '12

--- mschap-orig 2012-04-08 00:39:44.000000000 +0100 +++ mschap-new 2012-04-08 00:41:06.000000000 +0100 @@ -78,3 +78,3 @@ # ntlm_auth_username = "username: %{mschap:User-Name}" -# ntlm_auth_domain = "username: %{mschap:NT-Domain}" +# ntlm_auth_domain = "nt-domain: %{mschap:NT-Domain}" -James

2 1

Single username/password for any platform?
by Blaster 08 Apr '12

08 Apr '12

Is it possible to give someone a single username & password that the person can use to login via WPA2-Enterprise from any type of device? (Android, iOS, Mac, Windows, Linux, etc?) I would prefer to not have to distribute certs either, and it's OK if the user has to accept a self-signed cert on first connect for each device. I've been googling this and can't seem to find any discussion that has a single cookbook cross-platform example, so I'm thinking it might not be? For example, my Android device just asks for an EAP password, and not a username/password like Windows does. Thanks...

2 1

load balancing and if statements
by Scott McLane Gardner 06 Apr '12

06 Apr '12

FR 2.1.10 on Linux I want to load balance my LDAP servers, but I also want to do some checking for group membership. Reading the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 makes me think I can use if and elsif statements in a load balancing block, as long as the rules in the table are followed. However, when I try to do this, I get the following errors in my log: >/etc/freeradius/sites-enabled/default[173]: load-balance sections cannot >contain a "if" statement Here is the configuration I am attempting: > load-balance { > ldap1 > > if (Ldap-Group == "NET Staff") { > if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4") { > update reply { > Passport-Access-Priority = 6 > } > } > } > # Reject everyone else to the routers > elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == >"10.51.0.2") { > reject > } > > ldap2 > > if (Ldap-Group == "NET Staff") { > if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4") { > update reply { > Passport-Access-Priority = 6 > } > } > } > # Reject everyone else to the routers > elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == >"10.51.0.2") { > reject > } > } If I can't use if statements in a load balance block, can anyone suggest another way to go about accomplishing what I want to do here? Thank you, Scott

6 19

How to configure COA in freeRadius
by ulislam.raihan 06 Apr '12

06 Apr '12

HI , I have put the following COA list in authorization section of default file. The default file is /etc/freeradius/sits-available to enable the COA request. update coa{ User-Name="%{User-Name}" Acct-Session-Id="%Acct-Session-Id" NAS-IP-Address="%NAS-IP-Address" Packet-Dst-Port=4200 } I am sending Access-Request from my java program and listening to port 4200. I am getting success Access-Accept . but i am not getting any COA request instead i have seen following error "Info: WARNING: Unknown destination 127.0.0.1:4200 for CoA request." Can any one tell me wht i have to configure more or what is the problem ? The output from radius server is below rad_recv: Access-Request packet from host 127.0.0.1 port 57378, id=1, length=59 User-Name = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 4200 User-Password = "password" Thu Apr 5 13:49:52 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Apr 5 13:49:52 2012 : Info: +- entering group authorize {...} Thu Apr 5 13:49:52 2012 : Info: ++[preprocess] returns ok Thu Apr 5 13:49:52 2012 : Info: ++[chap] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[mschap] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[digest] returns noop Thu Apr 5 13:49:52 2012 : Info: [suffix] No '@' in User-Name = "testing", looking up realm NULL Thu Apr 5 13:49:52 2012 : Info: [suffix] No such realm "NULL" Thu Apr 5 13:49:52 2012 : Info: ++[suffix] returns noop Thu Apr 5 13:49:52 2012 : Info: [eap] No EAP-Message, not doing EAP Thu Apr 5 13:49:52 2012 : Info: ++[eap] returns noop Thu Apr 5 13:49:52 2012 : Info: [files] users: Matched entry testing at line 49 Thu Apr 5 13:49:52 2012 : Info: ++[files] returns ok Thu Apr 5 13:49:52 2012 : Info: [sql] expand: %{User-Name} -> testing Thu Apr 5 13:49:52 2012 : Info: [sql] sql_set_user escaped user --> 'testing' Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Thu Apr 5 13:49:52 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testing' ORDER BY id Thu Apr 5 13:49:52 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testing' ORDER BY id Thu Apr 5 13:49:52 2012 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testing' ORDER BY priority Thu Apr 5 13:49:52 2012 : Debug: rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'testing' ORDER BY priority Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Released sql socket id: 0 Thu Apr 5 13:49:52 2012 : Info: [sql] User testing not found Thu Apr 5 13:49:52 2012 : Info: ++[sql] returns notfound Thu Apr 5 13:49:52 2012 : Info: ++[expiration] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[logintime] returns noop Thu Apr 5 13:49:52 2012 : Info: ++[pap] returns updated Thu Apr 5 13:49:52 2012 : Info: expand: %{User-Name} -> testing Thu Apr 5 13:49:52 2012 : Info: expand: %{Acct-Session-Id} -> Thu Apr 5 13:49:52 2012 : Info: expand: %{NAS-IP-Address} -> 127.0.0.1 Thu Apr 5 13:49:52 2012 : Debug: WARNING: You are modifying the value of virtual attribute Packet-Dst-Port. This is not supported. Thu Apr 5 13:49:52 2012 : Info: ++[coa] returns updated Thu Apr 5 13:49:52 2012 : Info: Found Auth-Type = PAP Thu Apr 5 13:49:52 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Apr 5 13:49:52 2012 : Info: +- entering group PAP {...} Thu Apr 5 13:49:52 2012 : Info: [pap] login attempt with password "password" Thu Apr 5 13:49:52 2012 : Info: [pap] Using clear text password "password" Thu Apr 5 13:49:52 2012 : Info: [pap] User authenticated successfully Thu Apr 5 13:49:52 2012 : Info: ++[pap] returns ok Thu Apr 5 13:49:52 2012 : Auth: Login OK: [testing/password] (from client localhost port 4200) Thu Apr 5 13:49:52 2012 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Thu Apr 5 13:49:52 2012 : Info: +- entering group post-auth {...} Thu Apr 5 13:49:52 2012 : Info: [sql] expand: %{User-Name} -> testing Thu Apr 5 13:49:52 2012 : Info: [sql] sql_set_user escaped user --> 'testing' Thu Apr 5 13:49:52 2012 : Info: [sql] expand: %{User-Password} -> password Thu Apr 5 13:49:52 2012 : Info: [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}:-%{Role2}', '%S','%{IP}','%{WEBPORT}','%{MEDIAPORT}') -> INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( 'testing', 'password', 'Access-Accept:-', '2012-04-05 13:49:52','','','') Thu Apr 5 13:49:52 2012 : Info: [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( 'testing', 'password', 'Access-Accept:-', '2012-04-05 13:49:52','','','') Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Thu Apr 5 13:49:52 2012 : Debug: rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate,ip,webport,mediaport) VALUES ( 'testing', 'password', 'Access-Accept:-', '2012-04-05 13:49:52','','','') Thu Apr 5 13:49:52 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Thu Apr 5 13:49:52 2012 : Info: ++[sql] returns ok Thu Apr 5 13:49:52 2012 : Info: ++[exec] returns noop Sending Access-Accept of id 1 to 127.0.0.1 port 57378 Role = "http://www.freeradius.org/rfc/attributes.html" Role2 = "Home A" Thu Apr 5 13:49:52 2012 : Info: WARNING: Unknown destination 127.0.0.1:4200 for CoA request. Thu Apr 5 13:49:52 2012 : Info: Do CoA Fail handler here Thu Apr 5 13:49:52 2012 : Info: Finished request 2. Thu Apr 5 13:49:52 2012 : Debug: Going to the next request Thu Apr 5 13:49:52 2012 : Debug: Waking up in 4.9 seconds. Thu Apr 5 13:49:57 2012 : Info: Cleaning up request 2 ID 1 with timestamp +1160 Thu Apr 5 13:49:57 2012 : Info: Ready to process requests Thanks raihan -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-configure-COA-in-freeRadius-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 12

Re: Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 06 Apr '12

06 Apr '12

Hi Alan, and how do i get this working ? I installed freeradius 3.0.0 and tested it, no chance by me ! Thanks, Alan DeKok wrote: >Aman Arneja wrote: >> Password change and retry is very much supported for Windows and Eap >> for (P)eap-mschapv2. There would be some flag that needs to be set for >> this after which it will work, will check what that flag is and write >> back in some time > The git "master" branch of FreeRADIUS supports MS-CHAP password >change. Version 2.1.x does NOT support it. >> Alan DeKok. -- NEU: FreePhone 3-fach-Flat mit kostenlosem Smartphone! Jetzt informieren: http://mobile.1und1.de/?ac=OM.PW.PW003K20328T7073a

2 1

atributing VLANs to roaming users
by Rui Ribeiro 05 Apr '12

05 Apr '12

Hi, I am having some problems with freeradius 2.1.12 and eduroam; whilst the local users are authenticated properly and given a specific VLAN, I haven´t been able to do the same to roaming (proxied) users. I have tried to place the following unlang code at the end of post-proxy, and in another separate test, at the end of post-auth, without much success. Any hints of fellow eduroamers? Best regards, Rui if ( Realm != "myreal" ) { update reply { Service-Type := "Framed-User" Reply-Message := "Eduroam Roaming" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "216" } }

2 1

radius proxy
by mimir 05 Apr '12

05 Apr '12

Hello, I applied proxy configuration between two radius servers. I see that packets are succesfully sent to second server and can get statistics via radmin tool. Besides this, I can log or write to sql the accounting datas. When I shutdown the remote server I can see the status of remote server like dead/alive and it is run succesfully with time settings in definition of home_server. But, I want to log accounting packets which could not be sent (which have no accounting response) to remote server (acct start/stop). Is it possible? Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/radius-proxy-tp5620043p5620043.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

RE: EAP-PEAP + Windows 7 with SSO and Password change
by Aman Arneja 05 Apr '12

05 Apr '12

Password change and retry is very much supported for Windows and Eap for (P)eap-mschapv2. There would be some flag that needs to be set for this after which it will work, will check what that flag is and write back in some time Sent from my Windows Phone From: David Mitton Sent: 4/5/2012 6:19 PM To: freeradius-users(a)lists.freeradius.org Subject: Re: EAP-PEAP + Windows 7 with SSO and Password change Yes, basically, password change operations are not supported by Windows EAP support. Not to mention RADIUS as well. Dave. Quoting c_dornig(a)gmx.de: > Hi, > > > we would like to use freeradius server for setup port access per > 802.1x on wired LAN. The plan is to have a guest-vlan for > unauthenticated supplicants and a vlan assignment for authenticated > supplicants. > > We configured the freeradius Server (Version 2.1.12) to use > peap/mschapv2 for user authentication. Each user can have one > nativ/untagged VLAN. > So far, the actual configuration works. > > Now we would like to use the Single Sign On feature from windows 7 > supplicant before the user logged in. > But this seems to work only if the user account is valid. > When the User account is new (with password change on next loggon) > or the password has expired, then the freeradius send the > MS-CHAP-Error to the supplicant. But why the hell, the windows 7 > client do not popup a window for change the password ? > > Is that generally not possible (cause EAP-MSCHAPv2) or something > missed in config ? > > I tried to use freeradius 3.0.0 from git with enabling the > passchange feature in the mschap module. > I did all steps from doc/mschap.rst. > > The follow Debug is from freeradius 3.0.0: > > <snip> > : > : > (8) Found Auth-Type = EAP > (8) # Executing group from file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > (8) group authenticate { > (8) - entering group authenticate {...} > (8) eap : Request found, released from the list > (8) eap : EAP/mschapv2 > (8) eap : processing type mschapv2 > (8) mschapv2 : # Executing group from file > /usr/local/etc/raddb/sites-enabled/inner-tunnel > (8) mschapv2 : group MS-CHAP { > (8) mschapv2 : - entering group MS-CHAP {...} > (8) mschap : NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 > (8) mschap : Told to do MS-CHAPv2 for DOMAIN\test-user3 with NT-Password > (8) mschap : expand: %{Stripped-User-Name} -> > (8) mschap : ... expanding second conditional > (8) mschap : expand: %{User-Name} -> DOMAIN\test-user3 > (8) mschap : expand: %{%{User-Name}:-None} -> DOMAIN\test-user3 > (8) mschap : expand: > --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> > --username=DOMAIN\test-user3 > (8) mschap : NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 > (8) mschap : expand: %{mschap:Challenge} -> 4b4be3875649ba1a > (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> > --challenge=4b4be3875649ba1a > (8) mschap : expand: %{mschap:NT-Response} -> > a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 > (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} > -> --nt-response=a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 > Exec-Program output: Password expired (0xc0000648) > Exec-Program-Wait: plaintext: Password expired (0xc0000648) > Exec-Program: returned: 1 > (8) mschap : ntlm_auth says password has expired > (8) [mschap] = reject > rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. > (8) eap : Handler failed in EAP/mschapv2 > (8) eap : Failed in EAP select > (8) [eap] = invalid > (8) Failed to authenticate the user. > (8) Login incorrect: [DOMAIN\\test-user3/<via Auth-Type = EAP>] > (from client switches port 0 via TLS tunnel) > } # server inner-tunnel > (8) peap : Got tunneled reply code 3 > MS-CHAP-Error = "\013E=648 R=0 > C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" > EAP-Message = 0x040b0004 > Message-Authenticator = 0x00000000000000000000000000000000 > (8) peap : Got tunneled reply RADIUS code 3 > MS-CHAP-Error = "\013E=648 R=0 > C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" > EAP-Message = 0x040b0004 > Message-Authenticator = 0x00000000000000000000000000000000 > (8) peap : Tunneled authentication was rejected. > (8) peap : FAILURE > (8) [eap] = handled > Sending Access-Challenge of id 128 to 192.168.15.52 port 2686 > EAP-Message = > 0x010c002b190017030100202f2f3b44177589096e8dbced7004dd801b1a777dd1a966acf5dcbde958537403 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x7cb2ed6374bef496dfd35c4e86820391 > (8) Finished request 8. > Waking up in 0.1 seconds. > rad_recv: Access-Request packet from host zzz.aaa.xxx.yyy port 2686, > id=129, length=262 > Framed-MTU = 1480 > NAS-IP-Address = zzz.aaa.xxx.yyy > NAS-Identifier = "SWITCHxxx" > User-Name = "DOMAIN\\test-user3" > Service-Type = Framed-User > : > : > : > > </snip> > > Thanks for any help. > -- > Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir > belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

EAP-PEAP + Windows 7 with SSO and Password change
by c_dornig＠gmx.de 05 Apr '12

05 Apr '12

Hi, we would like to use freeradius server for setup port access per 802.1x on wired LAN. The plan is to have a guest-vlan for unauthenticated supplicants and a vlan assignment for authenticated supplicants. We configured the freeradius Server (Version 2.1.12) to use peap/mschapv2 for user authentication. Each user can have one nativ/untagged VLAN. So far, the actual configuration works. Now we would like to use the Single Sign On feature from windows 7 supplicant before the user logged in. But this seems to work only if the user account is valid. When the User account is new (with password change on next loggon) or the password has expired, then the freeradius send the MS-CHAP-Error to the supplicant. But why the hell, the windows 7 client do not popup a window for change the password ? Is that generally not possible (cause EAP-MSCHAPv2) or something missed in config ? I tried to use freeradius 3.0.0 from git with enabling the passchange feature in the mschap module. I did all steps from doc/mschap.rst. The follow Debug is from freeradius 3.0.0: <snip> : : (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/mschapv2 (8) eap : processing type mschapv2 (8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) mschapv2 : group MS-CHAP { (8) mschapv2 : - entering group MS-CHAP {...} (8) mschap : NT Domain delimeter found, should we have enabled with_ntdomain_hack? (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 (8) mschap : Told to do MS-CHAPv2 for DOMAIN\test-user3 with NT-Password (8) mschap : expand: %{Stripped-User-Name} -> (8) mschap : ... expanding second conditional (8) mschap : expand: %{User-Name} -> DOMAIN\test-user3 (8) mschap : expand: %{%{User-Name}:-None} -> DOMAIN\test-user3 (8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=DOMAIN\test-user3 (8) mschap : NT Domain delimeter found, should we have enabled with_ntdomain_hack? (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 (8) mschap : expand: %{mschap:Challenge} -> 4b4be3875649ba1a (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=4b4be3875649ba1a (8) mschap : expand: %{mschap:NT-Response} -> a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 Exec-Program output: Password expired (0xc0000648) Exec-Program-Wait: plaintext: Password expired (0xc0000648) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password has expired (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. (8) Login incorrect: [DOMAIN\\test-user3/<via Auth-Type = EAP>] (from client switches port 0 via TLS tunnel) } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "\013E=648 R=0 C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\013E=648 R=0 C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Tunneled authentication was rejected. (8) peap : FAILURE (8) [eap] = handled Sending Access-Challenge of id 128 to 192.168.15.52 port 2686 EAP-Message = 0x010c002b190017030100202f2f3b44177589096e8dbced7004dd801b1a777dd1a966acf5dcbde958537403 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7cb2ed6374bef496dfd35c4e86820391 (8) Finished request 8. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host zzz.aaa.xxx.yyy port 2686, id=129, length=262 Framed-MTU = 1480 NAS-IP-Address = zzz.aaa.xxx.yyy NAS-Identifier = "SWITCHxxx" User-Name = "DOMAIN\\test-user3" Service-Type = Framed-User : : : </snip> Thanks for any help. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

2 1

Proxy radius
by cktan 05 Apr '12

05 Apr '12

Hi, Can the proxy radius return an additional attribute to NAS apart from the attribute return by the actual radius server? I've an situation where the actual radius server only return the frame-IP-address and netmask in Access-Accept, and we need the frame-Pools (mikrotik library) as well in order to have IP pools selection base on user profile i.e. Public user will get the public IP where else private user will secure the private IP pool. Problem is the administrator of the actual radius server may not want to add in new attribute for all the users in their DB for whatever reason and we are still finding way to see how to inject the Frame-Pool attribute based on the realm of the login id. Looking for your kind assistance in this matter. Cheers, CK -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1