From roacobb at gmail.com Thu Aug 20 11:37:32 2015 Content-Type: multipart/mixed; boundary="===============3769974980586739752==" MIME-Version: 1.0 From: Rodney Cobb To: scap-security-guide at lists.fedorahosted.org Subject: Re: Anyone using rhel6 ssg for centos6? Date: Fri, 15 Aug 2014 14:29:26 -0400 Message-ID: In-Reply-To: CA+t30AQ74AqLXugV4kH0UQEwA4iQAJJXKhWtdX+yRefEQ3oiRA@mail.gmail.com --===============3769974980586739752== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable I'm experiencing what Marci has described as well. I would agree with the g= oal of creating an OVAL for CentOs as well. On a similar note when I run th= e scan inside a Docker container "running" CentOs I get a complete scan. I'= m all in with goal of creating an OVAL for CentOs and Docker containers. = Rodney Cobb = rocobb(a)gitmachines.com @facetherathe 202-602-7077 > On Aug 15, 2014, at 1:48 PM, Marcin Pohl wrote: > = > I have a similar problem on AWS' AMI. OpenSCAP used to run fine, and few= weeks ago it just stopped working, all checks show up as 'not applicable.'= Is there a way to force it to just recognize it as RHEL/CentOS 6? > = > Thanks, > Marcin > = > = >> On Fri, Aug 15, 2014 at 1:46 PM, James Ford w= rote: >> Shawn, thanks for the detailed explanation. Rather than faking the syste= m into thinking it's running RHEL6, would it be possible to update the oval= definitions to include CentOS as an applicable platform? >> = >> = >> = >>> On Fri, Aug 15, 2014 at 1:10 PM, Shawn Wells wrote: >>> On 8/14/14, 5:25 PM, Jeremiah Jahn wrote: >>> > I'm using it for SL6. The problem is in openscap-cpe-oval.xml. The >>> > test for release is searching on RedHat only. >>> > >>> > I've changed mine to the following: notice the (redhat|sl) on the >>> > second line. You should be able to change it to whatever the >>> > centos-release rpm says. I can't remember right now if SSG is where I >>> > got the original xml file, or if it's the one from open-scap. It's >>> > very possible that you'll have to make sure that you'll have to alter >>> > the ssg-rhel6-cpe-dictionary.xml to point to your altered cpe-oval >>> > file. I've attached them just incase, but it took some tweaking. >>> > >>> > >> > xmlns=3D"http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"> >>> > ^(redhat|sl)-rele= ase >>> > ^6[^\d] >>> > >>> = >>> = >>> To illustrate how CPE works, as part of Greg's question.... >>> = >>> Step 1: In your OVAL check, you define which platforms the check is >>> written for. This is done by the stanzas, such as: >>> = >>> > >>> > Red Hat Enterprise Linux 6 >>> > >>> = >>> = >>> Step 2: When an SCAP interpreter parses each OVAL rule, it will parse >>> the tag above. For each listed, it will find the >>> associated to find what needs to be ran. This will >>> tell the SCAP interpreter if the OVAL rule is applicable for the system >>> being scanned. >>> = >>> For example, from SSG's CPE dictionary: >>> = >>> > >>> > Red Hat Enterprise Linux 6</tit= le> >>> > <!-- the check references an OVAL file that contains an i= nventory definition --> >>> > <check system=3D"http://oval.mitre.org/XMLSchema/oval-def= initions-5" href=3D"filename">installed_OS_is_rhel6</check> >>> > </cpe-item> >>> = >>> In this case, if the <platform> tag matches the cpe-item/title, then the >>> cpe-item/check will be ran. In the case of "Red Hat Enterprise Linux 6" >>> the OVAL check "installed_OS_is_rhel6" will be ran. >>> = >>> The installed_OS_is_rhel6 OVAL check queries the system to see if the >>> redhat-release-{server workstation}-6 RPM is installed, for example: >>> = >>> https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/inpu= t/checks/installed_OS_is_rhel6.xml#L46#L55 >>> > <linux:rpminfo_test check=3D"all" check_existence=3D"at_least_one_e= xists" comment=3D"redhat-release-server is version 6" id=3D"test_rhel_serve= r" version=3D"1"> >>> > <linux:object object_ref=3D"obj_rhel_server" /> >>> > <linux:state state_ref=3D"state_rhel_server" /> >>> > </linux:rpminfo_test> >>> > <linux:rpminfo_state id=3D"state_rhel_server" version=3D"1"> >>> > <linux:version operation=3D"pattern match">^6\.\d+$</linux:versio= n> >>> > </linux:rpminfo_state> >>> > <linux:rpminfo_object id=3D"obj_rhel_server" version=3D"1"> >>> > <linux:name>redhat-release-server</linux:name> >>> > </linux:rpminfo_object> >>> = >>> = >>> If the the check passes, the SCAP interpreter knows the particular OVAL >>> rule is applicable to the system, executes the probes, and you get a >>> pass/fail result. If the installed_OS_is_rhel6 check fails, the OVAL >>> rule will be marked as "Not Applicable." >>> = >>> = >>> For users running derivative operating systems (CentOS, Scientific...) >>> you can edit your CPE dictionary's regex like Jeremiah outlined. This >>> will "fake" the system into thinking it's running RHEL6 and allow the >>> check to be ran. >>> -- >>> SCAP Security Guide mailing list >>> scap-security-guide(a)lists.fedorahosted.org >>> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >>> https://github.com/OpenSCAP/scap-security-guide/ >> = >> = >> = >> -- = >> Sincerely, >> = >> James >> = >> -- >> SCAP Security Guide mailing list >> scap-security-guide(a)lists.fedorahosted.org >> https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide >> https://github.com/OpenSCAP/scap-security-guide/ > = > -- = > SCAP Security Guide mailing list > scap-security-guide(a)lists.fedorahosted.org > https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide > https://github.com/OpenSCAP/scap-security-guide/ --===============3769974980586739752== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+SSdtIGV4 cGVyaWVuY2luZyB3aGF0IE1hcmNpIGhhcyBkZXNjcmliZWQgYXMgd2VsbC4gSSB3b3VsZCBhZ3Jl ZSB3aXRoIHRoZSBnb2FsIG9mIGNyZWF0aW5nIGFuIE9WQUwgZm9yIENlbnRPcyBhcyB3ZWxsLiBP biBhIHNpbWlsYXIgbm90ZSB3aGVuIEkgcnVuIHRoZSBzY2FuIGluc2lkZSBhIERvY2tlciBjb250 YWluZXIgInJ1bm5pbmciIENlbnRPcyBJIGdldCBhIGNvbXBsZXRlIHNjYW4uIEknbSBhbGwgaW4g d2l0aCBnb2FsIG9mIGNyZWF0aW5nIGFuIE9WQUwgZm9yIENlbnRPcyBhbmQgRG9ja2VyIGNvbnRh aW5lcnMuJm5ic3A7PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5Sb2RuZXkgQ29iYiZuYnNwOzwv ZGl2PjxkaXY+PGEgaHJlZj0ibWFpbHRvOnJvY29iYkBnaXRtYWNoaW5lcy5jb20iPnJvY29iYkBn aXRtYWNoaW5lcy5jb208L2E+PC9kaXY+PGRpdj5AZmFjZXRoZXJhdGhlPC9kaXY+PGRpdj4yMDIt NjAyLTcwNzc8L2Rpdj48ZGl2Pjxicj5PbiBBdWcgMTUsIDIwMTQsIGF0IDE6NDggUE0sIE1hcmNp biBQb2hsICZsdDs8YSBocmVmPSJtYWlsdG86bWFyY2lucG9obEBnbWFpbC5jb20iPm1hcmNpbnBv aGxAZ21haWwuY29tPC9hPiZndDsgd3JvdGU6PGJyPjxicj48L2Rpdj48YmxvY2txdW90ZSB0eXBl PSJjaXRlIj48ZGl2PjxkaXYgZGlyPSJsdHIiPjxkaXY+PGRpdj5JIGhhdmUgYSBzaW1pbGFyIHBy b2JsZW0gb24gQVdTJyBBTUkuJm5ic3A7IE9wZW5TQ0FQIHVzZWQgdG8gcnVuIGZpbmUsIGFuZCBm ZXcgd2Vla3MgYWdvIGl0IGp1c3Qgc3RvcHBlZCB3b3JraW5nLCBhbGwgY2hlY2tzIHNob3cgdXAg YXMgJ25vdCBhcHBsaWNhYmxlLicmbmJzcDsgSXMgdGhlcmUgYSB3YXkgdG8gZm9yY2UgaXQgdG8g anVzdCByZWNvZ25pemUgaXQgYXMgUkhFTC9DZW50T1MgNj88YnI+Cjxicj48L2Rpdj5UaGFua3Ms PGJyPjwvZGl2Pk1hcmNpbjxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGJyPjxi cj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gRnJpLCBBdWcgMTUsIDIwMTQgYXQgMTo0NiBQ TSwgSmFtZXMgRm9yZCA8c3BhbiBkaXI9Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzpqYW1lcy50 LmZvcmRAZ21haWwuY29tIiB0YXJnZXQ9Il9ibGFuayI+amFtZXMudC5mb3JkQGdtYWlsLmNvbTwv YT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+CjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIg c3R5bGU9Im1hcmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRp bmctbGVmdDoxZXgiPjxkaXYgZGlyPSJsdHIiPlNoYXduLCB0aGFua3MgZm9yIHRoZSBkZXRhaWxl ZCBleHBsYW5hdGlvbi4gUmF0aGVyIHRoYW4gZmFraW5nIHRoZSBzeXN0ZW0gaW50byB0aGlua2lu ZyBpdCdzIHJ1bm5pbmcgUkhFTDYsIHdvdWxkIGl0IGJlIHBvc3NpYmxlIHRvIHVwZGF0ZSB0aGUg b3ZhbCBkZWZpbml0aW9ucyB0byBpbmNsdWRlIENlbnRPUyBhcyBhbiBhcHBsaWNhYmxlIHBsYXRm b3JtPzxicj4KCiZuYnNwOzxicj48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9leHRyYSI+PGRpdj48 ZGl2IGNsYXNzPSJoNSI+PGJyPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gRnJpLCBB dWcgMTUsIDIwMTQgYXQgMToxMCBQTSwgU2hhd24gV2VsbHMgPHNwYW4gZGlyPSJsdHIiPiZsdDs8 YSBocmVmPSJtYWlsdG86c2hhd25AcmVkaGF0LmNvbSIgdGFyZ2V0PSJfYmxhbmsiPnNoYXduQHJl ZGhhdC5jb208L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJyPgoKPGJsb2NrcXVvdGUgY2xhc3M9Imdt YWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjAgMCAwIC44ZXg7Ym9yZGVyLWxlZnQ6MXB4ICNjY2Mg c29saWQ7cGFkZGluZy1sZWZ0OjFleCI+PGRpdj5PbiA4LzE0LzE0LCA1OjI1IFBNLCBKZXJlbWlh aCBKYWhuIHdyb3RlOjxicj4KJmd0OyBJJ20gdXNpbmcgaXQgZm9yIFNMNi4gVGhlIHByb2JsZW0g aXMgaW4gb3BlbnNjYXAtY3BlLW92YWwueG1sLiBUaGU8YnI+CiZndDsgdGVzdCBmb3IgcmVsZWFz ZSBpcyBzZWFyY2hpbmcgb24gUmVkSGF0IG9ubHkuPGJyPgomZ3Q7PGJyPgomZ3Q7IEkndmUgY2hh bmdlZCBtaW5lIHRvIHRoZSBmb2xsb3dpbmc6IG5vdGljZSB0aGUgKHJlZGhhdHxzbCkgb24gdGhl PGJyPgomZ3Q7IHNlY29uZCBsaW5lLiBZb3Ugc2hvdWxkIGJlIGFibGUgdG8gY2hhbmdlIGl0IHRv IHdoYXRldmVyIHRoZTxicj4KJmd0OyBjZW50b3MtcmVsZWFzZSBycG0gc2F5cy4gSSBjYW4ndCBy ZW1lbWJlciByaWdodCBub3cgaWYgU1NHIGlzIHdoZXJlIEk8YnI+CiZndDsgZ290IHRoZSBvcmln aW5hbCB4bWwgZmlsZSwgb3IgaWYgaXQncyB0aGUgb25lIGZyb20gb3Blbi1zY2FwLiBJdCdzPGJy PgomZ3Q7IHZlcnkgcG9zc2libGUgdGhhdCB5b3UnbGwgaGF2ZSB0byBtYWtlIHN1cmUgdGhhdCB5 b3UnbGwgaGF2ZSB0byBhbHRlcjxicj4KJmd0OyB0aGUgc3NnLXJoZWw2LWNwZS1kaWN0aW9uYXJ5 LnhtbCB0byBwb2ludCB0byB5b3VyIGFsdGVyZWQgY3BlLW92YWw8YnI+CiZndDsgZmlsZS4gSSd2 ZSBhdHRhY2hlZCB0aGVtIGp1c3QgaW5jYXNlLCBidXQgaXQgdG9vayBzb21lIHR3ZWFraW5nLjxi cj4KJmd0Ozxicj4KJmd0OyAmbHQ7cnBtaW5mb19zdGF0ZSBpZD0ib3ZhbDpvcmcub3Blbi1zY2Fw LmNwZS5yaGVsOnN0ZTo2IiB2ZXJzaW9uPSIxIjxicj4KJmd0OyB4bWxucz0iPGEgaHJlZj0iaHR0 cDovL292YWwubWl0cmUub3JnL1hNTFNjaGVtYS9vdmFsLWRlZmluaXRpb25zLTUjbGludXgiIHRh cmdldD0iX2JsYW5rIj5odHRwOi8vb3ZhbC5taXRyZS5vcmcvWE1MU2NoZW1hL292YWwtZGVmaW5p dGlvbnMtNSNsaW51eDwvYT4iJmd0Ozxicj4KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNw OyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZsdDtuYW1lIG9wZXJh dGlvbj0icGF0dGVybiBtYXRjaCImZ3Q7XihyZWRoYXR8c2wpLXJlbGVhc2UmbHQ7L25hbWUmZ3Q7 PGJyPgomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7Jmx0O3ZlcnNpb24gb3BlcmF0aW9uPSJwYXR0ZXJuIG1hdGNo IiZndDteNlteXGRdJmx0Oy92ZXJzaW9uJmd0Ozxicj4KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZsdDsvcnBtaW5mb19zdGF0ZSZndDs8YnI+Cjxi cj4KPGJyPgo8L2Rpdj5UbyBpbGx1c3RyYXRlIGhvdyBDUEUgd29ya3MsIGFzIHBhcnQgb2YgR3Jl ZydzIHF1ZXN0aW9uLi4uLjxicj4KPGJyPgpTdGVwIDE6IEluIHlvdXIgT1ZBTCBjaGVjaywgeW91 IGRlZmluZSB3aGljaCBwbGF0Zm9ybXMgdGhlIGNoZWNrIGlzPGJyPgp3cml0dGVuIGZvci4gVGhp cyBpcyBkb25lIGJ5IHRoZSAmbHQ7YWZmZWN0ZWQmZ3Q7IHN0YW56YXMsIHN1Y2ggYXM6PGJyPgo8 YnI+CiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmbHQ7YWZmZWN0ZWQgZmFtaWx5PSJ1 bml4IiZndDs8YnI+CiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7Jmx0O3Bs YXRmb3JtJmd0O1JlZCBIYXQgRW50ZXJwcmlzZSBMaW51eCA2Jmx0Oy9wbGF0Zm9ybSZndDs8YnI+ CiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmbHQ7L2FmZmVjdGVkJmd0Ozxicj4KPGJy Pgo8YnI+ClN0ZXAgMjogV2hlbiBhbiBTQ0FQIGludGVycHJldGVyIHBhcnNlcyBlYWNoIE9WQUwg cnVsZSwgaXQgd2lsbCBwYXJzZTxicj4KdGhlICZsdDthZmZlY3RlZCZndDsgdGFnIGFib3ZlLiBG b3IgZWFjaCAmbHQ7cGxhdGZvcm0mZ3Q7IGxpc3RlZCwgaXQgd2lsbCBmaW5kIHRoZTxicj4KYXNz b2NpYXRlZCAmbHQ7Y3BpLWl0ZW0mZ3Q7IHRvIGZpbmQgd2hhdCAmbHQ7Y2hlY2smZ3Q7IG5lZWRz IHRvIGJlIHJhbi4gVGhpcyB3aWxsPGJyPgp0ZWxsIHRoZSBTQ0FQIGludGVycHJldGVyIGlmIHRo ZSBPVkFMIHJ1bGUgaXMgYXBwbGljYWJsZSBmb3IgdGhlIHN5c3RlbTxicj4KYmVpbmcgc2Nhbm5l ZC48YnI+Cjxicj4KRm9yIGV4YW1wbGUsIGZyb20gU1NHJ3MgQ1BFIGRpY3Rpb25hcnk6PGJyPgo8 YnI+CiZndDsmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmbHQ7Y3BlLWl0ZW0gbmFtZT0iY3Bl Oi9vOnJlZGhhdDplbnRlcnByaXNlX2xpbnV4OjYiJmd0Ozxicj4KJmd0OyZuYnNwOyAmbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZsdDt0aXRsZSB4bWw6bGFuZz0iZW4t dXMiJmd0O1JlZCBIYXQgRW50ZXJwcmlzZSBMaW51eCA2Jmx0Oy90aXRsZSZndDs8YnI+CiZndDsm bmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsmbHQ7IS0tIHRo ZSBjaGVjayByZWZlcmVuY2VzIGFuIE9WQUwgZmlsZSB0aGF0IGNvbnRhaW5zIGFuIGludmVudG9y eSBkZWZpbml0aW9uIC0tJmd0Ozxicj4KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZuYnNwOyZsdDtjaGVjayBzeXN0ZW09IjxhIGhyZWY9Imh0dHA6Ly9vdmFs Lm1pdHJlLm9yZy9YTUxTY2hlbWEvb3ZhbC1kZWZpbml0aW9ucy01IiB0YXJnZXQ9Il9ibGFuayI+ aHR0cDovL292YWwubWl0cmUub3JnL1hNTFNjaGVtYS9vdmFsLWRlZmluaXRpb25zLTU8L2E+IiBo cmVmPSJmaWxlbmFtZSImZ3Q7aW5zdGFsbGVkX09TX2lzX3JoZWw2Jmx0Oy9jaGVjayZndDs8YnI+ CgoKJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyZsdDsvY3BlLWl0ZW0mZ3Q7PGJyPgo8 YnI+CkluIHRoaXMgY2FzZSwgaWYgdGhlICZsdDtwbGF0Zm9ybSZndDsgdGFnIG1hdGNoZXMgdGhl IGNwZS1pdGVtL3RpdGxlLCB0aGVuIHRoZTxicj4KY3BlLWl0ZW0vY2hlY2sgd2lsbCBiZSByYW4u IEluIHRoZSBjYXNlIG9mICJSZWQgSGF0IEVudGVycHJpc2UgTGludXggNiI8YnI+CnRoZSBPVkFM IGNoZWNrICJpbnN0YWxsZWRfT1NfaXNfcmhlbDYiIHdpbGwgYmUgcmFuLjxicj4KPGJyPgpUaGUg aW5zdGFsbGVkX09TX2lzX3JoZWw2IE9WQUwgY2hlY2sgcXVlcmllcyB0aGUgc3lzdGVtIHRvIHNl ZSBpZiB0aGU8YnI+CnJlZGhhdC1yZWxlYXNlLXtzZXJ2ZXIgd29ya3N0YXRpb259LTYgUlBNIGlz IGluc3RhbGxlZCwgZm9yIGV4YW1wbGU6PGJyPgo8YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHVi LmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlL2Jsb2IvbWFzdGVyL1JIRUwvNi9pbnB1 dC9jaGVja3MvaW5zdGFsbGVkX09TX2lzX3JoZWw2LnhtbCNMNDYlMjNMNTUiIHRhcmdldD0iX2Js YW5rIj5odHRwczovL2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS9ibG9i L21hc3Rlci9SSEVMLzYvaW5wdXQvY2hlY2tzL2luc3RhbGxlZF9PU19pc19yaGVsNi54bWwjTDQ2 I0w1NTwvYT48YnI+CgoKJmd0OyZuYnNwOyAmbmJzcDsmbHQ7bGludXg6cnBtaW5mb190ZXN0IGNo ZWNrPSJhbGwiIGNoZWNrX2V4aXN0ZW5jZT0iYXRfbGVhc3Rfb25lX2V4aXN0cyIgY29tbWVudD0i cmVkaGF0LXJlbGVhc2Utc2VydmVyIGlzIHZlcnNpb24gNiIgaWQ9InRlc3RfcmhlbF9zZXJ2ZXIi IHZlcnNpb249IjEiJmd0Ozxicj4KJmd0OyZuYnNwOyAmbmJzcDsgJm5ic3A7Jmx0O2xpbnV4Om9i amVjdCBvYmplY3RfcmVmPSJvYmpfcmhlbF9zZXJ2ZXIiIC8mZ3Q7PGJyPgomZ3Q7Jm5ic3A7ICZu YnNwOyAmbmJzcDsmbHQ7bGludXg6c3RhdGUgc3RhdGVfcmVmPSJzdGF0ZV9yaGVsX3NlcnZlciIg LyZndDs8YnI+CiZndDsmbmJzcDsgJm5ic3A7Jmx0Oy9saW51eDpycG1pbmZvX3Rlc3QmZ3Q7PGJy PgomZ3Q7Jm5ic3A7ICZuYnNwOyZsdDtsaW51eDpycG1pbmZvX3N0YXRlIGlkPSJzdGF0ZV9yaGVs X3NlcnZlciIgdmVyc2lvbj0iMSImZ3Q7PGJyPgomZ3Q7Jm5ic3A7ICZuYnNwOyAmbmJzcDsmbHQ7 bGludXg6dmVyc2lvbiBvcGVyYXRpb249InBhdHRlcm4gbWF0Y2giJmd0O142XC5cZCskJmx0Oy9s aW51eDp2ZXJzaW9uJmd0Ozxicj4KJmd0OyZuYnNwOyAmbmJzcDsmbHQ7L2xpbnV4OnJwbWluZm9f c3RhdGUmZ3Q7PGJyPgomZ3Q7Jm5ic3A7ICZuYnNwOyZsdDtsaW51eDpycG1pbmZvX29iamVjdCBp ZD0ib2JqX3JoZWxfc2VydmVyIiB2ZXJzaW9uPSIxIiZndDs8YnI+CiZndDsmbmJzcDsgJm5ic3A7 ICZuYnNwOyZsdDtsaW51eDpuYW1lJmd0O3JlZGhhdC1yZWxlYXNlLXNlcnZlciZsdDsvbGludXg6 bmFtZSZndDs8YnI+CiZndDsmbmJzcDsgJm5ic3A7Jmx0Oy9saW51eDpycG1pbmZvX29iamVjdCZn dDs8YnI+Cjxicj4KPGJyPgpJZiB0aGUgdGhlIGNoZWNrIHBhc3NlcywgdGhlIFNDQVAgaW50ZXJw cmV0ZXIga25vd3MgdGhlIHBhcnRpY3VsYXIgT1ZBTDxicj4KcnVsZSBpcyBhcHBsaWNhYmxlIHRv IHRoZSBzeXN0ZW0sIGV4ZWN1dGVzIHRoZSBwcm9iZXMsIGFuZCB5b3UgZ2V0IGE8YnI+CnBhc3Mv ZmFpbCByZXN1bHQuIElmIHRoZSBpbnN0YWxsZWRfT1NfaXNfcmhlbDYgY2hlY2sgZmFpbHMsIHRo ZSBPVkFMPGJyPgpydWxlIHdpbGwgYmUgbWFya2VkIGFzICJOb3QgQXBwbGljYWJsZS4iPGJyPgo8 YnI+Cjxicj4KRm9yIHVzZXJzIHJ1bm5pbmcgZGVyaXZhdGl2ZSBvcGVyYXRpbmcgc3lzdGVtcyAo Q2VudE9TLCBTY2llbnRpZmljLi4uKTxicj4KeW91IGNhbiBlZGl0IHlvdXIgQ1BFIGRpY3Rpb25h cnkncyByZWdleCBsaWtlIEplcmVtaWFoIG91dGxpbmVkLiBUaGlzPGJyPgp3aWxsICJmYWtlIiB0 aGUgc3lzdGVtIGludG8gdGhpbmtpbmcgaXQncyBydW5uaW5nIFJIRUw2IGFuZCBhbGxvdyB0aGU8 YnI+CmNoZWNrIHRvIGJlIHJhbi48YnI+CjxkaXY+PGRpdj4tLTxicj4KU0NBUCBTZWN1cml0eSBH dWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRl QGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciIHRhcmdldD0iX2JsYW5rIj5zY2FwLXNlY3VyaXR5LWd1 aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PGJyPgo8YSBocmVmPSJodHRwczovL2xpc3Rz LmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlIiB0 YXJnZXQ9Il9ibGFuayI+aHR0cHM6Ly9saXN0cy5mZWRvcmFob3N0ZWQub3JnL21haWxtYW4vbGlz dGluZm8vc2NhcC1zZWN1cml0eS1ndWlkZTwvYT48YnI+CjxhIGhyZWY9Imh0dHBzOi8vZ2l0aHVi LmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBz Oi8vZ2l0aHViLmNvbS9PcGVuU0NBUC9zY2FwLXNlY3VyaXR5LWd1aWRlLzwvYT48L2Rpdj48L2Rp dj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjxiciBjbGVhcj0iYWxsIj48YnI+PC9kaXY+PC9kaXY+ PHNwYW4gY2xhc3M9IkhPRW5aYiI+PGZvbnQgY29sb3I9IiM4ODg4ODgiPi0tIDxicj4KU2luY2Vy ZWx5LDxkaXY+PGJyPjwvZGl2PjxkaXY+SmFtZXM8L2Rpdj4KCjwvZm9udD48L3NwYW4+PC9kaXY+ Cjxicj4tLTxicj4KU0NBUCBTZWN1cml0eSBHdWlkZSBtYWlsaW5nIGxpc3Q8YnI+CjxhIGhyZWY9 Im1haWx0bzpzY2FwLXNlY3VyaXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmciPnNjYXAt c2VjdXJpdHktZ3VpZGVAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZzwvYT48YnI+CjxhIGhyZWY9Imh0 dHBzOi8vbGlzdHMuZmVkb3JhaG9zdGVkLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3NjYXAtc2VjdXJp dHktZ3VpZGUiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcv bWFpbG1hbi9saXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjxicj4KPGEgaHJlZj0iaHR0 cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvIiB0YXJnZXQ9Il9i bGFuayI+aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvPC9h Pjxicj48L2Jsb2NrcXVvdGU+PC9kaXY+PGJyPjwvZGl2Pgo8L2Rpdj48L2Jsb2NrcXVvdGU+PGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48c3Bhbj4tLSA8L3NwYW4+PGJyPjxzcGFuPlNDQVAg U2VjdXJpdHkgR3VpZGUgbWFpbGluZyBsaXN0PC9zcGFuPjxicj48c3Bhbj48YSBocmVmPSJtYWls dG86c2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3JnIj5zY2FwLXNlY3Vy aXR5LWd1aWRlQGxpc3RzLmZlZG9yYWhvc3RlZC5vcmc8L2E+PC9zcGFuPjxicj48c3Bhbj48YSBo cmVmPSJodHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9saXN0aW5mby9zY2Fw LXNlY3VyaXR5LWd1aWRlIj5odHRwczovL2xpc3RzLmZlZG9yYWhvc3RlZC5vcmcvbWFpbG1hbi9s aXN0aW5mby9zY2FwLXNlY3VyaXR5LWd1aWRlPC9hPjwvc3Bhbj48YnI+PHNwYW4+PGEgaHJlZj0i aHR0cHM6Ly9naXRodWIuY29tL09wZW5TQ0FQL3NjYXAtc2VjdXJpdHktZ3VpZGUvIj5odHRwczov L2dpdGh1Yi5jb20vT3BlblNDQVAvc2NhcC1zZWN1cml0eS1ndWlkZS88L2E+PC9zcGFuPjwvZGl2 PjwvYmxvY2txdW90ZT48L2JvZHk+PC9odG1sPg== --===============3769974980586739752==--