From shawn at redhat.com Thu Aug 20 11:35:33 2015 Content-Type: multipart/mixed; boundary="===============4089211845369588618==" MIME-Version: 1.0 From: Shawn Wells To: scap-security-guide at lists.fedorahosted.org Subject: Re: [PATCH] [RHEL6] Fix couple of typos in the text in 'Restrict Root Logins' document Date: Sun, 13 Oct 2013 23:51:56 -0400 Message-ID: <525B6A5C.8070102@redhat.com> In-Reply-To: 743047597.4513093.1381495558907.JavaMail.root@redhat.com --===============4089211845369588618== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On 10/11/13 8:45 AM, Jan Lieskovsky wrote: > This proposal fixes couple of text typos in the 'Restrict Root Logins' > document: > * replace /etc/secuetty with /etc/securetty, > * s/on thesyste,/on the system,/ > * s/passowrd/password/ > * s/as as user can login/as user can login/ > * remove couple instances of whitespace noise at the end of rows, > * be consistent - globally use one space character to start new > sentence (in cca 3 cases there have been two spaces). > > Thank you && Regards, Jan. > -- > Jan iankko Lieskovsky / Red Hat Security Technologies Team > > 0001-RHEL6-Fix-couple-of-typos-in-the-text-in-Restrict-Ro.patch > > > From caab207a8c8a587914d9a1b318d972bbd678896c Mon Sep 17 00:00:00 2001 > From: Jan Lieskovsky > Date: Fri, 11 Oct 2013 14:38:27 +0200 > Subject: [PATCH] [RHEL6] Fix couple of typos in the text in 'Restrict Root > Logins' document > > > Signed-off-by: Jan Lieskovsky > --- > .../system/accounts/restrictions/root_logins.xml | 35 +++++++++++----= ------- > 1 file changed, 18 insertions(+), 17 deletions(-) > > diff --git a/RHEL6/input/system/accounts/restrictions/root_logins.xml b/R= HEL6/input/system/accounts/restrictions/root_logins.xml > index 2f21dd9..547c712 100644 > --- a/RHEL6/input/system/accounts/restrictions/root_logins.xml > +++ b/RHEL6/input/system/accounts/restrictions/root_logins.xml > @@ -25,14 +25,15 @@ include guidance describing how to prevent root from = logging in via SSH. > > Direct root Logins Not Allowed > To further limit access to the root account, admi= nistrators > -can disable root logins at the console by editing the /etc/secuetty<= /tt> file. > +can disable root logins at the console by editing the /etc/securetty= file. > This file lists all devices the root user is allowed to login to. If th= e file does > -not exist at all, the root user can login through any communication devi= ce on thesyste, > -whether via the console or a raw network interface. This is dangerous as= as user can login to > -his machine as root via Telnet, which sends the passowrd in plain text o= ver the network. > -By default, Red Hat Enteprise Linux's /etc/securetty file only = allows the root user > -to login at the console physically attached to the machine. To prevent r= oot from logging in, > -remove the contents of this file. To prevent direct root logins, remove = the contents of this > +not exist at all, the root user can login through any communication devi= ce on the > +system, whether via the console or via a raw network interface. This is = dangerous > +as user can login to his machine as root via Telnet, which sends the pas= sword in > +plain text over the network. By default, Red Hat Enteprise Linux's > +/etc/securetty file only allows the root user to login at the c= onsole > +physically attached to the machine. To prevent root from logging in, rem= ove the > +contents of this file. To prevent direct root logins, remove the content= s of this > file by typing the following command: >
>   echo > /etc/securetty
> @@ -47,7 +48,7 @@ If any output is returned, this is a finding.
>   
>   Disabling direct root logins ensures proper accountability and multifac=
tor
>   authentication to privileged accounts. Users will first login, then esc=
alate
> -to privileged (root) access via su/sudo. This is required for FISMA Low
> +to privileged (root) access via su / sudo. This is required for FISMA Low
>   and FISMA Moderate systems.
>   
>   
> @@ -110,16 +111,16 @@ using the root account.
>   
>   Restrict Web Browser Use for Administrative Accounts
>   
> -Enforce policy requiring administrative accounts use web browsers only f=
or
> +Enforce policy requiring administrative accounts use web browsers only f=
or
>   local service administration.
>   
>   
> -Check the root home directory for a .mozilla directory=
.  If
> +Check the root home directory for a .mozilla directory=
. If
>   one exists, ensure browsing is limited to local service administration.
>   
>   
> -If a browser vulnerability is exploited while running with administrativ=
e privileges,
> -the entire system could be compromised.  Specific exceptions for local s=
ervice
> +If a browser vulnerability is exploited while running with administrativ=
e privileges,
> +the entire system could be compromised. Specific exceptions for local se=
rvice
>   administration should be documented in site-defined policy.
>   
>   
> @@ -133,8 +134,8 @@ function. Should an attacker be able to log into thes=
e accounts,
>   they should not be granted access to a shell.
>   

> The login shell for each local account is stored in the last field of e= ach line > -in /etc/passwd. System accounts are those user accounts with a= user ID less than > -500. The user ID is stored in the third field. > +in /etc/passwd. System accounts are those user accounts with a = user ID less than > +500. The user ID is stored in the third field. > If any system account SYSACCT (other than root) has a login shel= l, > disable it with the command: >
# usermod -s /sbin/nologin SYSACCT
> @@ -195,18 +196,18 @@ access to root privileges in an accountable manner. > Assuming root shell is bash, edit the following files: >
~/.profile
>
~/.bashrc
> -Change any PATH variables to the vendor default for root and re= move any > +Change any PATH variables to the vendor default for root and re= move any > empty PATH entries or references to relative paths. > > > To view the root user's PATH, run the following command: >
# env | grep PATH
> -If correctly configured, the PATH must: use vendor default sett= ings, > +If correctly configured, the PATH must: use vendor default sett= ings, > have no empty entries, and have no entries beginning with a character > other than a slash (/). >
> > -The root account's executable search path must be the vendor default, an= d must > +The root account's executable search path must be the vendor default, an= d must > contain only absolute paths. > > I thought this was replied to, but in case not... ack --===============4089211845369588618== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRG LTgiIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSI+CiAgPC9oZWFkPgogIDxib2R5IGJnY29sb3I9 IiNGRkZGRkYiIHRleHQ9IiMwMDAwMDAiPgogICAgPGRpdiBjbGFzcz0ibW96LWNpdGUtcHJlZml4 Ij5PbiAxMC8xMS8xMyA4OjQ1IEFNLCBKYW4gTGllc2tvdnNreQogICAgICB3cm90ZTo8YnI+CiAg ICA8L2Rpdj4KICAgIDxibG9ja3F1b3RlCiAgICAgIGNpdGU9Im1pZDo3NDMwNDc1OTcuNDUxMzA5 My4xMzgxNDk1NTU4OTA3LkphdmFNYWlsLnJvb3RAcmVkaGF0LmNvbSIKICAgICAgdHlwZT0iY2l0 ZSI+CiAgICAgIDxkaXYgY2xhc3M9Im1vei10ZXh0LXBsYWluIiB3cmFwPSJ0cnVlIiBncmFwaGlj YWwtcXVvdGU9InRydWUiCiAgICAgICAgc3R5bGU9ImZvbnQtZmFtaWx5OiAtbW96LWZpeGVkOyBm b250LXNpemU6IDEycHg7IgogICAgICAgIGxhbmc9IngtdW5pY29kZSI+CiAgICAgICAgPHByZSB3 cmFwPSIiPlRoaXMgcHJvcG9zYWwgZml4ZXMgY291cGxlIG9mIHRleHQgdHlwb3MgaW4gdGhlICdS ZXN0cmljdCBSb290IExvZ2lucycKZG9jdW1lbnQ6CiogcmVwbGFjZSAmbHQ7dHQmZ3Q7L2V0Yy9z ZWN1ZXR0eSZsdDsvdHQmZ3Q7IHdpdGggJmx0O3R0Jmd0Oy9ldGMvc2VjdXJldHR5Jmx0Oy90dCZn dDssCiogcy9vbiB0aGVzeXN0ZSwvb24gdGhlIHN5c3RlbSwvCiogcy9wYXNzb3dyZC9wYXNzd29y ZC8KKiBzL2FzIGFzIHVzZXIgY2FuIGxvZ2luL2FzIHVzZXIgY2FuIGxvZ2luLwoqIHJlbW92ZSBj b3VwbGUgaW5zdGFuY2VzIG9mIHdoaXRlc3BhY2Ugbm9pc2UgYXQgdGhlIGVuZCBvZiByb3dzLAoq IGJlIGNvbnNpc3RlbnQgLSBnbG9iYWxseSB1c2Ugb25lIHNwYWNlIGNoYXJhY3RlciB0byBzdGFy dCBuZXcKICBzZW50ZW5jZSAoaW4gY2NhIDMgY2FzZXMgdGhlcmUgaGF2ZSBiZWVuIHR3byBzcGFj ZXMpLgoKVGhhbmsgeW91ICZhbXA7JmFtcDsgUmVnYXJkcywgSmFuLgotLQpKYW4gaWFua2tvIExp ZXNrb3Zza3kgLyBSZWQgSGF0IFNlY3VyaXR5IFRlY2hub2xvZ2llcyBUZWFtPC9wcmU+CiAgICAg IDwvZGl2PgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRI ZWFkZXIiPjxsZWdlbmQKICAgICAgICAgIGNsYXNzPSJtaW1lQXR0YWNobWVudEhlYWRlck5hbWUi PjAwMDEtUkhFTDYtRml4LWNvdXBsZS1vZi10eXBvcy1pbi10aGUtdGV4dC1pbi1SZXN0cmljdC1S by5wYXRjaDwvbGVnZW5kPjwvZmllbGRzZXQ+CiAgICAgIDxicj4KICAgICAgPGRpdiBjbGFzcz0i bW96LXRleHQtcGxhaW4iIHdyYXA9InRydWUiIGdyYXBoaWNhbC1xdW90ZT0idHJ1ZSIKICAgICAg ICBzdHlsZT0iZm9udC1mYW1pbHk6IC1tb3otZml4ZWQ7IGZvbnQtc2l6ZTogMTJweDsiCiAgICAg ICAgbGFuZz0ieC13ZXN0ZXJuIj4KICAgICAgICA8cHJlIHdyYXA9IiI+RnJvbSBjYWFiMjA3YThj OGE1ODc5MTRkOWExYjMxOGQ5NzJiYmQ2Nzg4OTZjIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpG cm9tOiBKYW4gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3ot dHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRoYXQuY29tIj4mbHQ7 amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+CkRhdGU6IEZyaSwgMTEgT2N0IDIwMTMgMTQ6Mzg6 MjcgKzAyMDAKU3ViamVjdDogW1BBVENIXSBbUkhFTDZdIEZpeCBjb3VwbGUgb2YgdHlwb3MgaW4g dGhlIHRleHQgaW4gJ1Jlc3RyaWN0IFJvb3QKIExvZ2lucycgZG9jdW1lbnQKCgpTaWduZWQtb2Zm LWJ5OiBKYW4gTGllc2tvdnNreSA8YSBtb3otZG8tbm90LXNlbmQ9InRydWUiIGNsYXNzPSJtb3ot dHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpqbGllc2tvdkByZWRoYXQuY29tIj4mbHQ7 amxpZXNrb3ZAcmVkaGF0LmNvbSZndDs8L2E+Ci0tLQogLi4uL3N5c3RlbS9hY2NvdW50cy9yZXN0 cmljdGlvbnMvcm9vdF9sb2dpbnMueG1sICAgfCAzNSArKysrKysrKysrKy0tLS0tLS0tLS0tCiAx IGZpbGUgY2hhbmdlZCwgMTggaW5zZXJ0aW9ucygrKSwgMTcgZGVsZXRpb25zKC0pCgpkaWZmIC0t Z2l0IGEvUkhFTDYvaW5wdXQvc3lzdGVtL2FjY291bnRzL3Jlc3RyaWN0aW9ucy9yb290X2xvZ2lu cy54bWwgYi9SSEVMNi9pbnB1dC9zeXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Jvb3RfbG9n aW5zLnhtbAppbmRleCAyZjIxZGQ5Li41NDdjNzEyIDEwMDY0NAotLS0gYS9SSEVMNi9pbnB1dC9z eXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Jvb3RfbG9naW5zLnhtbAorKysgYi9SSEVMNi9p bnB1dC9zeXN0ZW0vYWNjb3VudHMvcmVzdHJpY3Rpb25zL3Jvb3RfbG9naW5zLnhtbApAQCAtMjUs MTQgKzI1LDE1IEBAIGluY2x1ZGUgZ3VpZGFuY2UgZGVzY3JpYmluZyBob3cgdG8gcHJldmVudCBy b290IGZyb20gbG9nZ2luZyBpbiB2aWEgU1NILgogJmx0O1J1bGUgaWQ9Im5vX2RpcmVjdF9yb290 X2xvZ2lucyIgc2V2ZXJpdHk9Im1lZGl1bSImZ3Q7CiAmbHQ7dGl0bGUmZ3Q7RGlyZWN0IHJvb3Qg TG9naW5zIE5vdCBBbGxvd2VkJmx0Oy90aXRsZSZndDsKICZsdDtkZXNjcmlwdGlvbiZndDtUbyBm dXJ0aGVyIGxpbWl0IGFjY2VzcyB0byB0aGUgJmx0O3R0Jmd0O3Jvb3QmbHQ7L3R0Jmd0OyBhY2Nv dW50LCBhZG1pbmlzdHJhdG9ycwotY2FuIGRpc2FibGUgcm9vdCBsb2dpbnMgYXQgdGhlIGNvbnNv bGUgYnkgZWRpdGluZyB0aGUgJmx0O3R0Jmd0Oy9ldGMvc2VjdWV0dHkmbHQ7L3R0Jmd0OyBmaWxl LiAKK2NhbiBkaXNhYmxlIHJvb3QgbG9naW5zIGF0IHRoZSBjb25zb2xlIGJ5IGVkaXRpbmcgdGhl ICZsdDt0dCZndDsvZXRjL3NlY3VyZXR0eSZsdDsvdHQmZ3Q7IGZpbGUuCiBUaGlzIGZpbGUgbGlz dHMgYWxsIGRldmljZXMgdGhlIHJvb3QgdXNlciBpcyBhbGxvd2VkIHRvIGxvZ2luIHRvLiBJZiB0 aGUgZmlsZSBkb2VzCi1ub3QgZXhpc3QgYXQgYWxsLCB0aGUgcm9vdCB1c2VyIGNhbiBsb2dpbiB0 aHJvdWdoIGFueSBjb21tdW5pY2F0aW9uIGRldmljZSBvbiB0aGVzeXN0ZSwKLXdoZXRoZXIgdmlh IHRoZSBjb25zb2xlIG9yIGEgcmF3IG5ldHdvcmsgaW50ZXJmYWNlLiBUaGlzIGlzIGRhbmdlcm91 cyBhcyBhcyB1c2VyIGNhbiBsb2dpbiB0bwotaGlzIG1hY2hpbmUgYXMgcm9vdCB2aWEgVGVsbmV0 LCB3aGljaCBzZW5kcyB0aGUgcGFzc293cmQgaW4gcGxhaW4gdGV4dCBvdmVyIHRoZSBuZXR3b3Jr LgotQnkgZGVmYXVsdCwgUmVkIEhhdCBFbnRlcHJpc2UgTGludXgncyAmbHQ7dHQmZ3Q7L2V0Yy9z ZWN1cmV0dHkmbHQ7L3R0Jmd0OyBmaWxlIG9ubHkgYWxsb3dzIHRoZSByb290IHVzZXIKLXRvIGxv Z2luIGF0IHRoZSBjb25zb2xlIHBoeXNpY2FsbHkgYXR0YWNoZWQgdG8gdGhlIG1hY2hpbmUuIFRv IHByZXZlbnQgcm9vdCBmcm9tIGxvZ2dpbmcgaW4sCi1yZW1vdmUgdGhlIGNvbnRlbnRzIG9mIHRo aXMgZmlsZS4gVG8gcHJldmVudCBkaXJlY3Qgcm9vdCBsb2dpbnMsIHJlbW92ZSB0aGUgY29udGVu dHMgb2YgdGhpcworbm90IGV4aXN0IGF0IGFsbCwgdGhlIHJvb3QgdXNlciBjYW4gbG9naW4gdGhy b3VnaCBhbnkgY29tbXVuaWNhdGlvbiBkZXZpY2Ugb24gdGhlCitzeXN0ZW0sIHdoZXRoZXIgdmlh IHRoZSBjb25zb2xlIG9yIHZpYSBhIHJhdyBuZXR3b3JrIGludGVyZmFjZS4gVGhpcyBpcyBkYW5n ZXJvdXMKK2FzIHVzZXIgY2FuIGxvZ2luIHRvIGhpcyBtYWNoaW5lIGFzIHJvb3QgdmlhIFRlbG5l dCwgd2hpY2ggc2VuZHMgdGhlIHBhc3N3b3JkIGluCitwbGFpbiB0ZXh0IG92ZXIgdGhlIG5ldHdv cmsuIEJ5IGRlZmF1bHQsIFJlZCBIYXQgRW50ZXByaXNlIExpbnV4J3MKKyZsdDt0dCZndDsvZXRj L3NlY3VyZXR0eSZsdDsvdHQmZ3Q7IGZpbGUgb25seSBhbGxvd3MgdGhlIHJvb3QgdXNlciB0byBs b2dpbiBhdCB0aGUgY29uc29sZQorcGh5c2ljYWxseSBhdHRhY2hlZCB0byB0aGUgbWFjaGluZS4g VG8gcHJldmVudCByb290IGZyb20gbG9nZ2luZyBpbiwgcmVtb3ZlIHRoZQorY29udGVudHMgb2Yg dGhpcyBmaWxlLiBUbyBwcmV2ZW50IGRpcmVjdCByb290IGxvZ2lucywgcmVtb3ZlIHRoZSBjb250 ZW50cyBvZiB0aGlzCiBmaWxlIGJ5IHR5cGluZyB0aGUgZm9sbG93aW5nIGNvbW1hbmQ6CiAmbHQ7 cHJlJmd0OwogZWNobyAmZ3Q7IC9ldGMvc2VjdXJldHR5CkBAIC00Nyw3ICs0OCw3IEBAIElmIGFu eSBvdXRwdXQgaXMgcmV0dXJuZWQsIHRoaXMgaXMgYSBmaW5kaW5nLgogJmx0O3JhdGlvbmFsZSZn dDsKIERpc2FibGluZyBkaXJlY3Qgcm9vdCBsb2dpbnMgZW5zdXJlcyBwcm9wZXIgYWNjb3VudGFi aWxpdHkgYW5kIG11bHRpZmFjdG9yCiBhdXRoZW50aWNhdGlvbiB0byBwcml2aWxlZ2VkIGFjY291 bnRzLiBVc2VycyB3aWxsIGZpcnN0IGxvZ2luLCB0aGVuIGVzY2FsYXRlCi10byBwcml2aWxlZ2Vk IChyb290KSBhY2Nlc3MgdmlhIHN1L3N1ZG8uIFRoaXMgaXMgcmVxdWlyZWQgZm9yIEZJU01BIExv dwordG8gcHJpdmlsZWdlZCAocm9vdCkgYWNjZXNzIHZpYSBzdSAvIHN1ZG8uIFRoaXMgaXMgcmVx dWlyZWQgZm9yIEZJU01BIExvdwogYW5kIEZJU01BIE1vZGVyYXRlIHN5c3RlbXMuCiAmbHQ7L3Jh dGlvbmFsZSZndDsKICZsdDtyZWYgbmlzdD0iSUEtMigxKSIgLyZndDsKQEAgLTExMCwxNiArMTEx LDE2IEBAIHVzaW5nIHRoZSByb290IGFjY291bnQuCiAmbHQ7UnVsZSBpZD0ibm9fcm9vdF93ZWJi cm93c2luZyImZ3Q7CiAmbHQ7dGl0bGUmZ3Q7UmVzdHJpY3QgV2ViIEJyb3dzZXIgVXNlIGZvciBB ZG1pbmlzdHJhdGl2ZSBBY2NvdW50cyZsdDsvdGl0bGUmZ3Q7CiAmbHQ7ZGVzY3JpcHRpb24mZ3Q7 Ci1FbmZvcmNlIHBvbGljeSByZXF1aXJpbmcgYWRtaW5pc3RyYXRpdmUgYWNjb3VudHMgdXNlIHdl YiBicm93c2VycyBvbmx5IGZvciAKK0VuZm9yY2UgcG9saWN5IHJlcXVpcmluZyBhZG1pbmlzdHJh dGl2ZSBhY2NvdW50cyB1c2Ugd2ViIGJyb3dzZXJzIG9ubHkgZm9yCiBsb2NhbCBzZXJ2aWNlIGFk bWluaXN0cmF0aW9uLgogJmx0Oy9kZXNjcmlwdGlvbiZndDsKICZsdDtvY2lsIGNsYXVzZT0idGhp cyBpcyBub3QgdGhlIGNhc2UiJmd0OwotQ2hlY2sgdGhlICZsdDt0dCZndDtyb290Jmx0Oy90dCZn dDsgaG9tZSBkaXJlY3RvcnkgZm9yIGEgJmx0O3R0Jmd0Oy5tb3ppbGxhJmx0Oy90dCZndDsgZGly ZWN0b3J5LiAgSWYgCitDaGVjayB0aGUgJmx0O3R0Jmd0O3Jvb3QmbHQ7L3R0Jmd0OyBob21lIGRp cmVjdG9yeSBmb3IgYSAmbHQ7dHQmZ3Q7Lm1vemlsbGEmbHQ7L3R0Jmd0OyBkaXJlY3RvcnkuIElm CiBvbmUgZXhpc3RzLCBlbnN1cmUgYnJvd3NpbmcgaXMgbGltaXRlZCB0byBsb2NhbCBzZXJ2aWNl IGFkbWluaXN0cmF0aW9uLgogJmx0Oy9vY2lsJmd0OwogJmx0O3JhdGlvbmFsZSZndDsKLUlmIGEg YnJvd3NlciB2dWxuZXJhYmlsaXR5IGlzIGV4cGxvaXRlZCB3aGlsZSBydW5uaW5nIHdpdGggYWRt aW5pc3RyYXRpdmUgcHJpdmlsZWdlcywgCi10aGUgZW50aXJlIHN5c3RlbSBjb3VsZCBiZSBjb21w cm9taXNlZC4gIFNwZWNpZmljIGV4Y2VwdGlvbnMgZm9yIGxvY2FsIHNlcnZpY2UgCitJZiBhIGJy b3dzZXIgdnVsbmVyYWJpbGl0eSBpcyBleHBsb2l0ZWQgd2hpbGUgcnVubmluZyB3aXRoIGFkbWlu aXN0cmF0aXZlIHByaXZpbGVnZXMsCit0aGUgZW50aXJlIHN5c3RlbSBjb3VsZCBiZSBjb21wcm9t aXNlZC4gU3BlY2lmaWMgZXhjZXB0aW9ucyBmb3IgbG9jYWwgc2VydmljZQogYWRtaW5pc3RyYXRp b24gc2hvdWxkIGJlIGRvY3VtZW50ZWQgaW4gc2l0ZS1kZWZpbmVkIHBvbGljeS4KICZsdDsvcmF0 aW9uYWxlJmd0OwogJmx0Oy9SdWxlJmd0OwpAQCAtMTMzLDggKzEzNCw4IEBAIGZ1bmN0aW9uLiBT aG91bGQgYW4gYXR0YWNrZXIgYmUgYWJsZSB0byBsb2cgaW50byB0aGVzZSBhY2NvdW50cywKIHRo ZXkgc2hvdWxkIG5vdCBiZSBncmFudGVkIGFjY2VzcyB0byBhIHNoZWxsLgogJmx0O2JyIC8mZ3Q7 Jmx0O2JyIC8mZ3Q7CiBUaGUgbG9naW4gc2hlbGwgZm9yIGVhY2ggbG9jYWwgYWNjb3VudCBpcyBz dG9yZWQgaW4gdGhlIGxhc3QgZmllbGQgb2YgZWFjaCBsaW5lCi1pbiAmbHQ7dHQmZ3Q7L2V0Yy9w YXNzd2QmbHQ7L3R0Jmd0Oy4gIFN5c3RlbSBhY2NvdW50cyBhcmUgdGhvc2UgdXNlciBhY2NvdW50 cyB3aXRoIGEgdXNlciBJRCBsZXNzIHRoYW4KLTUwMC4gVGhlIHVzZXIgSUQgaXMgc3RvcmVkIGlu IHRoZSB0aGlyZCBmaWVsZC4gCitpbiAmbHQ7dHQmZ3Q7L2V0Yy9wYXNzd2QmbHQ7L3R0Jmd0Oy4g U3lzdGVtIGFjY291bnRzIGFyZSB0aG9zZSB1c2VyIGFjY291bnRzIHdpdGggYSB1c2VyIElEIGxl c3MgdGhhbgorNTAwLiBUaGUgdXNlciBJRCBpcyBzdG9yZWQgaW4gdGhlIHRoaXJkIGZpZWxkLgog SWYgYW55IHN5c3RlbSBhY2NvdW50ICZsdDtpJmd0O1NZU0FDQ1QmbHQ7L2kmZ3Q7IChvdGhlciB0 aGFuIHJvb3QpIGhhcyBhIGxvZ2luIHNoZWxsLAogZGlzYWJsZSBpdCB3aXRoIHRoZSBjb21tYW5k OgogJmx0O3ByZSZndDsjIHVzZXJtb2QgLXMgL3NiaW4vbm9sb2dpbiAmbHQ7aSZndDtTWVNBQ0NU Jmx0Oy9pJmd0OyZsdDsvcHJlJmd0OwpAQCAtMTk1LDE4ICsxOTYsMTggQEAgYWNjZXNzIHRvIHJv b3QgcHJpdmlsZWdlcyBpbiBhbiBhY2NvdW50YWJsZSBtYW5uZXIuCiBBc3N1bWluZyByb290IHNo ZWxsIGlzIGJhc2gsIGVkaXQgdGhlIGZvbGxvd2luZyBmaWxlczoKICZsdDtwcmUmZ3Q7fi8ucHJv ZmlsZSZsdDsvcHJlJmd0OwogJmx0O3ByZSZndDt+Ly5iYXNocmMmbHQ7L3ByZSZndDsKLUNoYW5n ZSBhbnkgJmx0O3R0Jmd0O1BBVEgmbHQ7L3R0Jmd0OyB2YXJpYWJsZXMgdG8gdGhlIHZlbmRvciBk ZWZhdWx0IGZvciByb290IGFuZCByZW1vdmUgYW55IAorQ2hhbmdlIGFueSAmbHQ7dHQmZ3Q7UEFU SCZsdDsvdHQmZ3Q7IHZhcmlhYmxlcyB0byB0aGUgdmVuZG9yIGRlZmF1bHQgZm9yIHJvb3QgYW5k IHJlbW92ZSBhbnkKIGVtcHR5ICZsdDt0dCZndDtQQVRIJmx0Oy90dCZndDsgZW50cmllcyBvciBy ZWZlcmVuY2VzIHRvIHJlbGF0aXZlIHBhdGhzLgogJmx0Oy9kZXNjcmlwdGlvbiZndDsKICZsdDtv Y2lsIGNsYXVzZT0iYW55IG9mIHRoZXNlIGNvbmRpdGlvbnMgYXJlIG5vdCBtZXQiJmd0OwogVG8g dmlldyB0aGUgcm9vdCB1c2VyJ3MgJmx0O3R0Jmd0O1BBVEgmbHQ7L3R0Jmd0OywgcnVuIHRoZSBm b2xsb3dpbmcgY29tbWFuZDoKICZsdDtwcmUmZ3Q7IyBlbnYgfCBncmVwIFBBVEgmbHQ7L3ByZSZn dDsKLUlmIGNvcnJlY3RseSBjb25maWd1cmVkLCB0aGUgJmx0O3R0Jmd0O1BBVEgmbHQ7L3R0Jmd0 OyBtdXN0OiB1c2UgdmVuZG9yIGRlZmF1bHQgc2V0dGluZ3MsIAorSWYgY29ycmVjdGx5IGNvbmZp Z3VyZWQsIHRoZSAmbHQ7dHQmZ3Q7UEFUSCZsdDsvdHQmZ3Q7IG11c3Q6IHVzZSB2ZW5kb3IgZGVm YXVsdCBzZXR0aW5ncywKIGhhdmUgbm8gZW1wdHkgZW50cmllcywgYW5kIGhhdmUgbm8gZW50cmll cyBiZWdpbm5pbmcgd2l0aCBhIGNoYXJhY3Rlcgogb3RoZXIgdGhhbiBhIHNsYXNoICgvKS4KICZs dDsvb2NpbCZndDsKICZsdDtyYXRpb25hbGUmZ3Q7Ci1UaGUgcm9vdCBhY2NvdW50J3MgZXhlY3V0 YWJsZSBzZWFyY2ggcGF0aCBtdXN0IGJlIHRoZSB2ZW5kb3IgZGVmYXVsdCwgYW5kIG11c3QgCitU aGUgcm9vdCBhY2NvdW50J3MgZXhlY3V0YWJsZSBzZWFyY2ggcGF0aCBtdXN0IGJlIHRoZSB2ZW5k b3IgZGVmYXVsdCwgYW5kIG11c3QKIGNvbnRhaW4gb25seSBhYnNvbHV0ZSBwYXRocy4KICZsdDsv cmF0aW9uYWxlJmd0OwogJmx0O3Rlc3RlZCBieT0iRFMiIG9uPSIyMDEyMTAyNCIvJmd0OzwvcHJl PgogICAgICA8L2Rpdj4KICAgIDwvYmxvY2txdW90ZT4KICAgIDxicj4KICAgIDxicj4KICAgIEkg dGhvdWdodCB0aGlzIHdhcyByZXBsaWVkIHRvLCBidXQgaW4gY2FzZSBub3QuLi4gYWNrPGJyPgog IDwvYm9keT4KPC9odG1sPgo= --===============4089211845369588618==--