- Freeradius-Users - lists.freeradius.org

Exercising Challenge/Response code path in pam client?
by Richard Perrin 24 Sep '16

24 Sep '16

Hi, I'm seeking a simple as possible config for freeradius server (version 2.1.12+dfsg-1.2ubuntu8.1 in Ubuntu 14.04) that would allow me to exercise the Challenge/Response path in the pam client (packaged as libpam-radius-auth-1.3.17). I see PW_ACCESS_CHALLENGE in several modules, but I haven't made the leap on how to configure the server to have pam-radius-auth (currently successfully authenticating against the server) receive an Access-Challenge instead of Accept/Reject. My end goal is verification of the client side code, rather than a production server deployment. Could you please provide me with guidance? Thanks Alan, and others, for both these pieces of software. - Richard Perrin

2 7

Translate authentication requests
by Laurens Vets 23 Sep '16

23 Sep '16

Hello list, I've got FreeRADIUS working with both OpenVPN (Android app + Windows) and StrongSwan (Android app). Authentication method used is eap-gtc with SSHA2 passwords. This all works. I'm now trying to integrate macOS and iOS clients as well, but I'm having a bit of a problem here. When either client sets up a connection to StrongSwan, FreeRADIUS receives an MSCHAPv2 request, which obviously doesn't work with SSHA2 passwords. Is there a way to either translate or proxy this MSCHAPv2 request into for instance an EAP-GTC request or is there a way to force the client to not use MSCHAPv2?

3 4

Linelog Event-Timestamp format
by rocky marciano 23 Sep '16

23 Sep '16

Hi, Im using linelog module and trying to generate a CSV file with the attribute "Event-Timestamp" with a custom format. The problem is that the module convert the value to a specific human readable format: Accounting-Request { Start = "%{Acct-Status-Type},%{Event- Timestamp},%{NAS-IP-Address},%{Framed-IP-Address},%{Called- Station-Id},%{Calling-Station-Id},%{Acct-Session-Id}" with that configuration I get: Start, Sep 10 2016 16:07:48,1.1.1.1,2.2.2.2,test.test,23354566767, 36u0qqarui9vlszx Is there a way to tell the module a required format for the date? Thanks.

3 8

Re: (freeradius 3) I'm trying to integrate freeradius with active directory in cenos 7.
by Marcelo Martinez 23 Sep '16

23 Sep '16

Hello, Thanks alan and other users for the help. I think all is working, but I don't know how to test freeradius with active directory users on localhost (radius server) Sorry for the dumb question. Any help please? Thanks.- On Mon, Sep 19, 2016 at 5:12 PM, Marcelo Martinez < marcelo.martinez(a)nexa.com.uy> wrote: > I fixed the issue with radtest. > > # radtest bob hello 127.0.0.1 0 testing123 > Sending Access-Request Id 154 from 0.0.0.0:47029 to 127.0.0.1:1812 > User-Name = 'bob' > User-Password = 'hello' > NAS-IP-Address = 192.168.72.22 > NAS-Port = 0 > Message-Authenticator = 0x00 > Received Access-Accept Id 154 from 127.0.0.1:1812 to 127.0.0.1:47029 > length 20 > > Thanks.- > > On Mon, Sep 19, 2016 at 4:58 PM, Marcelo Martinez < > marcelo.martinez(a)nexa.com.uy> wrote: > >> winbind is running >> >> # systemctl status winbind >> ● winbind.service - Samba Winbind Daemon >> Loaded: loaded (/usr/lib/systemd/system/winbind.service; disabled; >> vendor preset: disabled) >> Active: active (running) since lun 2016-09-19 16:39:35 UYT; 4min 43s >> ago >> Main PID: 4752 (winbindd) >> Status: "winbindd: ready to serve connections..." >> CGroup: /system.slice/winbind.service >> ├─4752 /usr/sbin/winbindd >> └─4753 /usr/sbin/winbindd >> >> sep 19 16:39:35 prueba systemd[1]: Starting Samba Winbind Daemon... >> sep 19 16:39:35 prueba winbindd[4752]: [2016/09/19 16:39:35.538056, 0] >> ../source3/winbindd/winbindd_cache.c:3235(initialize_winbindd_cache) >> sep 19 16:39:35 prueba winbindd[4752]: initialize_winbindd_cache: >> clearing cache and re-creating with version number 2 >> sep 19 16:39:35 prueba winbindd[4752]: [2016/09/19 16:39:35.542982, 0] >> ../lib/util/become_daemon.c:124(daemon_ready) >> sep 19 16:39:35 prueba winbindd[4752]: STATUS=daemon 'winbindd' >> finished starting up and ready to serve connections >> sep 19 16:39:35 prueba systemd[1]: Started Samba Winbind Daemon. >> >> My progress is fine... >> >> wbinfo -a Administrador%Passw0rd >> plaintext password authentication failed >> Could not authenticate user Administrador%Passw0rd with plaintext password >> challenge/response password authentication succeeded >> [root@miem-radius-test raddb]# ntlm_auth --request-nt-key --domain=TEST >> --username=Administrador --password=Passw0rd >> NT_STATUS_OK: Success (0x0) >> >> but radtest is not working... >> >> radtest -t mschap bob hello localhost 0 testing123 >> -bash: radtest: command not found >> >> yum provides radtest >> Complementos cargados:ps >> miemrepo-base >> | 3.6 kB 00:00:00 >> miemrepo-epel >> | 4.3 kB 00:00:00 >> miemrepo-base/filelists_db >> | 6.2 MB 00:00:00 >> miemrepo-epel/filelists_db >> | 7.1 MB 00:00:00 >> freeradius-utils-3.0.4-6.el7.x86_64 : FreeRADIUS utilities >> Repositorio : testrepo-base >> Resultado obtenido desde: >> Nombre del archivo : /usr/bin/radtest >> >> >> >> On Mon, Sep 19, 2016 at 4:34 PM, Matthew Newton [via FreeRADIUS] < >> ml-node+s1045715n5742624h28(a)n5.nabble.com> wrote: >> >>> On Mon, Sep 19, 2016 at 03:33:02PM -0300, Marcelo Martinez wrote: >>> > Any help please? >>> >>> As per my last e-mail... >>> >>> Is winbind running? >>> >>> Matthew >>> >>> >>> -- >>> Matthew Newton, Ph.D. <[hidden email] >>> <http:///user/SendEmail.jtp?type=node&node=5742624&i=0>> >>> >>> Systems Specialist, Infrastructure Services, >>> I.T. Services, University of Leicester, Leicester LE1 7RH, United >>> Kingdom >>> >>> For IT help contact helpdesk extn. 2253, <[hidden email] >>> <http:///user/SendEmail.jtp?type=node&node=5742624&i=1>> >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list >>> /users.html >>> >>> ------------------------------ >>> If you reply to this email, your message will be added to the discussion >>> below: >>> http://freeradius.1045715.n5.nabble.com/freeradius-3-I-m-try >>> ing-to-integrate-freeradius-with-active-directory-in-cenos- >>> 7-tp5742598p5742624.html >>> To unsubscribe from FreeRADIUS, click here >>> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsu…> >>> . >>> NAML >>> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macr…> >>> >> >> >

5 18

Freeradius with Windbind and Google authenticator issues with Cisco Anyconnect VPN
by Nawaz Hosany 23 Sep '16

23 Sep '16

Hi Guys I am trying to configure Google Authenticator to work with Windbind for VPN using Cisco Anyconnect on Ubuntu . Windbind works fine without Google Authenticator., but combined it does not work. I would need some help from the community. Here below are my configs and debugs/errors i am seeing: # /etc/pam.d/radiusd - PAM configuration for FreeRADIUS # # We fall back to the system default in /etc/pam.d/common-* # @include common-auth @include common-account @include common-password @include common-session auth requisite pam_google_authenticator.so forward_pass auth required pam_winbind.so use_first_pass account required pam_permit.so # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) auth [success=1 default=ignore] pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login # here's the fallback if no module succeeds # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_google_authenticator.so auth required pam_winbind.so auth required pam_permit.so auth requisite pam_deny.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config Below is the error message i am getting when trying to authenticate, i am using <AD password><google-authenticator-token>: User-Name = "testuser" User-Password = "4c330e@3O7K5401206" NAS-Port = 577536 Called-Station-Id = "10.33.3.100" Calling-Station-Id = "10.1.3.10" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "10.1.3.10" Cisco-AVPair = "mdm-tlv=device-platform=win" Cisco-AVPair = "mdm-tlv=device-mac=02-00-4c-4f-4f-50" Cisco-AVPair = "mdm-tlv=device-mac=f0-1f-af-3c-1d-b0" Cisco-AVPair = "mdm-tlv=device-type=Dell Inc. XPS L421X" Cisco-AVPair = "mdm-tlv=ac-user-agent=AnyConnect Windows 4.2.03013" Cisco-AVPair = "mdm-tlv=device-platform-version=6.1.7601 Service Pack 1" Cisco-AVPair = "mdm-tlv=device-uid=26CC5FF8D17E0CF5A9DDDBA2E53009E17488F0B66E780F33A635AA1A7ABC26B9" NAS-IP-Address = 10.33.4.100 Cisco-AVPair = "audit-session-id=0a2103640008d00057bdf75b" Cisco-AVPair = "ip:source-ip=10.1.3.10" Vendor-3076-Attr-146 = 0x4f414e444174657374 Vendor-3076-Attr-150 = 0x00000002 Cisco-AVPair = "coa-push=true" Wed Aug 24 15:43:43 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:43:43 2016 : Info: +- entering group authorize {...} Wed Aug 24 15:43:43 2016 : Info: ++[preprocess] returns ok Wed Aug 24 15:43:43 2016 : Info: ++[chap] returns noop Wed Aug 24 15:43:43 2016 : Info: ++[mschap] returns noop Wed Aug 24 15:43:43 2016 : Info: ++[digest] returns noop Wed Aug 24 15:43:43 2016 : Info: [suffix] No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 24 15:43:43 2016 : Info: [suffix] No such realm "NULL" Wed Aug 24 15:43:43 2016 : Info: ++[suffix] returns noop Wed Aug 24 15:43:43 2016 : Info: [eap] No EAP-Message, not doing EAP Wed Aug 24 15:43:43 2016 : Info: ++[eap] returns noop Wed Aug 24 15:43:43 2016 : Info: [files] users: Matched entry DEFAULT at line 58 Wed Aug 24 15:43:43 2016 : Info: ++[files] returns ok Wed Aug 24 15:43:43 2016 : Info: ++[expiration] returns noop Wed Aug 24 15:43:43 2016 : Info: ++[logintime] returns noop Wed Aug 24 15:43:43 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Aug 24 15:43:43 2016 : Info: ++[pap] returns noop Wed Aug 24 15:43:43 2016 : Info: Found Auth-Type = PAM Wed Aug 24 15:43:43 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:43:43 2016 : Info: +- entering group authenticate {...} Wed Aug 24 15:43:43 2016 : Debug: pam_pass: using pamauth string <radiusd> for pam.conf lookup Wed Aug 24 15:43:44 2016 : Debug: pam_pass: function pam_authenticate FAILED for <testuser>. Reason: Cannot make/remove an entry for the specified session Wed Aug 24 15:43:44 2016 : Info: ++[pam] returns reject Wed Aug 24 15:43:44 2016 : Info: Failed to authenticate the user. Wed Aug 24 15:43:44 2016 : Info: Using Post-Auth-Type Reject Wed Aug 24 15:43:44 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:43:44 2016 : Info: +- entering group REJECT {...} Wed Aug 24 15:43:44 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testuser Wed Aug 24 15:43:44 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Aug 24 15:43:44 2016 : Info: ++[attr_filter.access_reject] returns updated Wed Aug 24 15:43:44 2016 : Info: Delaying reject of request 0 for 1 seconds Wed Aug 24 15:43:44 2016 : Debug: Going to the next request Wed Aug 24 15:43:44 2016 : Debug: Waking up in 0.8 seconds. Wed Aug 24 15:43:44 2016 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 180 to 10.33.4.100 port 29288 Wed Aug 24 15:43:44 2016 : Debug: Waking up in 4.9 seconds. Wed Aug 24 15:43:49 2016 : Info: Cleaning up request 0 ID 180 with timestamp +23 Wed Aug 24 15:43:49 2016 : Info: Ready to process requests. Below is the log from var/log/auth.log: Aug 24 15:43:43 oatr2radius01 freeradius: pam_winbind(radiusd:auth): getting password (0x00000380) Aug 24 15:43:44 oatr2radius01 freeradius: pam_winbind(radiusd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_LOGON_FAILURE, Error message was: Logon failure Aug 24 15:43:44 oatr2radius01 freeradius: pam_winbind(radiusd:auth): user 'testuser' denied access (incorrect password or invalid membership) Aug 24 15:43:44 oatr2radius01 radiusd(pam_google_authenticator)[10570]: Invalid verification code Aug 24 15:43:44 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): getting password (0x00000000) Aug 24 15:43:44 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_WRONG_PASSWORD, Error message was: Wrong Password Aug 24 15:43:44 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): user 'testuser' denied access (incorrect password or invalid membership) However, i noticed when I only enter the AD password instead of AD Password+token, i get the following output: rad_recv: Access-Request packet from host 10.33.4.100 port 29288, id=181, length=612 User-Name = "testuser" User-Password = "4c330e@3O7K5" NAS-Port = 581632 Called-Station-Id = "10.33.3.100" Calling-Station-Id = "10.1.3.10" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "10.1.3.10" Cisco-AVPair = "mdm-tlv=device-platform=win" Cisco-AVPair = "mdm-tlv=device-mac=02-00-4c-4f-4f-50" Cisco-AVPair = "mdm-tlv=device-mac=f0-1f-af-3c-1d-b0" Cisco-AVPair = "mdm-tlv=device-type=Dell Inc. XPS L421X" Cisco-AVPair = "mdm-tlv=ac-user-agent=AnyConnect Windows 4.2.03013" Cisco-AVPair = "mdm-tlv=device-platform-version=6.1.7601 Service Pack 1" Cisco-AVPair = "mdm-tlv=device-uid=26CC5FF8D17E0CF5A9DDDBA2E53009E17488F0B66E780F33A635AA1A7ABC26B9" NAS-IP-Address = 10.33.4.100 Cisco-AVPair = "audit-session-id=0a2103640008e00057bdf9bc" Cisco-AVPair = "ip:source-ip=10.1.3.10" Vendor-3076-Attr-146 = 0x4f414e444174657374 Vendor-3076-Attr-150 = 0x00000002 Cisco-AVPair = "coa-push=true" Wed Aug 24 15:53:53 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:53:53 2016 : Info: +- entering group authorize {...} Wed Aug 24 15:53:53 2016 : Info: ++[preprocess] returns ok Wed Aug 24 15:53:53 2016 : Info: ++[chap] returns noop Wed Aug 24 15:53:53 2016 : Info: ++[mschap] returns noop Wed Aug 24 15:53:53 2016 : Info: ++[digest] returns noop Wed Aug 24 15:53:53 2016 : Info: [suffix] No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 24 15:53:53 2016 : Info: [suffix] No such realm "NULL" Wed Aug 24 15:53:53 2016 : Info: ++[suffix] returns noop Wed Aug 24 15:53:53 2016 : Info: [eap] No EAP-Message, not doing EAP Wed Aug 24 15:53:53 2016 : Info: ++[eap] returns noop Wed Aug 24 15:53:53 2016 : Info: [files] users: Matched entry DEFAULT at line 58 Wed Aug 24 15:53:53 2016 : Info: ++[files] returns ok Wed Aug 24 15:53:53 2016 : Info: ++[expiration] returns noop Wed Aug 24 15:53:53 2016 : Info: ++[logintime] returns noop Wed Aug 24 15:53:53 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Aug 24 15:53:53 2016 : Info: ++[pap] returns noop Wed Aug 24 15:53:53 2016 : Info: Found Auth-Type = PAM Wed Aug 24 15:53:53 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:53:53 2016 : Info: +- entering group authenticate {...} Wed Aug 24 15:53:53 2016 : Debug: pam_pass: using pamauth string <radiusd> for pam.conf lookup Wed Aug 24 15:53:53 2016 : Debug: pam_pass: function pam_authenticate FAILED for <testuser>. Reason: Authentication failure Wed Aug 24 15:53:53 2016 : Info: ++[pam] returns reject Wed Aug 24 15:53:53 2016 : Info: Failed to authenticate the user. Wed Aug 24 15:53:53 2016 : Info: Using Post-Auth-Type Reject Wed Aug 24 15:53:53 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:53:53 2016 : Info: +- entering group REJECT {...} Wed Aug 24 15:53:53 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testuser Wed Aug 24 15:53:53 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Aug 24 15:53:53 2016 : Info: ++[attr_filter.access_reject] returns updated Wed Aug 24 15:53:53 2016 : Info: Delaying reject of request 1 for 1 seconds Wed Aug 24 15:53:53 2016 : Debug: Going to the next request Wed Aug 24 15:53:53 2016 : Debug: Waking up in 0.6 seconds. Wed Aug 24 15:53:54 2016 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 181 to 10.33.4.100 port 29288 Wed Aug 24 15:53:54 2016 : Debug: Waking up in 4.9 seconds. Wed Aug 24 15:53:59 2016 : Info: Cleaning up request 1 ID 181 with timestamp +633 Wed Aug 24 15:53:59 2016 : Info: Ready to process requests. And /var/log/auth.log shows: Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): getting password (0x00000380) Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): user 'testuser' granted access Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): getting password (0x00000000) Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): user 'testuser' granted access I sincerely hope that someone can help me out Thanks Guys!

3 2

FR 3.0.11, RadSec, validation via an external command
by Martin Stanislav 23 Sep '16

23 Sep '16

Hi, May I ask for your comment on how to fix/deal with two issues I've experienced with FR 3.0.11? Required funcionality: RadSec TLS peer/client certificate to be validated by an external command. AFAIU certificate validation by external command (i.e. tls configuration stanza verify) requires ocsp to be enabled, accordig to FR 3.0.11 documentation. Issue 1 (OCSP checks fail for a RadSec client): FR 3.0.11 is passing a null-valued cert. store pointer over to openssl's function OCSP_basic_verify() resulting in segfault within openssl's libcrypto. Prior FR code attempt to fill ocsp_store pointer via SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_STORE) call is of no help as FR 3.0.11 code path doesn't seem to invoke a corresponding SSL_set_ex_data() function call for a RadSec client TLS connection. I'm not sure what a correct fix should look like. I've replaced the function call: ocsp_store = (X509_STORE *)SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_STORE); by a reference: ocsp_store = conf->ocsp_store; for purpose of a local test as conf->ocsp_store is already initialized at that point in code. Issue 2 (validation via external command blocked by if clause): Even if ocsp check is enabled, there seems to be little chance for external validation to kick in. Contrary to FR 3.0.11 documentation, the code requires two contending conditions to be satisfied at once. These conditions prevent external validation command from beeing called in case prior ocsp check returns OK. Local interim/test fix for both issues is attached. Thanks for your comments. Kind regards, Martin

2 3

HOW TO CHANGE PUBLIC IP RANDOMLY EVERY TIME USER CONNECT.
by Zubair Ayub 23 Sep '16

23 Sep '16

my user get every time same public ip i want to do that my user should get new public ip every time he connect.. i am not using ippool file . my ips are stored in radgroupreply. my table content id,groupname,attribute,op,value 39 1024 Service-Type == Framed-User 40 1024 Mikrotik-Address-List = 1024 43 1024 Framed-Pool == all-ips 42 1024 Framed-Protocol == PPP thanks regards zubairayub

4 18

rlm_acct_unique missing in current version of Freeradius
by Mike Ely 22 Sep '16

22 Sep '16

At least, the Centos7 package is. I'm trying to port an install over from a Centos5 box and see acct_unique all over the configs, with a corresponding log error: Failed to link to module 'rlm_acct_unique': rlm_acct_unique.so: cannot open shared object file: No such file or directory RPM tells me that rlm_acct_unique.so came with the freeradius2 package on Centos5. So I guess my question is: has this module been deprecated/removed, or is it just missing from the vendor package for some reason? Thanks, Mike

2 2

More OpenSSL badness
by Alan DeKok 22 Sep '16

22 Sep '16

Yet another list of vulnerabilities has been released for OpenSSL. The big one is this: > A malicious client can send an excessively large OCSP Status Request extension. > If that client continually requests renegotiation, sending a large OCSP Status > Request extension each time, then there will be unbounded memory growth on the > server. This will eventually lead to a Denial Of Service attack through memory > exhaustion. Servers with a default configuration are vulnerable even if they do > not support OCSP. https://www.openssl.org/news/secadv/20160922.txt <sigh> Time for everyone to upgrade OpenSSL. Again. Alan DeKok.

1 0

Re: return statement failure
by John Kristoff 22 Sep '16

22 Sep '16

On Thu, 22 Sep 2016 14:53:27 +0000 Alan DeKok <aland(a)deployingradius.com> wrote: > Upgrade to a recent version of the server. Fair enough thanks, I'll advocate for using a recent stable tarball instead of a packaged version. > Features which are undocumented are ones which probably don't work. Hah, apparently. Legacy installs are confusing, especially when they did things they shouldn't have done. There is another place in the config that has this and doesn't result in any noticeable errors: authorized { eap { ok = return } *shrug* Time to go through the config and validate everything else that might be a little wonky. Thanks for your help, John

2 1