From 82b681a38d142bbe7fdb401446077c9008ca09f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Lesimple?= Date: Wed, 1 Sep 2021 14:22:37 +0000 Subject: [PATCH] doc: add faq about session locking (#226) --- doc/sphinx/faq.rst | 14 ++++++++++++++ doc/sphinx/img/locked_session.png | Bin 0 -> 22793 bytes 2 files changed, 14 insertions(+) create mode 100644 doc/sphinx/img/locked_session.png diff --git a/doc/sphinx/faq.rst b/doc/sphinx/faq.rst index 41c25cd..c22b796 100644 --- a/doc/sphinx/faq.rst +++ b/doc/sphinx/faq.rst @@ -80,3 +80,17 @@ Those two connections are distinct, and the bastion logic merges those two so th Using ``ProxyCommand`` with the bastion doesn't make sense because with this option, your local ssh client expects to talk the SSH dialect on the STDIN of the ProxyCommand you're giving, and it'll try to use your local SSH key to authenticate you through it, which won't work as it's only used for the ingress connection. However, when you use the usual bastion alias, in STDIN you have the remote server terminal directly, all the SSH stuff has already been done. Attempting to summarize this a bit would be: ``ProxyCommand`` and ``JumpHost`` are useful when the server you're trying to connect to can't be accessed *network-wise* from where you stand, and needs to be accessed through some kind of proxy instead, where The Bastion's logic is to use two distinct SSH connections, and two distinct authentication phases, with two distinct SSH keys (yours for the ingress connection, and your bastion egress key for the egress connection). + +What is *session locking*? +========================== + +Session locking can be enabled in the global configuration, through the :ref:`idleLockTimeout` option. + +When enabled, the interactive SSH session will automatically lock itself after a defined amount of idle time. Unlocking such a session can be done, but re-authentication is required, i.e. connecting to the bastion from another console, and using the :doc:`/plugins/open/unlock` command. Here, idle time is defined as keyboard input idle time, so even if a remote command might be running (such as ``tail -f``), the connection will still be considered idle if no input is detected. This is by design. + +Such as configuration can be required by policy or regulations, in some sensitive environments, to ensure opened connections are automatically cut off when unused. Locking such sessions can be an alternative to cutting (see the :ref:`idleKillTimeout` option) as it gives a chance to unlock the session before tearing the connection down. Both can also be used, such as locking first, then tearing down after more time has passed without the session being unlocked. Note that while a session is locked, any potentially running remote command will still be running, as locking the session will just hide the normal console output, and prevent any input to be registered. Unlocking the session will simply resume display to the console. Session locking can be seen as the equivalent of a desktop screensaver, but for SSH interactive sessions. + +A locked session looks like this: + +.. image:: /img/locked_session.png + diff --git a/doc/sphinx/img/locked_session.png b/doc/sphinx/img/locked_session.png new file mode 100644 index 0000000000000000000000000000000000000000..104c5bf506b70ec745590debffe218909b60aa52 GIT binary patch literal 22793 zcmce;Wk8f|w>FF|q97t&(jqP01`;BmbO|CQ-5n#M0#YI(4I&6iilo#?3rKg4Gy+36 z%*?muj=lH&>}S94e*b*_xNl` z5fB{PK6@H|vg%Ls3;uV~<(87>S@`37)-0HS;0l3~+)Yi-q~&ohUkxoRZe6FMtNLTH zA`wre<}p%IIk{tH4=gpu?(e^P^(lCY|GKukp~aTyVsM=p{DfLsq<399RHD^7#CHd7U8oNtDeL#W zCnqPDQJ5g%mi=)N^W_yS{-@?I>zF(h(gL@4tIC$o-;EuPjwCC84wZ?xnSki<9d43wR3fAQ>1-7 ze}9bSHX*RGvNCk-zB6Q-P)J5fx^DUL<3}1V>qlv6X-OUvUcQ*^L4xNO7-h!XSH8_3 zzv^`f-s3VmJFADz4gR^>c-MQo|;mUMSDV{&uX=Tm)AD~$#WMj%+4h` z%$1JXyW}vCl9CF@r@(rA>E+YkzJ2?=-9nHethuQvo-){jMil(Lb>?$v;C*fFm+cnQskkG{ zWI~PpL*b=Q<%r#JkI^MqF6r*uckdPj`-AA%)yN}9ZAC^(Y|i|0?E5??@+e7F&&l|V zzMNcxAC1?BbWn>%|L3Zu{K^P6<#(@RV=awmjR${d*!6lybiu+`dTk@bnCd$`P^R+2YTpy=D$+UhwQqZ1q+KAT(AF;%@gF+HD(a2Gq!bo0sSx5n{Y zI=_P+J#)j^`D?Q(<&I{uNMbk~uZF(<-CMVA1@c|nmPhSv`rq+Qld&8{kCsK!OS%(u zWvbAsN}`1vp3l8oMdBtt&Oe0H;vMvwY9JJ`ANwIbpH!b9Z1ZHiLRd*jiGWVb@#)x@ zVTa72?Le;HZF%|A-QC@)ORi#eI&KXM4IyN5ckZljwDA?0HWNQKHKo^HTrO4gtJ>;O zzD!9us3-Hd;Vj%%HAAy$r1Z;vYc?*f(DHII)5d>@BPmpxw=9qyo6L`7pISF6aL4i{OT*n49Eyn0{)x zsB;dMo#nH;axYb8+^E!MkoP4q{oT#Ec1}J%4nDrlk28cx_eQno-dC>HBsMc5l3?#s zta>vGZHK>FFQwA4$&<6F-A!qD=(Dq&mXUFi|E2!14<9}(Gycj-cBj$KiTV2VdO?%Z zdLw1@>(@76U~s~3+BmI}n3XU@hNd2 zg~^{vu9OGWCn)mI#VM}zm%~-jU>q1w+ z#)dO5^2nK>DUwkQmS3o!_cK*C6_Vn4AqmNuU&$U5wbmuqAAKjN*`K3T zO_6H(Vp8w9lvhSjzE(%H4|~SR%RASj%*Q4y9J9P^OH41(06}p(RmLy7QC(fVZn8cI zu3m-N8HFI?t=W4_!K2@hb~|WcAdi;P$TJPIZ|t{CF6pr{GgN3QCokUv`EdF?)%~Sn zeZLx8Zrv|WRT4#xIqt2Q$l#7#@+%gvL89)hRIUzHc?q(yv1NSx=+wd%J2bzOr_H7O zj{9@b(XZM-sogP`t>3*tPSZ`@xq5=HLPH^nEZ3(R&CJc$2a(tq5xWu1P!3tyR2*g% zK_~9~d}X{+XGzx5Z+)o%xlvCddtX;q(aenX^XJco?!)H3o9&`>Ql1x|uGSnzBqh;F zc&yx;??_e?XNPDf9@Sd+c69w||815c#dC@##(XsNW=gyrQDzTx2g+@v{9amIQnS}s&JW^~$uw%t-oTHf16hUubvya4X z^Btnfa^S9?41Z;VJgblnpc8m}k|OlQ^XDgbR>s>B9cq;H^=SYJc?a!`H#G;{5^Y6j zO`F0d0hmoYlEmqxz26QE=>{oj*zLwhg>XQ|yy)rav5rKKl!U?|1eDkezDY^JhbBOf zjJUXX7`5Q((8jvD7esJ)_~4rPK?*1&Z*6^zh?4i@quJJ&=g*(xe+s2XL0$b4hicNV zh3@oRy`q=J#X@j#f@QaH&*|_Xz;}#Rj_8`}$r5(0T=ml3P1sJOTv z9m$e;7!a(_rq7hlRPy2{Nx z13#aKwOGP_?f4yS^{PF8@uIuJ%?92AA2D-tLJ8I?|8;MP<|PinO{9tjeL%4IUROLu9_|OeP(54^^`P=)nw&` zh%$7nJ=Nd(j`yK8pP=MdI!a0f_+Y$<9Sw_o*n6+dxu*izGIk?Ehx0FUwnr3FTHD&x z^eXR1i9tl%H#Gd2p%fh)7RGw*+N(EjF3q(k>Y(=rA9{>)qCVtA$XL~ud){py?5S{D z(yeso;V~#RgG%x?CPu)0Sr<{XMk9yw#yo2er1y6_reK}4# z#b@PPkWK!#m$1uGF)?@C-9>bayx7i=Ft`p;a%ty&w=U_a_VHLj;{2zkry)5S8XDGS zqSZFWTsjNAHZAb^f3SlNZMQH5SniK#>G`NkUz)R6!KTohJEhxaSgGe^t6yfX0;rrU z;Rad#Vc>UnRh5*?;j*Cn>V!%t1mz(r>X*DS09<)%Czr&@!y`SbY-R_i z&B@7W0=EX0GC3>NpXMp2Mkc@Q5dU3eWmpk!fB(g7b~RyBXU(}+A3iYOx_uj6L`ncq z^!(*ZbxqBgjd=I_EMD2-8=C7cAurDo5wS=}jQGD;hYE>@Ui5xpVPXHXY`s|dlm-p! zns@H#kyBJQAFOM5JyynAhAmU=kO(LN>JVzcGqe3n@GFM(6!B5uw>XDKm5-ZSitXkn zYGtH9W(bKuVwB|?MNXYMbuUpQ9F9G?=N*)031qn@pm>pA1jDb|GmNa_;`?t!U&D$I z(bYb?Uu}o46G*r%%4up|P86|YmX=Ni94YiWbobfN)$v-LsJ80KAOs49&mK7ih3NQr zrJFa8r6RE6kaSR@Nhv5Sa38eNEIU&m%zB{=eAo3LrKD`0sP>`XxdRLU3NyD+Ra|2z zB^d*QYAo-=^34uOwDH)rnYlUVt%YulMc_YfL;0`b=;(_^7W2Gpc`KK%zln|xiHMkk zbSSB5Zcmn^Ol+6$OpzY0aN~kFE0J9Vq~HLMgL@dL;ESp#m#`ZItbnRujmoU+PFL{S z?$ z-z9457U4ldQ`zzI$CyX`5;+5-P@Gq)ca08%{DF#G<>T`xcO14T8b&HXyavO`0YzR` zx_Rr?v+A0PR#Q_`PA;w@q$uzlXP~prE-vCuQzwCn_2=l2(bKCy-8e%`_hl6ad-*&l zXmlwwIQR-X`%5@y@#RpcZYll;R_BO_hHLyJjs5r8pfI_jM`A*GD}GFrMex=v<&JA9 z&@D+=bPNPMi^|9|My3F}==)|d^UlB?f9|^66j1u{UkZp-Y(Jjx_U&cZ+xNTj0%+i8 zyea~Xjg8%T2BHM-_>AolRaI3d)udi!_i z1l=gf$)jRpn}0;HSPkS-!-aRute|dXWMnw5R_|`Kaur;pppe(peA_F5W>LEze^m>E zb0b&F7PqB`-9}&dWKCa!&RBFH_2~EIaa$RShXVqn>j0ouQdOP%9&jSp@Y@@%f~q&b zCbfP1A5zBUh~JrR)z3)SwHeKvx&Z9RC5f(sjtM=y-Z_HK%g!0wI!43q?Lg0f8{o;<+hbqtnEWFMbyFqzK zZIALl2Z0%kZ3=vgK^mv+Tlru_c$P#ER8B+-$hQ-FW3?RW+G zQ-}hWiJw@TIZ}(ITrSQWwQ-2+Bmi+Z4iI?FaLQ<0k;leNixkKj z_#s}{l-iA2tf-$Nw^n|8ZEkNVVZbG0G3bHc%Tsr(H8x8w)6%vDld|ls)svttBcBSG zC8wnLx7w6Vg*~v`9-vFkwkt0$J=7{I9JU3F2#n#<`D)e6p5nd8$y>dp&dkDs?tNC$ z|6sEaAkMnixdV7F@Pu!`96fQE-FQh4UIGB9qgg&gnp&z1>_oqn7r=8fk zHYPs4NC@Pi=rRUr?=Ao?_mwd{o;jBe@u0E^?@)kg3HRk6cr_fsAibz=d<09yGt`}m z3fJFt7evRthmdiUFMn+l^IW?ki`gOr+LZ>_^!$aE4=oEjdy`dV5`7V901?}v?{CkfHA~pdr-k-C z<8G?(lGNU>Kw{G^*W~Tbk`fXLjEE!B#P+6Fe`YwLM@!E#`OyPsP!C2|2??jfr=Sj2Jw|oX#-%ZIP~4ZARqS zkvm;uWo@W=X9bdwPSQOrE{^K(^A=nkidOgn0Cqkx4Oaj#wXcKt9mcmIo%AXHdq@%zPa9IRx@@tlXy&M8^nvIWAy5 zAUY|@_pYptp=1`wSFkX?!mdk1bC9YX0(A!e;Im6|p{9=0oU5X{}kHW{2pq&GlwRF0VJI$!KWq>gvY%RY%A|9Z?E2{81!g zVqyX+pif+D=9BMug&RmnRE-!C?%mL-k^DUM_2<$)JALBUDBz<{o;=BOlUNE}TXO_2 zWK1TaV}$3@6YV_xJ9>K5>+9<^#2+6V?2J0(sEzh(3ZUP`#_FslFI+m+)3uoJZu3md z5rN0MFXGo$M@qOTjeP~+6F_EQTkBh*Ifj8?)N@`{Xs**U_FUYuGG@(Yo_L#*(s8i8 zL_33epoCt$mjd4^28RzZ6@(EG3@yGUpN6jlh(69sCwEp+op9EKgoNNr?b$uMc4--k zJeq?+?7+BaO4^NG4Q~iA`mP0xqDJcK>dGfy(vD@{mOBcPkG|u}1@RFUb{=x+hLTc< za@Js|Wq-WX1sb8?n}Mf=&A5T%O+5pX<@)vOLto89GpAAN55t6Zg0Se`?+GM8?$zb01=>eUr|JYz!aOzsw;7YmE zv~JQPhc3X3eHq*iCQE9&-a3aXnxbn2rE1v{mp z4_A??L5%)GECJtgN~w;?N6;zB%fIYJ+muc>QW|F%BmKep88sC+UWGka0yXap5tORF z12ysWn>TguZw4M^8ry&&w#Z)tK@PR0iXljLmvm1}_SC;ubuUP--DDpr_j#bR_2r;S>#~(n%TmDqW@1RfLNL~FFuzZ`r{Ey}3 zaextmPr9yv)}8x(pH9Mi>ng}05rb0OG)UU5rNIJyuYUKRaRPy00||hJnEM%j8`!Co zNUPIayyYb*9e{kHxDFZWt zYkJt%FD&R;y3$9nFGo9GL(NC7y;t$%T(YckAbMq z$jUm*;IY7UG>6kFfDHoF*Cx-7jC7sj0yZ+h5?}<9I$b`T8Ms`hEG`MQZv6*Kq|idp z0GKi%p`p`Y2TOu^0~?v%F%NX}EtuIp<|7@C3%jz^81cea4XCn|VHiudlBft(X^m`Dnz6?LvXMft^PT3!_@-D#zyq(*(GpNPH5Gb=TR_F$*n zR#ZF-oA(QZ(iGT6bH%-?(|~!F0AhHa5JoTgZn`;g6G(e>R8%c^R~qv*v3$lI;B$c~ zW8VGY&d&tlP|FlAydmPZJAUSAzqL8=eZ2Srx|52DR?(T#`)WoAx?c46@85Vu0eWn0 z7l}&-lY!r1LJAAJ9u0T|9+O^)bxh}*tb?QE!T!>rp`p_eMsf{>-Ux4A{o>#U>GH#f zf&7O{u8B}4ih!O$=-vaC92FIHo=)ubvuDS_?=e8#H;gEpvaNuBmfDZELRJNbhO&r@ z$3w0TOdon^fpY)R)&@m`o&XOmz+?yGFN-ZTFDyLi>FpgZcVYqBiZlcU*H@P;5Km?dBX^{0?sx^xRXDTp*vs0=CSr{0d2)j-gSW43xj!op_0w(+ts zG2xA;OMg^{t8j~ux4j_t!3L8kXwVr&X*JqVF5*0lbVlXmj#L8ky(Ao=nWHANKf`H` z*D-1jyzV{}fK82MS4p@?Nok4T78f5*KNP`VnfGDEA4ynjRSy#UHwaXf1fkE{`}td@ zp!{e>?V&opgaqjUoB`&o0L2#HbOFdH(it^l*M17ZUZXW9LJU>~>d+`p4PY50xLY|c z!HpnE%InfoVVi+3;4uMYSR#JL_R8fqXl%MABqjX>&l7mVPWCaRcH@?GD zVm-SqW^-7Xz;E&l#b$W}fG{A6GGBHV$ z4!Cyps$+S0S=MDd^x+LZys!rCT>oO~&pQG`gB6I7V24;BkdjN6F6kCOAr%l1D1Opi zXP_cLpTh@E_H~!JdoM50%EJ!8ZcGBDFz?US@~2n3^H@FY{rjgy9TG%O0dRUsY;?dv z8i6w3TKvSH1wadI}rb?o`o}OM{V^mVo zJy@m}s3GuFs6gWVidK_xDpvu25zKk;lfBt8U%i;dTi8HTz&S4In6K!GgqBDaKrlI% z_E6RWRLeauduVN2JNk9~(u#{OgUkji0Qy$8sG8&#M3e`9QlXT5767q;e{1ccD7;CG z*E4X3dtk|c?;s2O6dXvOUs@ZG=viBsGvIW;Zqy|t!Ahvy$gF{!DMjgOgFSu;9N zZZWenGeb+_v$mBn_NNDW+tHZhO3bv)gp5q>ge(@jJBi*qj@gqSTSk-Y>{>>>{9q*s zUqnjgnvCZ`R&T*Jz)L^KN_-apyqj*w$_`naZ-S7O`n>xeLxsb_!O8!6daDSR(E?$^39`AG>6HPrUDn?_QjagnciII3fcWD85^ z8Zd#YnLrkJRbnQvhm@p&^8cif|Gdz@Fwh0{Q%0AAaV1sxan(-eT(0b>@vpn#4!v?S{%jhn||*CG74t)~{UyP11+| zmh@B8_>la+P~yMt#r5;?sMDI8TdOfsb#$bE&jPqf85v{!TM?!X$l#M_!vEa3f4Sd( z&$zojo|Aj_HcJ&p!s=F{7t4Qe0J{xhM749?z$o9Cp*syJ6#F7Ggc`q|B#hA zKoKw_QrK)m-NhLDy6VZvyK=|F;i9s?tS?QsL~$VQ>K`$MkdZpYP=x*O)ymr5$8**x z*s8A)&3=u;oZZ4|vnzVD9*w3EC%q5bZ40ngo*h#zWw`2bY?J?y-?%>l;TL-H-2cn* z;J@PN;lr$xl|JV@uWXnlKKqDRJUlo{VU0jPE5y`ph;mI4h4Xr4qgA?w6BXNSXit%; z`CdJ#f$N*!CcW2()i~vH7%0Gb+3GC*UHkGwR0>Jf&ROBL1F{yzjJ5LUf_#Bu*&*!9 zJ2bb_l~aC(y%EZENZa0jeYOcpnE9ai;Qk?(aORHaOV$Ss(Z!Dp|JNF>jx+Y!C$DV# z&TGg!nCW|806xk(N7wg#4y*GD%Z%mD{~yu%UogP2_2aq4o;Ym1r{5<89nlVUeRs!8 zQU>9GEEC?@2^A9IWmBto8DhG~*!-*-aa8R$5z&bnU9}6Z#xRFR_0A}vKGA95#3+_A z)2ry-;AoFOKBY|@&Ec2sd=E3N`^WOsSX3waher8&;-Ja&?_}w}55xbJqWwR9^rYR! zR=H&X<`+-wLwCJ&UOZl|o?VE_0`>H@sK}50B}yF!YxFd_ z!SRQpzQFT73k{7+U;1ap8h^Z!^8bQ{f1v}@l{Z;~Mn2)96Q1>hCMREjg$pegIcQ7$ zQHB+7Y#h#T0#(O1`9bCGNxXgk#k`GTt~0gs(}VQ?d=K7H1|AX&ws+%T+R1P*J)*$W zj|3mVI0(S*lH-wt*Q>BFGk9MZqwEB{Ck7nZLg+jKgJk&6_s~eVUWJDKV~~k8#B2-j z-jpB)@8B@j!i6q$I7DZG7Ke@+y5vDtLCwLr#C90A0VT-wt95+4TY>Qb^m#yJ zNEwv{2P^V#j+z7ooH&DT4vc+ssaD6C$3CR!nqBz{U4EDvFtf1O03XN4%@{6T+u)#( za$Qicr4?qSa&sr#fX2K@PDa;$Itr~sCyKkU1AQ_CG0YHlS5A(#eBXSd5A+}2#Voe! z^`*aipX=JSDL7d+LBU?IE`ozko<}B?`piTr>~$irw}BcPY{LYA*HvcROvp|(v?rl+ z{Sq3=OU@VJ`+3(Yqq5)#ocpzO1i%t74(hpj`SN9cpur6OdnSMG(#0eD87p9sFgdd? z5hgzyaE4*c?JRuySpDjs5pWd$-=gnXhfQR?TZOAum(QBEr>pMtI5K!I0)>Zhr^XBq znqBOj29Kl1Grz&r09#^WZFr|P0~Fb1a`NtMEv{7CRXe`0myLqfxNpX|%uaLZ%I`sZ z`x56qx6201)4gpzG5xghyXbe88&AUL4bN4b;>KV+B2kPEgt;e2w7pgs{R^^2S9i0p z*raUP)V?8qwzcuqPPFL{swIy^Y65#?gV@&~5l} zw7&^`V#`Ih78zi1Bs`bn{Tm3?9G1T)JcE8;34+6c;T zMmVpBlPODSc3eX-XY^dcFi#8T7DGSsJES=whTOVjE~Lb1e!~!@PdYLc+Y&#NxZz19 zwSSGcS^lzM1mn~5e1eZoeEQMH>6+L3%r6!Iv0y7cIeYul0h=Dcs;iLWy1h>aqP z_Qpvs7@iM1zJtSV@;aV~Y3X(R#qz5cwd!!f=+no1t^k3g1hH>*+UBUN6Su+53lCMx zLPJLY-^c@#VYg+c)_VA>c`h`nz?hzXB{x z*3vK1TXAFE`s2}$#%`}o-YWMOk`le(on#`@q}&n_ab|^|&Jf~9x!>e{mnDzW#)Kh+O*KK76Ls}zZr0}CiuRK1R&$Sv8s&ekg7)zxK^;>u zHTj{tx4GFhZ(ELz%-@dWN@uhALenK29yk zTA#$#y@)vK#&qwD6^LB?yaZm4nH@e7@jvop@Lpi5t6LN;Us&0x*=bZCsyRc?TKSz>SqOIUWRtMRIk{a`Tik>A5kcf@Ku=7!hg!ONZ<6xzeGS{ z()wG@`e47m+SRgKUes@6>T6l}(I-re^PA?M_~^9K6A}hs=j*m2!%A0M1HTa+Wg*7M zF^8*fu0@icpty1=cptN4!m&Meez{JURx45RbIqL9v%rc7o#6sS)5#*Wray77T|-TJ zHX0o`uE6Nm0HYqA0Ct`r5ovvWj3r%*H{6vt<%9(6%M?ZYJALQ+>^`te$`x)_XuRRd zS{N%V`|kVKBI7oxb-DSm1@hIh`7f*(X?h>$H^4eAw>j^2HLluItQv zneMZ(!BTzlUh;5A6kW-&4Sz)Lh1W!HvHl2_F0$$K6&1_%aVtLbp6ANR#dJI4DjwY% z4-sOQNi1#q`I8mA#IIiu{ODag4x1i<>QRX(Zh68j<8b=k>_9Z&0Qor zQp<}rQttm}Q>eLxiGj;)DiOj^v z$qCxYo{6T*4_zB3UWMk2=L+W zD7PUQJN~m^BMC<^cnop;ae(Ugdbd8&6GIn{(isX_O_SVqIl`i@MKv{Wu&DVRY^5p3 z@)~;0#>foU6kh$0a#UorR5vz0VH}=FygNY<&G2IA$&cZ)8YmaPL*vrgp%BO2?blvs zmRo};Ej8aEr5UmN1io)i*@#drr6;iU={*c=Cix;rBC|I_MII6<;88lx5&8?87=H4% z+2^P@--G0(b@9;&y?r0DD{P-Pu>F`{x}=6)NGC)cVzQvD-T-&K6ld{5AZCuUV`r7y zU*~9YH#K|ZnDbN1faU-%s&tjq6IyC}2FIl?jBOuomY#4+RyS=_Oq!_EJ+qBOF(NnN z?cUnoFbwj{Wu&Iv`;ojQcUe7kUy?A|(}L?j09x5`!?hE7dn8~pxl|Xh%&hE$D>*w~ zmvmo#uTx;OU6B-6ISO2VFBHaip$P`#%J)*F;td?C$$>yXgU_N!t5O==Pncs<1`ihI z)nIUrAoE^)&swiLnBFtlIr)#L8ba{<3R6G$2$4E+e0XAaV%!MGz>v^h@%TF)gWy-M zHimb?yHAiv{pv-7>+vka_{ah8A4J_q`)5yNPsl4l+D9ZlK3-;2X6Q2l-YliY^1tbq z{I~l4f2ZkZH)lJ7&QnkIq63o;bf7b{DfCzK<)0V(1t7VzJPf?(!1nOb;Lzc2t-)ls zNlirEq3^h=@v5<0M%unB@MTdI@8&^LJjDV5c`U2nYHhx@E064Q?DuDkkLH>kKMV~< ziSPbq^~9>|`MYg5uU1ibyT6o`T}>=M-tsMZa%Jhg2CbOu)#N%C?h=A0x?>OmmOiYeW zeC40c_!joTBFkL(GFX!jJnvpw9vWR+Kl#A`OVBF=P1L|%gZe!r4dd5T9+6gsvGde+ zlRM2!0u0z>LZ6-bEL3GF23I5G&$~d}8F`&CH63HXz4kM3tykXD_QU#}M@RLqb?#HA zN^biw`&*8poKKCpiXXXLJF2*Fu=_lp{!xDcLpG{q-Kl?kus+IE9@^A;k|~6{YZ*G@p#=8S#cpF2jgw9!|Nk5;b@o1pP zvA*8%*O&Dp3MKyCJLTr*mw6l~f=s_&b0`?s93JSTplxX(_Y1?!()0Vv7$4Vps2gu6 zHZt+BV+SSGP37f1gOW!$j2tuO4ruG};PG<)=r`fsM$W&F_+k<0gv{sTVXQH$l4+_k z%lFrbj7&d}ED11r_zS)NTD;hQJyh&N5t{WqowU7g8-sgtl$;)Smdt!nqvPa#&-u-Y zCF(A+rfR~#>r9_H&(q!4bGMMB+P&yoelef%LZ?a~17IA^?y9R|;F**cwUM`6GYX%K zkW22+gk1W51}Cy}qF*5;sUH`4_y~2g++L_kpmT4|Hq)&}X^8&1Sv`!G*K$^co$+Ej1V{;OCnF7{Na+Dk;l^Gv6SVPn4t zHQlRW)uVg2?%U@X4Roz5ui-PU(IW6cCoK!TUL=)GaMSr0C!-zwjk$&81Muv{DBFL} zP?CTm@A-accy~bFH~vksbZ(JWDz+a9cD_rpf0G$Iq~s1&hk)}S=P*xTO z%WYBRr}^|I2MUhMCvy!++WeiX{qh@(?O$wMH|<;aMH;sg@E|tl5YjXqcUSe6y^Qbn z3D?d~+?`nB{F)!-c7;^w?5X`OeP&x1O&L>tEyp5X@%uCKUC;CgLOmIah;X&@@em)y zVQ)8z$I#Y?y)diFnT)B7+94=b|!>k`o$(Do8(=d9O`$h13Ql#m6ePjMT^O)In4 zC9PAr);srqDq1(;`iEAUOPXlj_FNy_LEQA961g~%L8I}UKo)DLhuwCbu3ubMy+~ty zuhGBq>kii0Y%ko=!iP$jxV0_3`PJPpl)!_vg|;Si&SAg5q4ns5mY!+YDJ+2t@_8)E z*$yW{3u@qK+kNk98<@zP(HpPFTu6a(?kA*V8SD%m*7JRLBB)^RUIftd$>UO{KfCP_#t)1&cPU zS|W*?2V8I7Wn_NwNp-69`XG?}`<%`cAFqIXVy53CRuMAB7k)uuB-ECNkzr3Q8J|;H zP-%EHvN^7XJIaqPZX+-(N1qv=zocr>ENl@>Ua9VmBlcZ*v1rpz%pkB*W@CPjXr;p@ zoU`1e^Z91ww+RuQDdeua=`~J~b05;LFptI6xtQZr>cWIMf+A?rPmN2|rt(S%N2no# zl)b5!KK@i49`_*I`h6NfZONLdHEg@qc%8~OW_{$x6C1kb{m_S_6A$y3af|*0)fQi5}O8rX9=@}ZTJ(E{0+R@hvq)Xvu3;qNkm0J7NkffSmcS*A?dzvH7I6q% zK;iE9s#ud=_h|`X3$Ywr^qr<*=g9NI`7FgxPWkGaw}+%-7^R8HutbQ;HmVZ+qFUWe zO_!US6+BH_Hcu4MHX4gPtYf;p$Jg{?x?eCNUIuYcm1P}u2K()}G`*dzdJ$v!;oDcg z)uKmr^)cq5mT^89u@PCS-jYa^%{_ya)}Sn$#;%Z)-=c>olteY}GuKyzc8s;{x5l{~ zDjAUJ2M@(%R-8rsNeS9u$kGnx#|hrUILL*HO?VC`Iy$-@9&y173Ju&V*~G1@+{Pq0 zOv7MQu%cs!u*QnIL* z(5_wRDa2Y1L$B>ka~9f`SbG9LmkWB+{iW4K7?0mQY@gcv#*tdPeCmmM zoirNWdM@vOec7B34c?=Tv8A>g(&@Ze$97Z3Jf5rQpB$pF!+3M;*JYucNl55~u(wBOHuf4+QmhbI1@szyE9 zWc~c~d>bdf75A1*8`q?GUlEb-o_hUiSsGaDzVyhl-PNU?Z(Lo|l-D*ciDtbrY%Fm!XHr0>hcK%B?n_t6LO{N`KnWXBPYRti<^)obHZ=UWhiHN0FFLmNZ z?=QSQO(I1U$oOJG(bOrAt8}*R#qG&7N)sH@^v;XhImmTc-!nqtFPKaxJ3DWu7EPAQ zRxqF}L&GId`&BFR=NAa4C!XJof8BTaH1Q{+37p~Hp;@{gXA9Je6r0qtX=J7>x8bo9 zjL%3rsW2WGwwPJV(m*GY+90CIgYLC4p#`UxOY4%a9F};0jGw`D`29NUm!F!k z^|3re#h*di267#0+ix}#nY7E#heUIXoViGASG5zF4Adli@b|~+G^?ZsE6c0($%ADa z5YgE0CL2O#KQ6*EVkmt0Pk$a9Tz?!Ka#ANBM@@SwHkm}Ph-sC8j`KM+V}0ZNH~P~A zOic1q*D)+&o_$p0@s;0QwsrO%bK0UzmrbpRi*2;3r4A*h0~ddhdfLbsj`bEDdc>yh z8RPJ*>P__PL=s~R!MNbHwgUP`Z##``!(Q69zlcxua?cpf@c&rcC)R(+8#Pjc4`!yQy)H zSdVK{9(-aFdxd+p!f$(}SV=hZHG%)px35xc!*L%r-<@g;sz;~C4w=E^up!=#k$Ac6xLtK!xM28 zIrp6}B|O)ePzx)lO8(QvnND=^8_q3>bfxDNk_k@Ws7t{#nYM)7cg(;ZW=GCs#*{@T z&^T$aszw}S-Fk@LEd6oTbLXa~$x8t@9mB`>#8bLUH^jY8y-t}bXYiOpd0ZT@3sCOB zt1lf{n&!Uq3WvZ`1_&{K5s-DI&VFNKiqK7DvZ_*36@LP@Y=IFaFZU*dX_96@I-*>`p(scGmT6$BE zYniINLH5CnfoXdmIVDv(6UbFNL^hVrV;c9E)3ASVs55pu?yE~F?hj&d6PL1`_;qt& z-DzicvUO=R)!3Lhj_=<5iM0n5xx2VP}5|n%0o_L zg)0$bf7WXc;GX~0N)fx4V$qqRVqsx%yOB9O>>qXWR=R4+k>5-`Tm@!A!f4$7v{T;w z(@yF7gcDeM&2$^ubhlw%0*bb2MihRQ<3HvdF7~x(*xU2MxMdA-z0ETireJ2qUi}19 z(C|l%Xz|oEj4{>_*XI27k|H=nzPlVu1O!x{@V^%T-p(#Y=Vcw1)rzm+Z36|yYVd4O zmHq@wMGYRma6Ei{n~j+{fbUZlda)h`h9yqIh1X4i{=onLr-|J9zg-{^P43KZw5cQW z27fN!?r+-g&-=XCr9#A@oJRTu)W zO8Wbf^{1vg@a?f{#07n;=sn+d)FH>vp)r(qj=x#V`b>*OQU89C{kTNd?396oKiq!A zH(@&++R(X4W(Z%wtDFbn9_bsOfNCP;6EM^G-lz^p9Z~AYXs%a?s!RXZuMvBdU7|o-aHe z^;bW5ZE2=uJSyZ7#HPPNNrIdf@3@WSCVsi*Ef_+#-Cy0J>67w67a^H ziKz=`2x1vb3;#LZr%Sx~_l$h2tAV(RsEjJz&@ZoxyER&K#(!9Q-xFT~Utof+F>>K+ zAhrbmE*J#3^je-Iz_^UM*EEo~!1u_J>22)o&4$+IH)LtQf)RFn5c^#3qyKKCmsaCv zmKK*l2m#zOGwbhbS%JpHAi9R$ASH zU+&ctzarg~Qvd@}FkqtQM&y6Zy?^<{$!+qc6Vm>c$E*F| z?GRV0|8qjTJ3YU;4zp(+C%up0E=s!p(k=g)7ru3<>D}GEB*LvdSgm#XUl<8-KMbIT zfXBAyx1Adqht}~HzGPV@+8PRm)I;+?b^HaVg8xNlL1c?*q&~MfIFvZ&iSKyF6{Me) zLRAxnT2jdtcGpD6%QZ;BfZQc3ZuaWwrL)I1kS31$f_uMEH4!k7=l@TQLXGhE+g?7- zSTmF8hdK&sjf!8L*it#q%&aa7dAJvk^CP4rej%WT|17K>NSvY-&!ZieE-BJ?1%Z?n zHzu9Zx!DL;kksC(r_5*98r40wAAZpf-zcY|l05I7MA*nNSzlnHy@PXDok&l=wkjMU zOZJTEhP^Xct-QW%#l_3(x^jx-At`s$*s{vsOZVL+A}uU0o;r2&9w+xzcz`GPdA8;cS>RzF!5XC6FoW~ zdr%Xx?{eSVZTq=JnROQ@#X3&K;de;e6U3<8$(^5#OsgAJBnf+4GpJ@w#$FxE#$(7t z9vf%XmJ%~D!ir&Q|0%mauO3U>Lq^2bypHl;$NVgAEgf6)u=>f*iDB%?HJ>YyWm6tz zR4y}g*y-#*+(jDOPaxB_D@i|LPN>9Ye2ct$>P}C8a>f#pt%Nux#p|XwM}2XB@AS{5 zAm@xuwFGm%+o7tQS_@`aAvH<@r6|3F?x5RFo3|J2EXj8&aUoDW>ttwvha6K{?r(%KZD3lB3E zc6#DCdosl5FgTx2t5P0EL0grvAALBK=|6mA9Pj?czV5x@|Jz{vV@T0Yky1O2ei^p; z469CMlB1!Yf_oId2WT^3Z1!37<#NnOnedW~i}vDpukHM6th%dQzf>8DTgBLR0+$`p zv&VQQ%U|?(2{IAGqIA2)=GL4vSv%IBqrM7z?~UgDt86mYKIRG^Uiv=U=-^2sXb}dJ z;e)y*zpnSb#%>QHl~d`WR4MNkIJ~wm*g5v@tM=W)8xpt}*RAqmx7a?>d~0v77n(*E z@>;40P96iUSvs3vO};#=4JU(iu!DW>GelPX6jo~8CkL_ahf{O;IIn$I5MlnTVT&@O&N|&FV1!S!^Jl8dy@Nf$q6=9> zDra-wR*awQ?lr#aaFi-EWd7Yz11TFYfYSU1U-Se+6*uWy$}vaM4V59iHlsDBf!$0?`RenRs8wdC1y zBCXR6(f#jaqxeb)d$1?Eq%K0px#fzqb_+CxJ%9Ty-p9-W(>iuyTlJ;uO4T>Btz?^= zIa!a1FcBUDn-zrD3MVI@v3^mBHA7b2Np6Evci0tOUqwYEf688+iQOK)>(i_jpDOD+ z6qegJ+bz(8MJSI;DDO^~%Nw(Lpmkyw(OP~u*I*H}y0lm_&Rb~y6;a0x`=tWq_d8|7 zvZ_2cSNjIjzVyae^xeI_bZ!7+O^^_DdVJFrei6>c%*@j{6vh0MMTjxMuCXzCGEU4E z!|&wrxoxgn?PnGJ)AnCiO^)`EO!>vq<4j#5RSz9M+m&A)7%{BNS&^%`Ovbcb)s&zA z>YSBN=GG=-!bpWjlsvnl74&;JteS_1ic_z>W@4--zfEv%Lfd%{BIB6(I?-x(b-ZhD&( z3gJ3?qD|XB^~e&(`M77JG>T=~4ZnIH`ET0g6rcZHFzPpm8>Z|TLB>D${KLHlRcauO z@@2{E`Le2Hc{gKK_KANg&hq!5Z1hB&-2jrO-td}h4ua7NYpR7@_3Zb+1RSl9TOA>k zI%Uo6S2`rF@;tQ5^ed{|`a$)3aP!`MahCzx!Jk1Hg}o}D2>bl)ZT*ZBFkf8F-ww<2 z@+U z;XB1QKoJKUW(l6GVBgyE2G|dE_r(ZB%n;78AI&Z$R$L+ofJf#G86p*+x2<30SqL+7 zJk3s;4<0ZzJNc%-<07L8*UevnkeXTdgkPY+rlb##0U@#p2yDmPa$GyFxD1zdy7lCV zCMX9G@G{;cQHyEGD{aP4nQT$W&_DU@ZlR2+VaYSPB8^eD!a56Xocy&xy5*B1wY~r9 z(o>4**cO$CwT*6b%Yz6NKRped08l#4nFt8_pcgiK2U5e1BaWE_bIf~ZvE4TvKl%3Xs} z2y%-_G$F~nr~NX2!>swj2iD;n&e>=G_C9;R&jWgx0m+S{lM@iXUjMwdS5-ozvU>7> zK2NYFvFy2nn_HwZjujHYJ^trQ)o&!=!ssBW7*A@7Ca{mUHS*Jr4OUy*{r&yNkVwNRNDZFa=I@l}D2wXjny9s*d}>OH z7y>5&xDDk)+R?6Uka+EuB)oRb!QMTXXC+pdr3h-?`SsTY(i;$t>_w=Oiu@t@?eP3R z*?Io6C;e1GK@zSQ3#@WGCF$D^_L2q@0G!zC8TGRoO=)?#NElJ;Xn%o07#b3~w&;1q zc3xFr`sfgrAj)aIGx^qs7?P7K?eE;Z+w;BUNn6G}rk!@;Sp>L4uFBJWGHYi@hyrGS zDzIkJz!pkWp0-|T-`;$U%*IIqX9cjr0APt-KKoQHoEaj-8KL3ff>EmjlsEpvx{Ae&{Sb(C11{~x3Pn0FG8^CNt@82f zFU$5eU?IE}kpK8#>vckHq~5X`%oo_P60+${!~pK7DC6BXXyI{uw7q!o;s}6tCuirc znM~&37$P_X)#e5?6X=@5=bvxajCQ4-?d@OOZ9aZAjPcZ*d47#v0^s((YUVf4Mvt-E z@p9%UBgX=$j*jqaGsFz|Maw)_xz0Zzz==#wfRDs>)4pSD?RYf~LgR#r$AO^m0Bco? zBsXFK>2$*cr$q+F@JN+vc`KSaf11pZsU8ErsYZ@C%Xej#Z-p(_&s0D3dL}B`xNzCU zylY-<29ck9Mj_Yet8>lsZ2hTJ4zWRj1c)~$dnK-L1aSX|CKjP!9$ZlC$mBs|FVt=P ziHQl@he|DWRtjAA-(D~^g&1ci9&t_$IF|zYAza*XXayL}OgkA9UV(aba8M94 zAuc{MWP z>Cu0f(mI~4dv=I0vo!VkrF8jWOQ;havEIn-Q;EbnmS$S%*Z&<&U{+7PP3uE!#e!F; z{ciyR89WtycyC5wXy`;}mq#i1z>CoAfbpD~=xgkHc0E&~d0w!}8w)wVAAm+n%{{5CY(-CQ%3JlSl*TTaMVp!J-e9s-&&`h; zuWNq-yeSeEIM(f{p89e^f2LHgcW?*?Z`{%b6VJ1&)}?3922zV`;ytu0$k}@!dEyUg z(Sc)N;E>>3Rzk$kM=SoGZ`EKzzxjon(+rAQu$q#eh}@>FUv7*2801VP_VMY8DBN!8 zY3K+9ihrCrGaR3qO#Ad=QggXZ-ohipg;zcZL+e0*#0M@| zgP^tuh5}Gt9JSiSX~?tWu35X*aqZe29s@^804OIvoF1I;gtV}-OM%12)?Af47ZM0d<2F^J2a$QNC_UJg{=Nm*60Vx0b`(9Iy*ay zwx~gcp@YHRCfVrW5zY6>>_N6WF^cw$9nEYA*n~fwd6{AQ<1L@>R>mIKWR_EGgaW}< zP>^zvqEa}b;0#h~XF<_MK&XIpdJV>wBs@#40|kl(LJjKZ=$P%YV&SD!jHb3I?L=4| ziMg*Ot-4>ptnOBS51V5W>?7=n%Q9k*rjibjQoEd-=_J>|X0iUuFT=sC_2BtR;U;N? zJ8f_b0c0iav$U+N21Pn??(K{L1bSk;?9MV`)S*$NXU&R8TXwdQWq3mm;dzEbGX?Hc zjwpUZ+RFz5W#;towpLKSAlvuW4_(!a9#};?ZU~_Cq1^q~ZNDFeiWl)tI+<%SxHG*v z0stbzMOX{{V~NG^9_iS@VeC539`&_avg9%Ri0<$&dKI59EVP=+$u8{zRhb;}^I!Zi z>B2EU13C5^V*Yg@%dB_io&ekWy1%Jpcme6=U-PFU!w6(gW3vh;E&FkL0g1Hl`2TgMqu=5Id0hc%dc zQZCT_ z2vV#7?!M~U+F*_^2Yhp+vGOS{bxaAEeT&5=Zc@@i_iFdWfutb+(67YX_nr6;|5f7T literal 0 HcmV?d00001