- Freeradius-Users - lists.freeradius.org

Bug in CUI generation? Is this a known issue?
by stefan.paetow＠diamond.ac.uk 14 May '13

14 May '13

I'm playing around with CUI generation with FreeRADIUS 2.2.0 and discovered something odd. In policy.conf I've set cui_require_operator_name = 1 and cui_hash_key = "4c2982f2f3b1dc4804994cf386db8c0a34d4ab2a". As you can see it's a 32-character string and it looks like a hash. In radiusd -X output I get this: Ready to process requests. rad_recv: Access-Request packet from host 192.168.126.155 port 1814, id=17, length=113 User-Name = "steve(a)diamond.ac.uk" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x80a453196d15a8e68ba13642ba725b24 Proxy-State = 0x30 Operator-Name = "1camford.ac.uk" Chargeable-User-Identity = "" Proxy-State = 0x313630 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++? if (!(User-Name =~ /@/)) ?? Evaluating (User-Name =~ /@/) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(User-Name =~ /@/)) -> FALSE ++? if (User-Name =~ /@$/) ? Evaluating (User-Name =~ /@$/) -> FALSE ++? if (User-Name =~ /@$/) -> FALSE ++? if (User-Name =~ /@.+?@/) ? Evaluating (User-Name =~ /@.+?@/) -> FALSE ++? if (User-Name =~ /@.+?@/) -> FALSE ++? if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) ? Evaluating (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE ++? if (User-Name =~ /@.+?[^[:alnum:]\\.-]/) -> FALSE ++? if (User-Name =~ /(a)[\\.-]/) ? Evaluating (User-Name =~ /(a)[\\.-]/) -> FALSE ++? if (User-Name =~ /(a)[\\.-]/) -> FALSE ++? if (User-Name =~ /@.+?[\\.-]$/) ? Evaluating (User-Name =~ /@.+?[\\.-]$/) -> FALSE ++? if (User-Name =~ /@.+?[\\.-]$/) -> FALSE ++? if (User-Name =~ /(a)[^\\.]+$/) ? Evaluating (User-Name =~ /(a)[^\\.]+$/) -> FALSE ++? if (User-Name =~ /(a)[^\\.]+$/) -> FALSE ++? if (User-Name =~ /@.+?\\.\\./) ? Evaluating (User-Name =~ /@.+?\\.\\./) -> FALSE ++? if (User-Name =~ /@.+?\\.\\./) -> FALSE ++? if (User-Name =~ /(a)myabc\\.com$/i) ? Evaluating (User-Name =~ /(a)myabc\\.com$/i) -> FALSE ++? if (User-Name =~ /(a)myabc\\.com$/i) -> FALSE ++? if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) ? Evaluating (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE ++? if (User-Name =~ /@wlan\\.[[:alnum:]]+\\.[[:alnum:]]+\\.3gppnetwork\\.org$/i) -> FALSE ++? if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ? Evaluating (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@gmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ? Evaluating (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@yahoo\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) ? Evaluating (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /@hotmail\\.co(m|\\.[[:alnum:]][[:alnum:]])$/i) -> FALSE ++? if (User-Name =~ /(a)\\.?ac\\.uk$/i) ? Evaluating (User-Name =~ /(a)\\.?ac\\.uk$/i) -> FALSE ++? if (User-Name =~ /(a)\\.?ac\\.uk$/i) -> FALSE ++? if (User-Name =~ /@.+?\\.ax\\.uk$/i) ? Evaluating (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE ++? if (User-Name =~ /@.+?\\.ax\\.uk$/i) -> FALSE ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "diamond.ac.uk" for User-Name = "steve(a)diamond.ac.uk" [suffix] Found realm "diamond.ac.uk" [suffix] Adding Stripped-User-Name = "steve" [suffix] Adding Realm = "diamond.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry steve at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++- entering policy cui_postauth {...} +++? if (FreeRadius-Proxied-To == 127.0.0.1) (Attribute FreeRadius-Proxied-To was not found) ? Evaluating (FreeRadius-Proxied-To == 127.0.0.1) -> FALSE +++? if (FreeRadius-Proxied-To == 127.0.0.1) -> FALSE +++- entering else else {...} ++++? if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity && !(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) expand: %{control:Proxy-To-Realm} -> ?? Evaluating ("%{control:Proxy-To-Realm}") -> FALSE ? Converting !FALSE -> TRUE ? Evaluating (Chargeable-User-Identity ) -> TRUE ?? Evaluating (reply:Chargeable-User-Identity) -> FALSE ? Converting !FALSE -> TRUE ?? Evaluating (Operator-Name ) -> TRUE ??? Skipping ("${policy.cui_require_operator_name}") ++++? if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity &&!(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) -> TRUE ++++- entering if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity &&!(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) {...} expand: %{md5:4c2982f2f3b1dc4804994cf386db8c0a34d4ab2a%{User-Name}%{%{Operator-Name}:-}} -> +++++[reply] returns noop ++++- if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity && !(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) returns noop +++- else else returns noop ++- policy cui_postauth returns noop As you can see, the expand: bit shows an empty value. Then I changed my cui_hash_key to "01234567890abcdef01234567890abcdef" and it did the same. However, when I set cui_hash_key to a hex string that was not 32 characters in length ("abcdef" as an example), or a non-hex string of any length, it works ok. So I'm guessing here that if the cui_hash_key happens to be a string that is a potentially valid MD5 hash, the md5 operator in the CUI generation statement does nothing or barfs. Working fragment: ++++- entering if (!("%{control:Proxy-To-Realm}") && Chargeable-User-Identity &&!(reply:Chargeable-User-Identity) && (Operator-Name || !("${policy.cui_require_operator_name}")) ) {...} expand: %{Operator-Name} -> 1camford.ac.uk expand: abcdef%{User-Name}%{%{Operator-Name}:-} -> abcdefsteve(a)diamond.ac.uk1camford.ac.uk expand: %{md5:abcdef%{User-Name}%{%{Operator-Name}:-}} -> 330a6f12e7152cb8888ef6aaa30b1aed +++++[reply] returns noop If this is known already, then that's fine (because it means you'll probably fix it in the future). Just thought I'd flag this up. In the meanwhile I've changed my cui_hash_key to something non-hex to avoid this issue. Stefan Paetow Software Engineer +44 1235 778812 Diamond Light Source Ltd. Diamond House, Harwell Science and Innovation Campus Didcot, Oxfordshire, OX11 0DE -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

5 7

FreeRadius Ceritificate Migration
by Mitch Yackobeck 14 May '13

14 May '13

3 2

RE: Inner tunnel post auth question
by Franks Andy (RLZ) IT Systems Engineer 13 May '13

13 May '13

Hi, The upgraded freeradius works fine, no surprise there I guess. Can't get any updated control, reply or whatever attributes to pass back to the default virtual server from the tunnel though, try as I might. Perhaps it's something to do with it being PEAP? I tried the authorize section and post auth section, but it never makes it through. It's not really critical at this point, just annoying me. I'm sure it's something I need to do differently but I'm not sure what. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 11 May 2013 14:26 To: FreeRadius users mailing list Subject: Re: Inner tunnel post auth question Franks Andy (RLZ) IT Systems Engineer wrote: > My FR version is 2.1.10+dfsg-3build2_amd64. Unless there’s a nice > package for Ubuntu 12.04 server then I’ll be compiling from source then > I think. Yes. Upgrading would be good. > so yes, the “use_tunneled reply” bit is there. Is that what’s causing > the copying of attributes from within the tunnel to fail, or is that > setting what it’s supposed to be? The "use_tunneled_reply" configuration only works for Access-Accept. > I’m still getting my head around the > eap thing – like for example why I need authorization and authentication > settings in the inner-tunnel virtual server for eap again – my intuition > would tell me that the inner eap just needs mschap in there if that’s > the protocol inside the tunnel, but then perhaps it’s something to do > with the “protection” bit of peap that means it’s a “tunnel within a > tunnel” or something. Like I said still getting my head around it all. You need "eap" in the inner-tunnel because PEAP sends EAP in the inner-tunnel. > I’d still like to get the attributes copying from the inner to outer > tunnels regardless of the fix in 2.2. It’s gnawing at me a bit. Well... if you want a feature from a later version of the server, upgrade. You can't magically create a feature without code changes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FreeRadius Wimax-TLV with external program
by Ali Majdzadeh 12 May '13

12 May '13

Hi I’m using freeradius 2.1.12 with external program for authentication (Written in C), so I’m sending radius attributes in Access-Accept by printf. How can I send Wimax-TLV? May someone give me a sample? *Ali Majdzadeh Kohbanani* *Managing Director* *Abshar Data Processing* *Tel:+982144160700 * * Tel/Fax: +982144160701 * *Cell:+989123614728* *majdzadeh(a)abshar.biz * *http://www.abshar.biz*

2 1

RE: Inner tunnel post auth question
by Franks Andy (RLZ) IT Systems Engineer 11 May '13

11 May '13

My FR version is 2.1.10+dfsg-3build2_amd64. Unless there's a nice package for Ubuntu 12.04 server then I'll be compiling from source then I think. This is the peap bit of eap.conf : peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes # proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" so yes, the "use_tunneled reply" bit is there. Is that what's causing the copying of attributes from within the tunnel to fail, or is that setting what it's supposed to be? I'm still getting my head around the eap thing - like for example why I need authorization and authentication settings in the inner-tunnel virtual server for eap again - my intuition would tell me that the inner eap just needs mschap in there if that's the protocol inside the tunnel, but then perhaps it's something to do with the "protection" bit of peap that means it's a "tunnel within a tunnel" or something. Like I said still getting my head around it all. I'd still like to get the attributes copying from the inner to outer tunnels regardless of the fix in 2.2. It's gnawing at me a bit. Thanks Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alex Sharaz Sent: 10 May 2013 14:09 To: FreeRadius users mailing list Subject: Re: Inner tunnel post auth question Andy, What version of FreeRadius are you using? I *think* that unless you are using the git source for 2.2.1, post-auth reject is broken. There was some stuff I was doing a few months ago that got fixed in 2.2.1 ... but I'm getting old and can't remember all the details :-( On 10 May 2013, at 13:53, Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> wrote: Hi, This may have come up before but I can't find any solutions : I'm using a NAS which always performs EAP/MSCHAP2 authentication, so I've stripped the sites-enabled/default right down to pretty much just include the eap stuff for authorisation/authentication, and am doing all the rest inside the inner tunnel - fine. When the radius returns an access-accept, it runs the stuff in the inner-tunnel post_auth section ok, and I can record the attributes I want to a mysql db, including a custom ldap attribute inserted into a control variable. However it seems that following a reject, the post_auth reject section of inner-tunnel isn't actually used, so it doesn't record any info about the attributes in the sql database if I use an sql call. Ok .. so do it in the default post_auth reject bit - ok but I can't figure how to pass back control variables to the outer tunnel. I'd imagine it should be similar to the description in the post auth reject section of the inner tunnel : update outer.reply { User-Name = "%{request:User-Name}" } have u got use_tunneled_reply = yes set up in eap.conf? Rgds Alex But the section never gets called, so I tried putting it after the ldap authorization bit, as I can't do it in the authentication part, or so I gather (no unlang support in there?). In the below update, ldap-UserDescription is my custom attribute, which I can see from the logs is being populated : [ldap] description -> Ldap-UserDescription == "test ip phone" Authorize { .. .. ldap update outer.control { Ldap-UserDescription := "%{control:Ldap-UserDescription}" } } But again it doesn't make it through (or am I doing it wrong?) +- entering group REJECT {...} expand: %{control:Ldap-UserDescription} -> : ++[reply] returns noop Am I being stupid? The best thing would be for the post_auth reject section in inner tunnel to run, but failing that I need to work out the control item passback to the outer tunnel. Thanks for any help in advance! Andy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Need help with making RPM from v2.x.x branch
by Divyesh Raithatha 10 May '13

10 May '13

Hello all, has anyone had success in building an RPM from the v2.x.x branch from http://git.freeradius.org? I am following the information from http://wiki.freeradius.org/guide/Red-Hat-FAQ On a CentOS 6.4 x64 system I was able to build an RPM from 2.2.0 source successfully but I want to get all of the recent patches from the v2.x.x branch. However, when I tried to build the RPM from v2.x.x I get the following message: Hunk #1 FAILED at 121. 1 out of 1 hunk FAILED -- saving rejects to file src/main/radtest.in.rej error: Bad exit status from /var/tmp/rpm-tmp.uETav5 (%prep) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.uETav5 (%prep) Here is the radtest.in.rej file contents: --- src/main/radtest.in 2011-09-30 10:12:07.000000000 -0400 +++ src/main/radtest.in 2012-01-05 15:51:56.877585514 -0500 @@ -121,7 +121,7 @@ echo "EAP-Code = Response" echo "EAP-Type-Identity = \"$1\"" fi - if [ "$6" ] + if [ ! -z "$6" ] && [[ $6 =~ ^[0-9]+$ ]] && [ $6 -gt 0 ] then echo "Framed-Protocol = PPP" fi Here is the contents of /var/tmp/rpm-tmp.uETav5 #!/bin/sh RPM_SOURCE_DIR="/home/test/rpmbuild/SOURCES" RPM_BUILD_DIR="/home/test/rpmbuild/BUILD" RPM_OPT_FLAGS="-O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic" RPM_ARCH="x86_64" RPM_OS="linux" export RPM_SOURCE_DIR RPM_BUILD_DIR RPM_OPT_FLAGS RPM_ARCH RPM_OS RPM_DOC_DIR="/usr/share/doc" export RPM_DOC_DIR RPM_PACKAGE_NAME="freeradius" RPM_PACKAGE_VERSION="2.2.0" RPM_PACKAGE_RELEASE="1.el6" export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE LANG=C export LANG unset CDPATH DISPLAY ||: RPM_BUILD_ROOT="/home/test/rpmbuild/BUILDROOT/freeradius-2.2.0-1.el6.x86_64" export RPM_BUILD_ROOT PKG_CONFIG_PATH="/usr/lib64/pkgconfig:/usr/share/pkgconfig" export PKG_CONFIG_PATH set -x umask 022 cd "/home/test/rpmbuild/BUILD" LANG=C export LANG unset DISPLAY cd '/home/test/rpmbuild/BUILD' rm -rf 'freeradius-server-2.2.0' /usr/bin/bzip2 -dc '/home/test/rpmbuild/SOURCES/freeradius-server-2.2.0.tar.bz2' | /bin/tar -xf - STATUS=$? if [ $STATUS -ne 0 ]; then exit $STATUS fi cd 'freeradius-server-2.2.0' /bin/chmod -Rf a+rX,u+w,g-w,o-w . echo "Patch #1 (freeradius-cert-config.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-cert-config.patch | /usr/bin/patch -p1 -b --suffix .cert-config --fuzz=0 echo "Patch #2 (freeradius-radtest.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-radtest.patch | /usr/bin/patch -p1 -b --suffix .radtest --fuzz=0 #%patch3 -p1 -b .man #%patch4 -p1 -b .unix-passwd-expire echo "Patch #5 (freeradius-radeapclient-ipv6.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-radeapclient-ipv6.patch | /usr/bin/patch -p1 -b --suffix .radeapclient-ipv6 --fuzz=0 #%patch6 -p1 #%patch7 -p1 -b perl echo "Patch #8 (freeradius-dhcp_sqlippool.patch):" /bin/cat /home/test/rpmbuild/SOURCES/freeradius-dhcp_sqlippool.patch | /usr/bin/patch -p1 --fuzz=0 # Some source files mistakenly have execute permissions set find $RPM_BUILD_DIR/freeradius-server-2.2.0 $ -name '*.c' -o -name '*.h' $ -a -perm /0111 -exec chmod a-x {} + exit 0 Any Ideas? Thank you.

6 15

Inner tunnel post auth question
by Franks Andy (RLZ) IT Systems Engineer 10 May '13

10 May '13

Hi, This may have come up before but I can't find any solutions : I'm using a NAS which always performs EAP/MSCHAP2 authentication, so I've stripped the sites-enabled/default right down to pretty much just include the eap stuff for authorisation/authentication, and am doing all the rest inside the inner tunnel - fine. When the radius returns an access-accept, it runs the stuff in the inner-tunnel post_auth section ok, and I can record the attributes I want to a mysql db, including a custom ldap attribute inserted into a control variable. However it seems that following a reject, the post_auth reject section of inner-tunnel isn't actually used, so it doesn't record any info about the attributes in the sql database if I use an sql call. Ok .. so do it in the default post_auth reject bit - ok but I can't figure how to pass back control variables to the outer tunnel. I'd imagine it should be similar to the description in the post auth reject section of the inner tunnel : update outer.reply { User-Name = "%{request:User-Name}" } But the section never gets called, so I tried putting it after the ldap authorization bit, as I can't do it in the authentication part, or so I gather (no unlang support in there?). In the below update, ldap-UserDescription is my custom attribute, which I can see from the logs is being populated : [ldap] description -> Ldap-UserDescription == "test ip phone" Authorize { .. .. ldap update outer.control { Ldap-UserDescription := "%{control:Ldap-UserDescription}" } } But again it doesn't make it through (or am I doing it wrong?) +- entering group REJECT {...} expand: %{control:Ldap-UserDescription} -> : ++[reply] returns noop Am I being stupid? The best thing would be for the post_auth reject section in inner tunnel to run, but failing that I need to work out the control item passback to the outer tunnel. Thanks for any help in advance! Andy

3 2

how to get linelog() see see packet-types other than access-request
by Jeff Smith 09 May '13

09 May '13

Hello, I've got a freeradius server 2.2.0 configured to process requests, and now I'd like to add some logging that would look something like this: Wed May 8 14:53:16 2013 Access-Request for abcd(a)purdue.edu from MAC address (Calling-Station-Id) 84-3a-4b-0c-46-44 NAS lwsn-b143-wism2-11 I actually have that working, but would like for linelog to also log a line for packet types access-challenge, access-accept, and access-reject. My /opt/freeradius/etc/raddb/modules/linelog has: reference = "%{%{Packet-Type}:-format}" # # Followed by a series of log messages. Access-Request = "%t %{Packet-Type} for %{User-Name} from MAC address (Calling-Station-Id) %{Calling-Station-Id} NAS %{NAS-IDentifier}" Access-Reject = "Rejected access: %{User-Name} Calling-Station-Id=%{Calling-Station-Id} NAS=%{NAS-IDentifier}" Access-Challenge = "Sent challenge: %{User-Name} Calling-Station-Id=%{Calling-Station-Id} NAS=%{NAS-IDentifier}" Access-Accept = "Accepted access: %{User-Name} Calling-Station-Id=%{Calling-Station-Id} NAS=%{NAS-IDentifier}" That is, slight changes from the examples given. I've added calls to linelog to the following sections in sites-enabled/default and sites-enabled/inner-tunnel: authorize authenticate preacct accounting post-auth

2 2

radgroupcheck attributes and test client
by ch2009＠arcor.de 09 May '13

09 May '13

All, I'm a newbie in radius. I've setup freeradius with mySQL and max-daily-session. When I set max-daily-session := 10 in radgroupcheck table, a user of this group can login (accept packet after authentication), even if he already has been logged in for 10 seconds before. I'm using NTRadPing and Radius Test Rig Utily as a client. I've sent accounting packages. Radacct table got populated (beginning and end of session, no octets). Is it a client issue? Must NTRadPing send any additional parameters? Any help is appreciated. Chris

4 7

re: RE: how to get linelog() see see packet-types other than access-request
by Jeff Smith 08 May '13

08 May '13

Argh. Please accept my apologies -- I accidentally sent the previous message before I had finished composing it. Jeff

1 0