mirror of
https://github.com/samba-team/samba.git
synced 2024-12-23 17:34:34 +03:00
992f1e6b8f
add the 5 missing chapters from the HOWTO
and add jht's Samba by Example book.
(This used to be commit 9fb5bcb93e
)
602 lines
20 KiB
XML
602 lines
20 KiB
XML
<chapter id="upgrading-to-3.0">
|
|
<chapterinfo>
|
|
&author.jelmer;
|
|
&author.jht;
|
|
&author.jerry;
|
|
<pubdate>June 30, 2003</pubdate>
|
|
</chapterinfo>
|
|
|
|
<title>Upgrading from Samba-2.x to Samba-3.0.0</title>
|
|
|
|
<para>
|
|
This chapter deals exclusively with the differences between Samba-3.0.0 and Samba-2.2.8a.
|
|
It points out where configuration parameters have changed, and provides a simple guide for
|
|
the move from 2.2.x to 3.0.0.
|
|
</para>
|
|
|
|
<sect1>
|
|
<title>Quick Migration Guide</title>
|
|
|
|
<para>
|
|
Samba-3.0.0 default behavior should be approximately the same as Samba-2.2.x.
|
|
The default behavior when the new parameter <smbconfoption><name>passdb backend</name></smbconfoption>
|
|
is not defined in the &smb.conf; file provides the same default behavior as Samba-2.2.x
|
|
with <smbconfoption><name>encrypt passwords</name><value>Yes</value></smbconfoption>, and
|
|
will use the <filename>smbpasswd</filename> database.
|
|
</para>
|
|
|
|
<para>
|
|
So why say that <emphasis>behavior should be approximately the same as Samba-2.2.x?</emphasis> Because
|
|
Samba-3.0.0 can negotiate new protocols, such as support for native Unicode, that may result in
|
|
differing protocol code paths being taken. The new behavior under such circumstances is not
|
|
exactly the same as the old one. The good news is that the domain and machine SIDs will be
|
|
preserved across the upgrade.
|
|
</para>
|
|
|
|
<para>
|
|
If the Samba-2.2.x system was using an LDAP backend, and there is no time to update the LDAP
|
|
database, then make sure that <smbconfoption><name>passdb backend</name><value>ldapsam_compat</value></smbconfoption>
|
|
is specified in the &smb.conf; file. For the rest, behavior should remain more or less the same.
|
|
At a later date, when there is time to implement a new Samba-3 compatible LDAP backend, it is possible
|
|
to migrate the old LDAP database to the new one through use of the <command>pdbedit</command>.
|
|
See <link linkend="pdbeditthing">The <emphasis>pdbedit</emphasis> Command</link>.
|
|
</para>
|
|
|
|
</sect1>
|
|
|
|
<sect1>
|
|
<title>New Features in Samba-3</title>
|
|
|
|
<para>
|
|
The major new features are:
|
|
</para>
|
|
|
|
<orderedlist numeration="arabic">
|
|
<listitem><para>
|
|
Active Directory support. This release is able to join an ADS realm
|
|
as a member server and authenticate users using LDAP/Kerberos.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Unicode support. Samba will now negotiate Unicode on the wire and
|
|
internally there is a much better infrastructure for multi-byte
|
|
and Unicode character sets.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
New authentication system. The internal authentication system has
|
|
been almost completely rewritten. Most of the changes are internal,
|
|
but the new authoring system is also very configurable.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
New filename mangling system. The filename mangling system has been
|
|
completely rewritten. An internal database now stores mangling maps
|
|
persistently.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
New <quote>net</quote> command. A new <quote>net</quote> command has been added. It is
|
|
somewhat similar to the <quote>net</quote> command in Windows. Eventually, we
|
|
plan to replace a bunch of other utilities (such as smbpasswd)
|
|
with subcommands in <quote>net</quote>.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Samba now negotiates NT-style status32 codes on the wire. This
|
|
considerably improves error handling.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Better Windows 200x/XP printing support including publishing
|
|
printer attributes in Active Directory.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
New loadable RPC modules for passdb backends and character sets.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
New default dual-daemon winbindd support for better performance.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Support for migrating from a Windows NT 4.0 domain to a Samba
|
|
domain and maintaining user, group and domain SIDs.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Support for establishing trust relationships with Windows NT 4.0
|
|
Domain Controllers.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Initial support for a distributed Winbind architecture using
|
|
an LDAP directory for storing SID to UID/GID mappings.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Major updates to the Samba documentation tree.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Full support for client and server SMB signing to ensure
|
|
compatibility with default Windows 2003 security settings.
|
|
</para></listitem>
|
|
</orderedlist>
|
|
|
|
<para>
|
|
Plus lots of other improvements!
|
|
</para>
|
|
|
|
</sect1>
|
|
|
|
<sect1>
|
|
<title>Configuration Parameter Changes</title>
|
|
|
|
<para>
|
|
This section contains a brief listing of changes to &smb.conf; options
|
|
in the 3.0.0 release. Please refer to the smb.conf(5) man page for
|
|
complete descriptions of new or modified parameters.
|
|
</para>
|
|
|
|
<sect2>
|
|
<title>Removed Parameters</title>
|
|
|
|
<para>(Ordered Alphabetically):</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>admin log </para></listitem>
|
|
<listitem><para>alternate permissions </para></listitem>
|
|
<listitem><para>character set </para></listitem>
|
|
<listitem><para>client codepage </para></listitem>
|
|
<listitem><para>code page directory </para></listitem>
|
|
<listitem><para>coding system </para></listitem>
|
|
<listitem><para>domain admin group </para></listitem>
|
|
<listitem><para>domain guest group </para></listitem>
|
|
<listitem><para>force unknown acl user </para></listitem>
|
|
<listitem><para>nt smb support </para></listitem>
|
|
<listitem><para>post script </para></listitem>
|
|
<listitem><para>printer driver </para></listitem>
|
|
<listitem><para>printer driver file </para></listitem>
|
|
<listitem><para>printer driver location </para></listitem>
|
|
<listitem><para>status </para></listitem>
|
|
<listitem><para>strip dot </para></listitem>
|
|
<listitem><para>total print jobs </para></listitem>
|
|
<listitem><para>use rhosts </para></listitem>
|
|
<listitem><para>valid chars </para></listitem>
|
|
<listitem><para>vfs options </para></listitem>
|
|
</itemizedlist>
|
|
|
|
</sect2>
|
|
|
|
<sect2>
|
|
<title>New Parameters</title>
|
|
|
|
<para>(New parameters have been grouped by function):</para>
|
|
|
|
<para>Remote Management</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>abort shutdown script </para></listitem>
|
|
<listitem><para>shutdown script </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>User and Group Account Management:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>add group script </para></listitem>
|
|
<listitem><para>add machine script </para></listitem>
|
|
<listitem><para>add user to group script </para></listitem>
|
|
<listitem><para>algorithmic rid base </para></listitem>
|
|
<listitem><para>delete group script </para></listitem>
|
|
<listitem><para>delete user from group script </para></listitem>
|
|
<listitem><para>passdb backend </para></listitem>
|
|
<listitem><para>set primary group script </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>Authentication:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>auth methods </para></listitem>
|
|
<listitem><para>realm </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>Protocol Options:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>client lanman auth </para></listitem>
|
|
<listitem><para>client NTLMv2 auth </para></listitem>
|
|
<listitem><para>client schannel </para></listitem>
|
|
<listitem><para>client signing </para></listitem>
|
|
<listitem><para>client use spnego </para></listitem>
|
|
<listitem><para>disable netbios </para></listitem>
|
|
<listitem><para>ntlm auth </para></listitem>
|
|
<listitem><para>paranoid server security </para></listitem>
|
|
<listitem><para>server schannel </para></listitem>
|
|
<listitem><para>server signing </para></listitem>
|
|
<listitem><para>smb ports </para></listitem>
|
|
<listitem><para>use spnego </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>File Service:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>get quota command </para></listitem>
|
|
<listitem><para>hide special files </para></listitem>
|
|
<listitem><para>hide unwriteable files </para></listitem>
|
|
<listitem><para>hostname lookups </para></listitem>
|
|
<listitem><para>kernel change notify </para></listitem>
|
|
<listitem><para>mangle prefix </para></listitem>
|
|
<listitem><para>map acl inherit </para></listitem>
|
|
<listitem><para>msdfs proxy </para></listitem>
|
|
<listitem><para>set quota command </para></listitem>
|
|
<listitem><para>use sendfile </para></listitem>
|
|
<listitem><para>vfs objects </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>Printing:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>max reported print jobs </para></listitem>
|
|
</itemizedlist>
|
|
|
|
|
|
<para>Unicode and Character Sets:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>display charset </para></listitem>
|
|
<listitem><para>dos charset </para></listitem>
|
|
<listitem><para>unicode </para></listitem>
|
|
<listitem><para>UNIX charset </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>SID to UID/GID Mappings:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>idmap backend </para></listitem>
|
|
<listitem><para>idmap gid </para></listitem>
|
|
<listitem><para>idmap uid </para></listitem>
|
|
<listitem><para>winbind enable local accounts </para></listitem>
|
|
<listitem><para>winbind trusted domains only </para></listitem>
|
|
<listitem><para>template primary group </para></listitem>
|
|
<listitem><para>enable rid algorithm </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>LDAP:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>ldap delete dn </para></listitem>
|
|
<listitem><para>ldap group suffix </para></listitem>
|
|
<listitem><para>ldap idmap suffix </para></listitem>
|
|
<listitem><para>ldap machine suffix </para></listitem>
|
|
<listitem><para>ldap passwd sync </para></listitem>
|
|
<listitem><para>ldap user suffix </para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>General Configuration:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>preload modules </para></listitem>
|
|
<listitem><para>privatedir </para></listitem>
|
|
</itemizedlist>
|
|
|
|
</sect2>
|
|
|
|
<sect2>
|
|
<title>Modified Parameters (Changes in Behavior):</title>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>encrypt passwords (enabled by default) </para></listitem>
|
|
<listitem><para>mangling method (set to hash2 by default) </para></listitem>
|
|
<listitem><para>passwd chat </para></listitem>
|
|
<listitem><para>passwd program </para></listitem>
|
|
<listitem><para>password server </para></listitem>
|
|
<listitem><para>restrict anonymous (integer value) </para></listitem>
|
|
<listitem><para>security (new ads value) </para></listitem>
|
|
<listitem><para>strict locking (enabled by default) </para></listitem>
|
|
<listitem><para>winbind cache time (increased to 5 minutes) </para></listitem>
|
|
<listitem><para>winbind uid (deprecated in favor of idmap uid) </para></listitem>
|
|
<listitem><para>winbind gid (deprecated in favor of idmap gid) </para></listitem>
|
|
</itemizedlist>
|
|
|
|
</sect2>
|
|
|
|
</sect1>
|
|
|
|
<sect1>
|
|
<title>New Functionality</title>
|
|
|
|
<sect2>
|
|
<title>Databases</title>
|
|
|
|
<para>
|
|
This section contains brief descriptions of any new databases
|
|
introduced in Samba-3. Please remember to backup your existing
|
|
${lock directory}/*tdb before upgrading to Samba-3. Samba will
|
|
upgrade databases as they are opened (if necessary), but downgrading
|
|
from 3.0 to 2.2 is an unsupported path.
|
|
</para>
|
|
|
|
<para>
|
|
The new tdb files are described in <link linkend="tdbfiledesc">the next table</link>.
|
|
</para>
|
|
|
|
|
|
<table frame='all' id="tdbfiledesc"><title>TDB File Descriptions</title>
|
|
<tgroup cols='3'>
|
|
<colspec align="left"/>
|
|
<colspec align="justify" width="1*"/>
|
|
<colspec align="left"/>
|
|
<thead>
|
|
<row>
|
|
<entry align="left">Name</entry>
|
|
<entry align="justify">Description</entry>
|
|
<entry align="center">Backup?</entry>
|
|
</row>
|
|
</thead>
|
|
<tbody>
|
|
<row>
|
|
<entry>account_policy</entry>
|
|
<entry>User policy settings</entry>
|
|
<entry>yes</entry>
|
|
</row>
|
|
<row>
|
|
<entry>gencache</entry>
|
|
<entry>Generic caching db</entry>
|
|
<entry>no</entry>
|
|
</row>
|
|
<row>
|
|
<entry>group_mapping</entry>
|
|
<entry><para>Mapping table from Windows groups/SID to UNIX groups</para></entry>
|
|
<entry>yes</entry>
|
|
</row>
|
|
<row>
|
|
<entry>idmap</entry>
|
|
<entry><para>new ID map table from SIDS to UNIX UIDs/GIDs</para></entry>
|
|
<entry>yes</entry>
|
|
</row>
|
|
<row>
|
|
<entry>namecache</entry>
|
|
<entry>Name resolution cache entries</entry>
|
|
<entry>no</entry>
|
|
</row>
|
|
<row>
|
|
<entry>netlogon_unigrp</entry>
|
|
<entry><para>Cache of universal group membership obtained when operating
|
|
as a member of a Windows domain</para></entry>
|
|
<entry>no</entry>
|
|
</row>
|
|
<row>
|
|
<entry>printing/*.tdb</entry>
|
|
<entry><para>Cached output from `lpq command' created on a per print
|
|
service basis</para></entry>
|
|
<entry>no</entry>
|
|
</row>
|
|
<row>
|
|
|
|
<entry>registry</entry>
|
|
<entry><para>Read-only Samba registry skeleton that provides support for
|
|
exporting various db tables via the winreg RPCs</para></entry>
|
|
<entry>no</entry>
|
|
</row>
|
|
</tbody>
|
|
</tgroup>
|
|
</table>
|
|
|
|
</sect2>
|
|
|
|
<sect2>
|
|
<title>Changes in Behavior</title>
|
|
|
|
<para>
|
|
The following issues are known changes in behavior between Samba-2.2 and
|
|
Samba-3 that may affect certain installations of Samba.
|
|
</para>
|
|
|
|
<orderedlist>
|
|
<listitem><para>
|
|
When operating as a member of a Windows domain, Samba-2.2 would
|
|
map any users authenticated by the remote DC to the <quote>guest account</quote>
|
|
if a uid could not be obtained via the getpwnam() call. Samba-3
|
|
rejects the connection as <?latex \linebreak ?>NT_STATUS_LOGON_FAILURE. There is no
|
|
current work around to re-establish the Samba-2.2 behavior.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
When adding machines to a Samba-2.2 controlled domain, the
|
|
<quote>add user script</quote> was used to create the UNIX identity of the
|
|
Machine Trust Account. Samba-3 introduces a new <quote>add machine
|
|
script</quote> that must be specified for this purpose. Samba-3 will
|
|
not fall back to using the <quote>add user script</quote> in the absence of
|
|
an <quote>add machine script</quote>.
|
|
</para></listitem>
|
|
</orderedlist>
|
|
|
|
</sect2>
|
|
|
|
<sect2>
|
|
<title>Passdb Backends and Authentication</title>
|
|
|
|
<para>
|
|
There have been a few new changes that Samba administrators should be
|
|
aware of when moving to Samba-3.
|
|
</para>
|
|
|
|
<orderedlist>
|
|
<listitem><para>
|
|
Encrypted passwords have been enabled by default in order to
|
|
interoperate better with out-of-the-box Windows client
|
|
installations. This does mean that either (a) a Samba account
|
|
must be created for each user, or (b) <quote>encrypt passwords = no</quote>
|
|
must be explicitly defined in &smb.conf;.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
Inclusion of new <smbconfoption><name>security</name><value>ads</value></smbconfoption> option for integration
|
|
with an Active Directory domain using the native Windows Kerberos 5 and LDAP protocols.
|
|
</para></listitem>
|
|
</orderedlist>
|
|
|
|
<para>
|
|
Samba-3 also includes the possibility of setting up chains
|
|
of authentication methods
|
|
(<smbconfoption><name>auth methods</name></smbconfoption>) and account
|
|
storage backends
|
|
(<smbconfoption><name>passdb backend</name></smbconfoption>).
|
|
Please refer to the &smb.conf;
|
|
man page and <link linkend="passdb">Account Information Databases</link>, for details. While both parameters assume sane default
|
|
values, it is likely that you will need to understand what the
|
|
values actually mean in order to ensure Samba operates correctly.
|
|
</para>
|
|
|
|
<para>
|
|
<indexterm><primary>pdbedit</primary></indexterm>
|
|
Certain functions of the <command>smbpasswd</command> tool have been split between the
|
|
new <command>smbpasswd</command> utility, the <command>net</command> tool and the new <command>pdbedit</command>
|
|
utility. See the respective man pages for details.
|
|
</para>
|
|
|
|
</sect2>
|
|
|
|
<sect2>
|
|
<title>LDAP</title>
|
|
|
|
<para>
|
|
This section outlines the new features effecting Samba/LDAP integration.
|
|
</para>
|
|
|
|
<sect3>
|
|
<title>New Schema</title>
|
|
|
|
<para>
|
|
A new object class (sambaSamAccount) has been introduced to replace
|
|
the old sambaAccount. This change aids us in the renaming of attributes
|
|
to prevent clashes with attributes from other vendors. There is a
|
|
conversion script (examples/LDAP/convertSambaAccount) to modify an LDIF
|
|
file to the new schema.
|
|
</para>
|
|
|
|
<para>
|
|
Example:
|
|
</para>
|
|
<para><screen>
|
|
&prompt;ldapsearch .... -LLL -b "ou=people,dc=..." > old.ldif
|
|
&prompt;convertSambaAccount --sid <DOM SID> --input old.ldif --output new.ldif
|
|
</screen></para>
|
|
|
|
<para>
|
|
The <DOM SID> can be obtained by running
|
|
<screen>
|
|
&prompt;<userinput>net getlocalsid <DOMAINNAME></userinput>
|
|
</screen>
|
|
on the Samba PDC as root.
|
|
</para>
|
|
|
|
<para>
|
|
The old sambaAccount schema may still be used by specifying the
|
|
<parameter>ldapsam_compat</parameter> passdb backend. However, the sambaAccount and
|
|
associated attributes have been moved to the historical section of
|
|
the schema file and must be uncommented before use if needed.
|
|
The Samba-2.2 object class declaration for a sambaAccount has not changed
|
|
in the Samba-3 samba.schema file.
|
|
</para>
|
|
|
|
<para>
|
|
Other new object classes and their uses include:
|
|
</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>
|
|
sambaDomain &smbmdash; domain information used to allocate RIDs
|
|
for users and groups as necessary. The attributes are added
|
|
in <quote>ldap suffix</quote> directory entry automatically if
|
|
an idmap UID/GID range has been set and the <quote>ldapsam</quote>
|
|
passdb backend has been selected.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
sambaGroupMapping &smbmdash; an object representing the
|
|
relationship between a posixGroup and a Windows
|
|
group/SID. These entries are stored in the <quote>ldap
|
|
group suffix</quote> and managed by the <quote>net groupmap</quote> command.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
sambaUNIXIdPool &smbmdash; created in the <quote>ldap idmap suffix</quote> entry
|
|
automatically and contains the next available <quote>idmap UID</quote> and
|
|
<quote>idmap GID</quote>.
|
|
</para></listitem>
|
|
|
|
<listitem><para>
|
|
sambaIdmapEntry &smbmdash; object storing a mapping between a
|
|
SID and a UNIX UID/GID. These objects are created by the
|
|
idmap_ldap module as needed.
|
|
</para></listitem>
|
|
</itemizedlist>
|
|
|
|
</sect3>
|
|
|
|
<sect3>
|
|
<title>New Suffix for Searching</title>
|
|
|
|
<para>
|
|
The following new smb.conf parameters have been added to aid in directing
|
|
certain LDAP queries when <parameter>passdb backend = ldapsam://...</parameter> has been
|
|
specified.
|
|
</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para>ldap suffix &smbmdash; used to search for user and computer accounts.</para></listitem>
|
|
<listitem><para>ldap user suffix &smbmdash; used to store user accounts.</para></listitem>
|
|
<listitem><para>ldap machine suffix &smbmdash; used to store Machine Trust Accounts.</para></listitem>
|
|
<listitem><para>ldap group suffix &smbmdash; location of posixGroup/sambaGroupMapping entries.</para></listitem>
|
|
<listitem><para>ldap idmap suffix &smbmdash; location of sambaIdmapEntry objects.</para></listitem>
|
|
</itemizedlist>
|
|
|
|
<para>
|
|
If an <parameter>ldap suffix</parameter> is defined, it will be appended to all of the
|
|
remaining sub-suffix parameters. In this case, the order of the suffix
|
|
listings in smb.conf is important. Always place the <parameter>ldap suffix</parameter> first
|
|
in the list.
|
|
</para>
|
|
|
|
<para>
|
|
Due to a limitation in Samba's &smb.conf; parsing, you should not surround
|
|
the DNs with quotation marks.
|
|
</para>
|
|
|
|
</sect3>
|
|
|
|
<sect3>
|
|
<title>IdMap LDAP Support</title>
|
|
|
|
<para>
|
|
Samba-3 supports an ldap backend for the idmap subsystem. The
|
|
following options inform Samba that the idmap table should be
|
|
stored on the directory server onterose in the "ou=idmap,dc=quenya,dc=org" partition.
|
|
</para>
|
|
|
|
<smbconfblock>
|
|
<smbconfsection>[global]</smbconfsection>
|
|
<member>...</member>
|
|
<smbconfoption><name>idmap backend</name><value>ldap:ldap://onterose/</value></smbconfoption>
|
|
<smbconfoption><name>ldap idmap suffix</name><value>ou=idmap,dc=quenya,dc=org</value></smbconfoption>
|
|
<smbconfoption><name>idmap uid</name><value>40000-50000</value></smbconfoption>
|
|
<smbconfoption><name>idmap gid</name><value>40000-50000</value></smbconfoption>
|
|
</smbconfblock>
|
|
|
|
<para>
|
|
This configuration allows Winbind installations on multiple servers to
|
|
share a UID/GID number space, thus avoiding the interoperability problems
|
|
with NFS that were present in Samba-2.2.
|
|
</para>
|
|
|
|
</sect3>
|
|
|
|
</sect2>
|
|
|
|
</sect1>
|
|
|
|
</chapter>
|