- Freeradius-Users - lists.freeradius.org

Help needed --- urgent
by Saeed Akhtar 19 Nov '08

19 Nov '08

Hi all, I'm new to freeradius and i want to configure and test my server... I have installed server from cvs .... now when i run radiusd -X its output is like this: FreeRADIUS Version 2.0.6, for host i686-pc-linux-gnu, built on Nov 19 2008 at 17:00:09 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/jradius.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no . . . . Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } /usr/local/etc/raddb/jradius.conf[2]: Invalid version in module 'rlm_jradius' /usr/local/etc/raddb/radiusd.conf[1868]: Failed to find module "jradius". /usr/local/etc/raddb/radiusd.conf[1776]: Errors parsing authorize section. } } Errors initializing modules Can anyone please help me... why im getting error ... how can i fix this. Regards, Saeed Akhtar

2 2

unlang?
by Dean, Barry 19 Nov '08

19 Nov '08

I am testing my current 1.1.7 config with version 2.0.0. I have 2 bits of config that are not quite right on 2.0.0 1) I have the line: filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am not sure why, I inherited this setup and I am still trying to understand it. The LDAP server is eDirectory (FreeRADIUS compiled with -with-edir) The "-X" output says: WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=user) expand: o=uol -> o=uol What is the replacement for ":-" given I don't know what it did in the first place for "man unlang" to be any help! 2) Rejecting a user I have a specific user account (call it "special") it was barred using: special Auth-Type := Reject Reply-Message = "Cannot use this user account" in the users file. Variants like " special", "Special" and "SPECIAL" etc get by this check, and out LDAP server allows them!, so I added: lower_user = before lower_pass = no nospace_user = before nospace_pass = no to radius.conf. These no longer seem to work. How do you achieve this with version 2.0.0? --------------- Barry Dean Networks Team Computing Services Department Tel: 0151 794 5641 (x45641)

6 8

again: 802.1x auto login with win login/pass
by Hegedus Gabor 19 Nov '08

19 Nov '08

sorry have some problem with this maillist, get the messages not a valid mail address... let's see I try new thread, and hope it will work... ------------------------- Hi all, I have a problem, can't authenticate my user with win login user/pass. I use: - 802.1x - newest freeradius, and ubuntu 8.4 - eap-tls - win xp sp2 client, use automatic win logon and pass When "Automatically use my Windows login name and password" is unchecked on the windows, i type user/pass and my radius is accept the request. and everything is okay. But, When i try it with automatic win login/pass, the radius reject the request. I set the with-ntdomain-hack=yes to preprocess and it cut the domain part. its seems okay but still reject. I have good user settings. what is the problem? password encription? log: when windows send automaticly the login and pass: Auth: Login incorrect: [Joe/<via Auth-Type = EAP>] (from client switch port 50003 cli 00-13-D4-E7-B3-FB) Auth: Login incorrect: [Joe/<via Auth-Type = EAP>] (from client switch port 50003 cli 00-13-D4-E7-B3-FB) Auth: Login incorrect: [joe/<via Auth-Type = EAP>] (from client switch port 50003 cli 00-13-D4-E7-B3-FB) when I type the l/p: Auth: Login OK: [Joe/<via Auth-Type = EAP>] (from client switch port 0 via TLS tunnel) Auth: Login OK: [Joe/<via Auth-Type = EAP>] (from client switch port 50003 cli 00-13-D4-E7-B3-FB) Here is the settings: main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.0/24 { require_message_authenticator = no secret = "cisco" shortname = "switch" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "pass" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = yes with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } ---------------------------------------------------- the debug log: rad_recv: Access-Request packet from host 192.168.1.1 port 1812, id=228, length=160 NAS-IP-Address = 192.168.1.1 NAS-Port = 50003 Cisco-NAS-Port = "FastEthernet0/3" NAS-Port-Type = Ethernet User-Name = "DOMAIN\\Joe" Called-Station-Id = "00-09-B7-94-CA-83" Calling-Station-Id = "00-13-D4-E7-B3-FB" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200001001524f555445525c48656765 Message-Authenticator = 0xda8ce7b609ed190bf55552b960fb9007 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Joe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry Hege at line 78 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Joe attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 228 to 192.168.1.1 port 1812 Waking up in 4.9 seconds. Cleaning up request 0 ID 228 with timestamp +37 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1812, id=229, length=160 NAS-IP-Address = 192.168.1.1 NAS-Port = 50003 Cisco-NAS-Port = "FastEthernet0/3" NAS-Port-Type = Ethernet User-Name = "DOMAIN\\Joe" Called-Station-Id = "00-09-B7-94-CA-83" Calling-Station-Id = "00-13-D4-E7-B3-FB" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0201001001524f555445525c48656765 Message-Authenticator = 0x899e38e1fdff02cd06c656b01129c91c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "joe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry joe at line 78 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Joe attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 229 to 192.168.1.1 port 1812 Waking up in 4.9 seconds. Cleaning up request 1 ID 229 with timestamp +43 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1812, id=230, length=160 NAS-IP-Address = 192.168.1.1 NAS-Port = 50003 Cisco-NAS-Port = "FastEthernet0/3" NAS-Port-Type = Ethernet User-Name = "DOMAIN\\Joe" Called-Station-Id = "00-09-B7-94-CA-83" Calling-Station-Id = "00-13-D4-E7-B3-FB" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0201001001524f555445525c48656765 Message-Authenticator = 0x7458dfe5581c573158e7bbd81998837c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Joe", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry Joe at line 78 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Joe attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 230 to 192.168.1.1 port 1812 Waking up in 4.9 seconds. Cleaning up request 2 ID 230 with timestamp +49 Ready to process requests.

4 11

Freeradius 2.0 with Activedirectory Integration Failed
by Andy Ng 19 Nov '08

19 Nov '08

Hi all, I am implementing Freeradius 2.0 to be integrated with Microsoft Activedirectory and has encountered problems. All are being run in Virtual Environment (VMware Server 1.07) RADIUS OS: CentOS5.2 Freeradius Server 2.1.1 PAM radius 1.3.17 Active Directory OS: Windows 2003 Server I refer to a number of URLS: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO http://deployingradius.com/documents/configuration/active_directory.html http://deployingradius.com/documents/configuration/active_directory.html I have successfully been able to join the RADIUS server to the AD, and is able to have output for "wbinfo -u", and NTLM works well: [root@RADIUS tmp]# ntlm_auth --request-nt-key --domain=TEST --username=test password: NT_STATUS_OK: Success (0x0) I used freeradius with it's default settings, but modifying MSCHAP module, enabling ntlm_auth: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-TEST} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Installed pam_radius 1.3.17, and configured sshd for pam to authenticate from pam_radius first: #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so I ran "radiusd -X", and opened another SSH session, using "test" account, that I tried with ntlm_auth previously, and got the following as in the debug output: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 27196, id=71, length=86 User-Name = "test" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 26171 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.0.0.151" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 71 to 127.0.0.1 port 27196 Waking up in 4.9 seconds. Cleaning up request 0 ID 71 with timestamp +13 Ready to process requests. It doesn't seem to be doing ntlm_auth? I am not sure how I am supposed to debug this problem further, as I have tried a number of troubleshooting, but still to no avail. Can someone enlighten me on this problem? If there is more information required, please tell me. I have attached my radius configuration as well: http://www.nabble.com/file/p20355701/radiusd.conf radiusd.conf Thanks in advance! Regards, Andy -- View this message in context: http://www.nabble.com/Freeradius-2.0-with-Activedirectory-Integration-Faile… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 16

Re: authenticating to an Windows AD
by Mike Diggins 19 Nov '08

19 Nov '08

I should have mentioned it's FreeRadius 2.1.1. -Mike On Tue, 18 Nov 2008, Mike Diggins wrote: > > Folks, I have freeradius running on a fedora linux box. I want to use it for > authentication from an Apache web server using the radius interface. That > part is working, and I'm able to authenticate web users only if they have a > local account on the freeradius server. > > I want freeradius to authenticate against a Windows Active Directory. I > installed Samba and am running Winbind, and wbinfo/ntlm_auth both are able to > authenticate from the command line assuming I give it a valid username and > password. What module in freeradius do I use to authenticate through Winbind? > Could someone point me in the right direction please. > > -Mike > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

3 4

Re: FreeRADIUS + OpenLDAP + MSCHAPv2
by Tim Gustafson 18 Nov '08

18 Nov '08

Ok, I've upgraded to FreeRADIUS 2.0.5 on a FreeBSD box (the FreeBSD ports is more up-to-date than the CentOS Yum repositories apparently). However, upon reading the documentation in modules/ldap, I see this: # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. So, does this mean that you can't do MSCHAPv2 against an LDAP server, or am I missing something again? Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

3 2

authenticating to an Windows AD
by Mike Diggins 18 Nov '08

18 Nov '08

Folks, I have freeradius running on a fedora linux box. I want to use it for authentication from an Apache web server using the radius interface. That part is working, and I'm able to authenticate web users only if they have a local account on the freeradius server. I want freeradius to authenticate against a Windows Active Directory. I installed Samba and am running Winbind, and wbinfo/ntlm_auth both are able to authenticate from the command line assuming I give it a valid username and password. What module in freeradius do I use to authenticate through Winbind? Could someone point me in the right direction please. -Mike

1 0

Test Radius Client supporting PEAP-EAP MD5
by Queenie de Melo 18 Nov '08

18 Nov '08

Hi, Can anyone suggest a test radius client supporting PEAP with EAP MD5 ? I have tried JRadius Simuator , RadiusTest n others but could not get the option of PEAP with EAP MD5. Incase anyone has come across, please let me know. Warm regards Queenie

2 1

free RADIUS server + return class attribute
by Vinay 18 Nov '08

18 Nov '08

hi there, I want to configure the freeRADIUS server to return the CLASS attribute in the ACCESS-ACCEPT message,. I tried adding the attribute for a user in users file : vinay Auth-type:=CHAP,User-Password="vinay",Class="Admin" The attribute is parsed. But when i try to connect with a RADIUS client, the freeRADIUS server crashes. What is the correct method of passing attributes from RADIUS server to the RADIUS Client? Thanks Vinay

2 1

oracle
by Alexandre Chapellon 18 Nov '08

18 Nov '08

Does anyone already used oracle stored proc as auth queries? Is it known to worl or known not to work? regards

2 2