From vince.passaro at fotisnetworks.com Thu Aug 20 11:31:50 2015 Content-Type: multipart/mixed; boundary="===============6233830548640768017==" MIME-Version: 1.0 From: Vincent Passaro To: scap-security-guide at lists.fedorahosted.org Subject: RE: disa-stig-rhel5-v1r0.6-xccdf-manual.xml Date: Wed, 08 Aug 2012 01:47:13 +0000 Message-ID: In-Reply-To: 502190E4.4060306@redhat.com --===============6233830548640768017== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable It=E2=80=99s sad to see DISA SCAP taking the community 3 steps forward 4 st= eps back. We now have more manual checks than when we were using the SRR=E2=80=99s an= d no standardization or reporting format. These two things combined make i= t difficult to use the SCAP since we now have to run the XCCDF / OVAL check= s, go back into the manual checks, figure out what wasn=E2=80=99t addressed= , and then do it manually. Honestly, it would take more time just do to the full 600 checks manually t= hen to mess around with the =C2=BD put together content. From: scap-security-guide-bounces(a)lists.fedorahosted.org [mailto:scap-sec= urity-guide-bounces(a)lists.fedorahosted.org] On Behalf Of Shawn Wells Sent: Tuesday, August 07, 2012 3:04 PM To: scap-security-guide(a)lists.fedorahosted.org Subject: Re: disa-stig-rhel5-v1r0.6-xccdf-manual.xml Shannon hit it on the head. The xccdf-manual includes "procedural" checks t= hat can not be automated with OVAL. An example of that would be there are g= overnment policies mandating proper backups, however there isn't a single s= ystem flag or command that can verify this. The intent is to process "proc= edural checks" is to use OCIL, however that is still very much evolving. Note that the disa-stig-* files are included for us to reference while we b= uild out content for the RHEL6 STIG. As a community we wanted to ensure tha= t we inherited RHEL5 STIG controls where appropriate, so we dropped the dis= a-stig-* files into the RHEL6/references directory to allow developers to d= ouble check things. Those files absolutely should not be considered officia= l DISA content! In regards to SSG output things will still be dropped into rhel6-xccdf-scap= -security-guide.xml. -Shawn On 8/7/12 4:14 PM, Shannon Mitchell wrote: I'm just guessing here, but it looks like the manual is meant to be the ful= l thing. The oval language seems very limited on what it can do, so it onl= y takes care of a small subset of the full set of checks. The bad thing is= that it looks like the nessus scans that I have seen run against my system= s check for all of them and not just the 350 in the benchmark. On Tue, Aug 7, 2012 at 4:03 PM, Willem Bos > wrote: Hi Shannon, Thanks. OK, so where do the extra id's come from? I grep-ed the whole scap-security-guide directory on a id from the *-manual.xml file but - apart from the file itself - got no results... Regards, Willem. On Tue, Aug 7, 2012 at 9:20 PM, Shannon Mitchell > wrote: > Every gen Id in the benchmark is in the manual. The manual contains all = 350 > plus an extra 219. > > On Aug 7, 2012 1:41 PM, "Willem Bos" > wrote: >> >> Hi Jeffrey, >> >> Are you sure disa-stig-rhel5-v1r0.6-xccdf-manual.xml is based on >> disa-stig-rhel5-v1r0.6-xccdf.xml? >> >> The *-manual.xml file contains a lot more GEN* tags : >> >> grep -c 'GEN' U_RedHat_5_V1R0.6_STIG_Benchmark-xccdf.xml >> 350 >> >> grep -c '<title>GEN' >> scap-security-guide/RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf.xml >> 350 >> >> grep -c '<title>GEN' >> >> scap-security-guide/RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-manual= .xml >> 569 >> >> Maybe I'm missing something obvious but like I said, I'm new to this stu= ff >> :) >> >> Regards, >> Willem. >> >> >> On Mon, Aug 6, 2012 at 4:20 PM, Jeffrey Blank <blank(a)eclipse.ncsc.mil<= mailto:blank(a)eclipse.ncsc.mil>> >> wrote: >> > This should be the same semantically (as the authoritative version from >> > iase.disa.mil<http://iase.disa.mil>) -- I just ran it through xmllint = (or was it tidy?) to >> > make it readable in a text editor. (And yes, I should have documented >> > this.) >> > >> > I really can't remember which, but if you'd like to do a quick re-run = of >> > each and compare, it would certainly be good for us to document its >> > congruence with the official version :) >> > >> > (Also note that we are not the maintainers of that content for RHEL 5.) >> > >> > >> > >> > >> > On 08/06/2012 03:00 AM, Willem Bos wrote: >> >> Hi All, >> >> >> >> The GIT repo contains the file >> >> RHEL6/references/disa-stig-rhel5-v1r0.6-xccdf-manual.xml. This is not >> >> part of the zipfile you can download from >> >> http://web.nvd.nist.gov/view/ncp/repository/checklist/download?id=3D1= 059. >> >> >> >> I could not find a Makefile target that creates it. What is its origi= n? >> >> >> >> Regards, >> >> Willem. --===============6233830548640768017== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTQgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpUYWhvbWE7DQoJcGFub3NlLTE6MiAxMSA2 IDQgMyA1IDQgNCAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBs aS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9t Oi4wMDAxcHQ7DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250LWZhbWlseToiVGltZXMgTmV3IFJv bWFuIiwic2VyaWYiOw0KCWNvbG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsN Cgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9u OnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNv LXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5k ZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJl cGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIiwic2Fucy1zZXJpZiI7DQoJY29sb3I6IzFGNDk3 RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250 LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsN CgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtw YWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwh W2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9 ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlv dXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBiZ2NvbG9yPSJ3aGl0ZSIgbGFu Zz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNl Y3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEu MHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90 Oztjb2xvcjojMUY0OTdEIj5JdOKAmXMgc2FkIHRvIHNlZSBESVNBIFNDQVAgdGFraW5nIHRoZSBj b21tdW5pdHkgMyBzdGVwcyBmb3J3YXJkIDQgc3RlcHMgYmFjay4NCjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztj b2xvcjojMUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDtD YWxpYnJpJnF1b3Q7LCZxdW90O3NhbnMtc2VyaWYmcXVvdDs7Y29sb3I6IzFGNDk3RCI+V2Ugbm93 IGhhdmUgbW9yZSBtYW51YWwgY2hlY2tzIHRoYW4gd2hlbiB3ZSB3ZXJlIHVzaW5nIHRoZSBTUlLi gJlzIGFuZCBubyBzdGFuZGFyZGl6YXRpb24gb3IgcmVwb3J0aW5nIGZvcm1hdC4mbmJzcDsgVGhl c2UgdHdvIHRoaW5ncyBjb21iaW5lZCBtYWtlIGl0IGRpZmZpY3VsdCB0bw0KIHVzZSB0aGUgU0NB UCBzaW5jZSB3ZSBub3cgaGF2ZSB0byBydW4gdGhlIFhDQ0RGIC8gT1ZBTCBjaGVja3MsIGdvIGJh Y2sgaW50byB0aGUgbWFudWFsIGNoZWNrcywgZmlndXJlIG91dCB3aGF0IHdhc27igJl0IGFkZHJl c3NlZCwgYW5kIHRoZW4gZG8gaXQgbWFudWFsbHkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1p bHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5zLXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5 N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O0NhbGlicmkmcXVv dDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjojMUY0OTdEIj5Ib25lc3RseSwgaXQgd291 bGQgdGFrZSBtb3JlIHRpbWUganVzdCBkbyB0byB0aGUgZnVsbCA2MDAgY2hlY2tzIG1hbnVhbGx5 IHRoZW4gdG8gbWVzcyBhcm91bmQgd2l0aCB0aGUgwr0gcHV0IHRvZ2V0aGVyIGNvbnRlbnQuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7Q2FsaWJyaSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7O2NvbG9yOiMxRjQ5N0QiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O0NhbGlicmkmcXVvdDssJnF1b3Q7c2Fucy1zZXJpZiZxdW90Oztjb2xvcjoj MUY0OTdEIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjQjVDNERGIDEuMHB0O3BhZGRpbmc6My4wcHQg MGluIDBpbiAwaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMC4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VGFob21hJnF1b3Q7LCZxdW90O3NhbnMtc2Vy aWYmcXVvdDs7Y29sb3I6d2luZG93dGV4dCI+RnJvbTo8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJm b250LXNpemU6MTAuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1RhaG9tYSZxdW90OywmcXVvdDtzYW5z LXNlcmlmJnF1b3Q7O2NvbG9yOndpbmRvd3RleHQiPiBzY2FwLXNlY3VyaXR5LWd1aWRlLWJvdW5j ZXNAbGlzdHMuZmVkb3JhaG9zdGVkLm9yZyBbbWFpbHRvOnNjYXAtc2VjdXJpdHktZ3VpZGUtYm91 bmNlc0BsaXN0cy5mZWRvcmFob3N0ZWQub3JnXQ0KPGI+T24gQmVoYWxmIE9mIDwvYj5TaGF3biBX ZWxsczxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBBdWd1c3QgMDcsIDIwMTIgMzowNCBQTTxi cj4NCjxiPlRvOjwvYj4gc2NhcC1zZWN1cml0eS1ndWlkZUBsaXN0cy5mZWRvcmFob3N0ZWQub3Jn PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBkaXNhLXN0aWctcmhlbDUtdjFyMC42LXhjY2RmLW1h bnVhbC54bWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+U2hhbm5vbiBoaXQgaXQgb24gdGhlIGhlYWQuIFRoZSB4Y2NkZi1tYW51YWwgaW5jbHVk ZXMgJnF1b3Q7cHJvY2VkdXJhbCZxdW90OyBjaGVja3MgdGhhdCBjYW4gbm90IGJlIGF1dG9tYXRl ZCB3aXRoIE9WQUwuIEFuIGV4YW1wbGUgb2YgdGhhdCB3b3VsZCBiZSB0aGVyZSBhcmUgZ292ZXJu bWVudCBwb2xpY2llcyBtYW5kYXRpbmcgcHJvcGVyIGJhY2t1cHMsIGhvd2V2ZXIgdGhlcmUgaXNu J3QgYSBzaW5nbGUgc3lzdGVtIGZsYWcNCiBvciBjb21tYW5kIHRoYXQgY2FuIHZlcmlmeSB0aGlz LiZuYnNwOyBUaGUgaW50ZW50IGlzIHRvIHByb2Nlc3MgJnF1b3Q7cHJvY2VkdXJhbCBjaGVja3Mm cXVvdDsgaXMgdG8gdXNlIE9DSUwsIGhvd2V2ZXIgdGhhdCBpcyBzdGlsbCB2ZXJ5IG11Y2ggZXZv bHZpbmcuDQo8YnI+DQo8YnI+DQpOb3RlIHRoYXQgdGhlIGRpc2Etc3RpZy0qIGZpbGVzIGFyZSBp bmNsdWRlZCBmb3IgdXMgdG8gcmVmZXJlbmNlIHdoaWxlIHdlIGJ1aWxkIG91dCBjb250ZW50IGZv ciB0aGUgUkhFTDYgU1RJRy4gQXMgYSBjb21tdW5pdHkgd2Ugd2FudGVkIHRvIGVuc3VyZSB0aGF0 IHdlIGluaGVyaXRlZCBSSEVMNSBTVElHIGNvbnRyb2xzIHdoZXJlIGFwcHJvcHJpYXRlLCBzbyB3 ZSBkcm9wcGVkIHRoZSBkaXNhLXN0aWctKiBmaWxlcyBpbnRvIHRoZSBSSEVMNi9yZWZlcmVuY2Vz DQogZGlyZWN0b3J5IHRvIGFsbG93IGRldmVsb3BlcnMgdG8gZG91YmxlIGNoZWNrIHRoaW5ncy4g VGhvc2UgZmlsZXMgYWJzb2x1dGVseSBzaG91bGQgbm90IGJlIGNvbnNpZGVyZWQgb2ZmaWNpYWwg RElTQSBjb250ZW50ITxicj4NCjxicj4NCkluIHJlZ2FyZHMgdG8gU1NHIG91dHB1dCB0aGluZ3Mg d2lsbCBzdGlsbCBiZSBkcm9wcGVkIGludG8gcmhlbDYteGNjZGYtc2NhcC1zZWN1cml0eS1ndWlk ZS54bWwuPGJyPg0KPGJyPg0KLVNoYXduPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KT24gOC83LzEy IDQ6MTQgUE0sIFNoYW5ub24gTWl0Y2hlbGwgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQi Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij5JJ20g anVzdCBndWVzc2luZyBoZXJlLCBidXQgaXQgbG9va3MgbGlrZSB0aGUgbWFudWFsIGlzIG1lYW50 IHRvIGJlIHRoZSBmdWxsIHRoaW5nLiZuYnNwOyBUaGUgb3ZhbCBsYW5ndWFnZSBzZWVtcyB2ZXJ5 IGxpbWl0ZWQgb24gd2hhdCBpdCBjYW4gZG8sIHNvIGl0IG9ubHkgdGFrZXMgY2FyZSBvZiBhIHNt YWxsIHN1YnNldCBvZiB0aGUgZnVsbCBzZXQgb2YgY2hlY2tzLiZuYnNwOw0KIFRoZSBiYWQgdGhp bmcgaXMgdGhhdCBpdCBsb29rcyBsaWtlIHRoZSBuZXNzdXMgc2NhbnMgdGhhdCBJIGhhdmUgc2Vl biBydW4gYWdhaW5zdCBteSBzeXN0ZW1zIGNoZWNrIGZvciBhbGwgb2YgdGhlbSBhbmQgbm90IGp1 c3QgdGhlIDM1MCBpbiB0aGUgYmVuY2htYXJrLg0KPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBBdWcgNywgMjAxMiBhdCA0OjAzIFBNLCBXaWxsZW0g Qm9zICZsdDs8YSBocmVmPSJtYWlsdG86d2hib3NAeHM0YWxsLm5sIiB0YXJnZXQ9Il9ibGFuayI+ d2hib3NAeHM0YWxsLm5sPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5IaSBTaGFubm9uLDxicj4NCjxicj4NClRoYW5rcy4gT0ssIHNvIHdoZXJlIGRv IHRoZSBleHRyYSBpZCdzIGNvbWUgZnJvbT8gSSBncmVwLWVkIHRoZSB3aG9sZTxicj4NCnNjYXAt c2VjdXJpdHktZ3VpZGUgZGlyZWN0b3J5IG9uIGEgaWQgZnJvbSB0aGUgKi1tYW51YWwueG1sIGZp bGUgYnV0IC08YnI+DQphcGFydCBmcm9tIHRoZSBmaWxlIGl0c2VsZiAtIGdvdCBubyByZXN1bHRz Li4uPGJyPg0KPGJyPg0KUmVnYXJkcyw8YnI+DQpXaWxsZW0uPG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCk9uIFR1ZSwgQXVnIDcsIDIwMTIg YXQgOToyMCBQTSwgU2hhbm5vbiBNaXRjaGVsbDxicj4NCiZsdDs8YSBocmVmPSJtYWlsdG86c2hh bm5vbi5taXRjaGVsbEBtZXJsaW50ZWNocy5jb20iPnNoYW5ub24ubWl0Y2hlbGxAbWVybGludGVj aHMuY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyBFdmVyeSBnZW4gSWQgaW4gdGhlIGJlbmNo bWFyayBpcyBpbiB0aGUgbWFudWFsLiAmbmJzcDtUaGUgbWFudWFsIGNvbnRhaW5zIGFsbCAzNTA8 YnI+DQomZ3Q7IHBsdXMgYW4gZXh0cmEgMjE5Ljxicj4NCiZndDs8YnI+DQomZ3Q7IE9uIEF1ZyA3 LCAyMDEyIDE6NDEgUE0sICZxdW90O1dpbGxlbSBCb3MmcXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0 bzp3aGJvc0B4czRhbGwubmwiPndoYm9zQHhzNGFsbC5ubDwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZn dDsmZ3Q7PGJyPg0KJmd0OyZndDsgSGkgSmVmZnJleSw8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsm Z3Q7IEFyZSB5b3Ugc3VyZSBkaXNhLXN0aWctcmhlbDUtdjFyMC42LXhjY2RmLW1hbnVhbC54bWwg aXMgYmFzZWQgb248YnI+DQomZ3Q7Jmd0OyBkaXNhLXN0aWctcmhlbDUtdjFyMC42LXhjY2RmLnht bD88YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IFRoZSAqLW1hbnVhbC54bWwgZmlsZSBjb250 YWlucyBhIGxvdCBtb3JlICZsdDt0aXRsZSZndDtHRU4qJmx0Oy90aXRsZSZndDsgdGFncyA6PGJy Pg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0OyBncmVwIC1jICcmbHQ7dGl0bGUmZ3Q7R0VOJyBVX1Jl ZEhhdF81X1YxUjAuNl9TVElHX0JlbmNobWFyay14Y2NkZi54bWw8YnI+DQomZ3Q7Jmd0OyAzNTA8 YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IGdyZXAgLWMgJyZsdDt0aXRsZSZndDtHRU4nPGJy Pg0KJmd0OyZndDsgc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9yZWZlcmVuY2VzL2Rpc2Etc3Rp Zy1yaGVsNS12MXIwLjYteGNjZGYueG1sPGJyPg0KJmd0OyZndDsgMzUwPGJyPg0KJmd0OyZndDs8 YnI+DQomZ3Q7Jmd0OyBncmVwIC1jICcmbHQ7dGl0bGUmZ3Q7R0VOJzxicj4NCiZndDsmZ3Q7PGJy Pg0KJmd0OyZndDsgc2NhcC1zZWN1cml0eS1ndWlkZS9SSEVMNi9yZWZlcmVuY2VzL2Rpc2Etc3Rp Zy1yaGVsNS12MXIwLjYteGNjZGYtbWFudWFsLnhtbDxicj4NCiZndDsmZ3Q7IDU2OTxicj4NCiZn dDsmZ3Q7PGJyPg0KJmd0OyZndDsgTWF5YmUgSSdtIG1pc3Npbmcgc29tZXRoaW5nIG9idmlvdXMg YnV0IGxpa2UgSSBzYWlkLCBJJ20gbmV3IHRvIHRoaXMgc3R1ZmY8YnI+DQomZ3Q7Jmd0OyA6KTxi cj4NCiZndDsmZ3Q7PGJyPg0KJmd0OyZndDsgUmVnYXJkcyw8YnI+DQomZ3Q7Jmd0OyBXaWxsZW0u PGJyPg0KJmd0OyZndDs8YnI+DQomZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7IE9uIE1vbiwgQXVnIDYs IDIwMTIgYXQgNDoyMCBQTSwgSmVmZnJleSBCbGFuayAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJsYW5r QGVjbGlwc2UubmNzYy5taWwiPmJsYW5rQGVjbGlwc2UubmNzYy5taWw8L2E+Jmd0Ozxicj4NCiZn dDsmZ3Q7IHdyb3RlOjxicj4NCiZndDsmZ3Q7ICZndDsgVGhpcyBzaG91bGQgYmUgdGhlIHNhbWUg c2VtYW50aWNhbGx5IChhcyB0aGUgYXV0aG9yaXRhdGl2ZSB2ZXJzaW9uIGZyb208YnI+DQomZ3Q7 Jmd0OyAmZ3Q7IDxhIGhyZWY9Imh0dHA6Ly9pYXNlLmRpc2EubWlsIiB0YXJnZXQ9Il9ibGFuayI+ aWFzZS5kaXNhLm1pbDwvYT4pIC0tIEkganVzdCByYW4gaXQgdGhyb3VnaCB4bWxsaW50IChvciB3 YXMgaXQgdGlkeT8pIHRvPGJyPg0KJmd0OyZndDsgJmd0OyBtYWtlIGl0IHJlYWRhYmxlIGluIGEg dGV4dCBlZGl0b3IuICZuYnNwOyhBbmQgeWVzLCBJIHNob3VsZCBoYXZlIGRvY3VtZW50ZWQ8YnI+ DQomZ3Q7Jmd0OyAmZ3Q7IHRoaXMuKTxicj4NCiZndDsmZ3Q7ICZndDs8YnI+DQomZ3Q7Jmd0OyAm Z3Q7IEkgcmVhbGx5IGNhbid0IHJlbWVtYmVyIHdoaWNoLCBidXQgaWYgeW91J2QgbGlrZSB0byBk byBhIHF1aWNrIHJlLXJ1biBvZjxicj4NCiZndDsmZ3Q7ICZndDsgZWFjaCBhbmQgY29tcGFyZSwg aXQgd291bGQgY2VydGFpbmx5IGJlIGdvb2QgZm9yIHVzIHRvIGRvY3VtZW50IGl0czxicj4NCiZn dDsmZ3Q7ICZndDsgY29uZ3J1ZW5jZSB3aXRoIHRoZSBvZmZpY2lhbCB2ZXJzaW9uIDopPGJyPg0K Jmd0OyZndDsgJmd0Ozxicj4NCiZndDsmZ3Q7ICZndDsgKEFsc28gbm90ZSB0aGF0IHdlIGFyZSBu b3QgdGhlIG1haW50YWluZXJzIG9mIHRoYXQgY29udGVudCBmb3IgUkhFTCA1Lik8YnI+DQomZ3Q7 Jmd0OyAmZ3Q7PGJyPg0KJmd0OyZndDsgJmd0Ozxicj4NCiZndDsmZ3Q7ICZndDs8YnI+DQomZ3Q7 Jmd0OyAmZ3Q7PGJyPg0KJmd0OyZndDsgJmd0OyBPbiAwOC8wNi8yMDEyIDAzOjAwIEFNLCBXaWxs ZW0gQm9zIHdyb3RlOjxicj4NCiZndDsmZ3Q7ICZndDsmZ3Q7IEhpIEFsbCw8YnI+DQomZ3Q7Jmd0 OyAmZ3Q7Jmd0Ozxicj4NCiZndDsmZ3Q7ICZndDsmZ3Q7IFRoZSBHSVQgcmVwbyBjb250YWlucyB0 aGUgZmlsZTxicj4NCiZndDsmZ3Q7ICZndDsmZ3Q7IFJIRUw2L3JlZmVyZW5jZXMvZGlzYS1zdGln LXJoZWw1LXYxcjAuNi14Y2NkZi1tYW51YWwueG1sLiBUaGlzIGlzIG5vdDxicj4NCiZndDsmZ3Q7 ICZndDsmZ3Q7IHBhcnQgb2YgdGhlIHppcGZpbGUgeW91IGNhbiBkb3dubG9hZCBmcm9tPGJyPg0K Jmd0OyZndDsgJmd0OyZndDsgPGEgaHJlZj0iaHR0cDovL3dlYi5udmQubmlzdC5nb3Yvdmlldy9u Y3AvcmVwb3NpdG9yeS9jaGVja2xpc3QvZG93bmxvYWQ/aWQ9MTA1OSIgdGFyZ2V0PSJfYmxhbmsi Pg0KaHR0cDovL3dlYi5udmQubmlzdC5nb3Yvdmlldy9uY3AvcmVwb3NpdG9yeS9jaGVja2xpc3Qv ZG93bmxvYWQ/aWQ9MTA1OTwvYT4uPGJyPg0KJmd0OyZndDsgJmd0OyZndDs8YnI+DQomZ3Q7Jmd0 OyAmZ3Q7Jmd0OyBJIGNvdWxkIG5vdCBmaW5kIGEgTWFrZWZpbGUgdGFyZ2V0IHRoYXQgY3JlYXRl cyBpdC4gV2hhdCBpcyBpdHMgb3JpZ2luPzxicj4NCiZndDsmZ3Q7ICZndDsmZ3Q7PGJyPg0KJmd0 OyZndDsgJmd0OyZndDsgUmVnYXJkcyw8YnI+DQomZ3Q7Jmd0OyAmZ3Q7Jmd0OyBXaWxsZW0uPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9ib2R5Pg0K PC9odG1sPg0K --===============6233830548640768017==--