Feature Request - Active Directory Authentication with Mesh installed on Linux server

[rogalskij13]

Hello, MeshCentral is a fantastic product thank you for all this effort and collaboration! One feature that would be fantastic is the ability to log in with our active directory accounts when Mesh is installed on a linux server. I know it is supported on a Windows server but we run a dedicated CentOS 8 appliance for Mesh (light weight, no GUI, 10 gig ethernet, high ram, you get the idea).

My team and I at our College would love the ability to log into Mesh with their already existing AD accounts. If there is a workaround for this while still having it installed on Linux we would greatly appreciate. And if not consideration for adding this feature would be even more appreciated. Thank you for all you do.

[Ylianst]

This is a good request and it's not the first time I hear of this request. Integrating MeshCentral with existing credential infrastructure is certainly huge. I just added OAuth and SAML, I think Domain authentication on Linux is the next big missing one.

[rogalskij13]

That would be fantastic. Please let me know how I can assist in any way with testing or anything else. This feature would make Mesh pretty well complete as far as our admins are concerned.

[Ylianst]

Taking a quick look at this, I think it should be possible with Passport.js here. However, I don't have an advice directory to test with. Does someone know of an easy way to use a free service or some easy software I could use to create an active directory server? (I don't want to setup Windows Server Domain Controller, etc). If there is a test server online, I will also accept test credentials. Thanks.

[Ylianst]

FYI. I just published MeshCentral v0.5.42 with Azure Active Directory support. However, this is very likely not what you want. It's easier for me to add cloud credential providers, I can get accounts for them easily.

[openmoto]

I could try set up a test AD here but would something like JumpCloud work?

[Ylianst]

Yes... JumpCloud Active Directory would be good. I already added JumpCloud SAML support a few days back, I need to try JumpCloud AD next.

[dnutan]

Does someone know of an easy way to use a free service or some easy software I could use to create an active directory server?

I use NethServer which uses Samba AD. You can quickly set it up on a Virtual Machine. Other similar projects offering Samba AD are Zentyal, Univention, TurnKeyLinux. Not yet ready for AD but there's GLAuth. Haven't tried it thou.

[rogalskij13]

Sounds like some great progress on this. Like you mentioned we at my College are looking to have internal Active Directory authentication to internal Windows Server domain controllers. If needed I could try to set up temporary domain controllers for you to use and test on. Wouldn't be until next week but I will do anything needed to assist in this process. Thank you again for all this effort!

[MordyT]

I can host a full AD environment for you @Ylianst with linux servers if you want for this development.

[FelR]

@rogalskij13 Why don't you use LDAP as suggested in #165? Every AD domain controller acts as LDAP server. You just have to configure your bind account and search filters.

[rogalskij13]

@FelR I actually tried that, as mentioned in 165 but everytime I added my AD credentials and server it made my mesh server fail to start. I figured something was missing since I run it on CentOS8 or something else. If this worked for me or I missed something I would have be happy to use it, but alas I couldn't get it to work no matter how hard I tried. Do you think I just missed a setting or had a typo perhaps?

[FelR]

@rogalskij13 I had this issue, too, when I configured LDAP authentication for the first time. In my case it failed due to spaces and commas in the bind user's common name. Therefore I had to place the CN in quotation marks that then again had to be escaped.

Here's an excerpt of my successfully running configuration:

"auth": "ldap",
"ldapUserName": "displayName",
"ldapUserBinaryKey": "objectSid",
"ldapOptions": {
    "url": "ldap://domain.local:389",
    "bindDN": "CN=\"lastName, firstName\",CN=Users,DC=domain,DC=local",
    "bindCredentials": "topSecretPassword",
    "searchBase": "DC=domain,DC=local",
    "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})(memberOf:1.2.840.113556.1.4.1941:=CN=Helpdesk,CN=Users,DC=domain,DC=local))"
}

[rogalskij13]

@FelR what section of the file does this go under in config.json though? I couldn't find the exact place it should go under "domains" section. I just crammed it under the first part of it because I wasn't sure where it should go. What line did you place it under if you don't mind me asking?

[FelR]

@rogalskij13 I just placed it at the end of the default domain section but in my opinion it shouldn't matter at all where you place it.

"domains": {
    "": {
        "certUrl": "https://meshcentral.publicDomain.tld:443",
        "title": "***",
        "userQuota": 1024,
        "meshQuota": 1024,
        "newAccountsRights": [ "nonewgroups", "notools" ],
        "newAccounts" : 0,
        "auth": "ldap",
        "ldapUserName": "displayName",
        "ldapUserBinaryKey": "objectSid",
        "ldapOptions": {
            "url": "ldap://domain.local:389",
            "bindDN": "CN=\"lastName, firstName\",CN=Users,DC=domain,DC=local",
            "bindCredentials": "topSecretPassword",
            "searchBase": "DC=domain,DC=local",
            "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})(memberOf:1.2.840.113556.1.4.1941:=CN=Helpdesk,CN=Users,DC=domain,DC=local))"
        }
    }
}

[rogalskij13]

I will try this, when you enable this, does it just have you enter your AD credentials on the login page? Or does it pull them from your login session you are logged in as? Also, wouldn't I want to use "sAAMAccountName" for the "ldapUserName" as we want users to log in with their AD username? My apologies on the basic questions but I want to make sure we get this right before we have students on campus again in the Fall.

[FelR]

I'm happy to help you out on this with my also limited knowledge on this topic. You still will have to enter your AD credentials on the login page. The attribute ldapUserName is only defined for cosmetic reasons as it sets the name that will be displayed in the upper right corner next to the logout button and in my environment is stored in the displayName attribute (I don't know if this is still needed at all as many attributes are now populated automatically). For the login itself only the searchFilter argument is relevant and there, at least in my case, the ldap lookup is performed against the aAMAccountName as stated in sAMAccountName={{username}}.

[rogalskij13]

Tried adding everything. Was almost sure I have everything correct this time. But same issue, service won't start. I get the error on command line of:

[root@sauron ~]# systemctl status meshcentral.service ● meshcentral.service - MeshCentral Server Loaded: loaded (/etc/systemd/system/meshcentral.service; enabled; vendor preset: disabled) Active: activating (auto-restart) since Mon 2020-06-08 16:41:58 EDT; 9s ago Process: 27709 ExecStart=/usr/bin/node /root/node_modules/meshcentral (code=exited, status=0/SUCCESS) Main PID: 27709 (code=exited, status=0/SUCCESS) [root@sauron ~]#

[FelR]

If you want, you could post (an obfuscated of) your domain section and we have a look at it. Does the "mesherror.txt" file in the "meshcentral-data" folder contain something useful?

[rogalskij13]

I don't seem to have that "mesherror.txt" file in the "meshcentral-data" folder. Bellow is an obfuscated version of my "domains" section. Mine is huge compared to what many post I just kept what came out of the box after install. Perhaps that is part of it?:

"domains": { "": { "Title": "My College's Title", "Title2": "(MeshCentral)", "_TitlePicture": "title-sample.png", "_UserQuota": 1048576, "_MeshQuota": 248576, "_NewAccounts": true, "_UserNameIsEmail": true, "_NewAccountEmailDomains": [ "sample.com" ], "_NewAccountsRights": [ "nonewgroups", "notools" ], "auth": "ldap", "ldapUserName": "displayName", "ldapUserBinaryKey": "objectSid", "ldapOptions": { "url": "ldap://ipaddressofdomaincontroller:389", "bindDN": "CN=MYBINDUSER,OU=Service Accounts,OU=Users - Admin,DC=domain,DC=lan", "bindCredentials": "supersecretpassword", "searchBase": "OU=Users - Admin,DC=domain,DC=lan", "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})" } "_ManageAllDeviceGroups": [ "admin" ], "_WelcomeText": "Sample Text on Login Page.", "_WelcomePicture": "mainwelcome.jpg", "_Footer": "Twitter", "_CertUrl": "https://192.168.2.106:443/", "_PasswordRequirements": { "min": 8, "max": 128, "upper": 1, "lower": 1, "numeric": 1, "nonalpha": 1, "reset": 90, "force2factor": true, "skip2factor": "127.0.0.1,192.168.2.0/24" }, "_AgentNoProxy": true, "_GeoLocation": true, "_UserAllowedIP": "127.0.0.1,192.168.1.0/24", "_UserBlockedIP": "127.0.0.1,::1,192.168.0.100", "_AgentAllowedIP": "192.168.0.100/24", "_AgentBlockedIP": "127.0.0.1,::1", "_UserSessionIdleTimeout__" : "Number of user idle minutes before auto-disconnect", "_UserSessionIdleTimeout" : 30, "UserConsentFlags__" : "Set to: 1 for desktop, 2 for terminal, 3 for files, 7 for all", "_UserConsentFlags" : 7, "_Limits": { "_MaxDevices": 100, "_MaxUserAccounts": 100, "_MaxUserSessions": 100, "_MaxAgentSessions": 100, "MaxSingleUserSessions": 10 },

[FelR]

Probably the service doesn't get to the point when it starts writing the error file so I assume there is some wrong syntax in the json file.

"searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})"
}
"_ManageAllDeviceGroups": [ "admin" ],

I think you are missing a comma after the closing curly bracket in the second line. That would explain the crash at startup.

"searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})"
},
"_ManageAllDeviceGroups": [ "admin" ],

Two other minor things appeared to me, but I don't know whether it impacts the service or not. The search filter is missing a final closing bracket and the description for the user consent flags should probably stay commented out.

"searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}}))"
...
"_UserConsentFlags" : "Set to: 1 for desktop, 2 for terminal, 3 for files, 7 for all",

[rogalskij13]

Oh wowsers that worked! Thank you I wouldn't have seen my mistake. Now the only 2 things I need to finish up are the display name and the default permission for this group. Do I change those in the config file as well? Display name in the top right corner shows a long string of numbers for some reason.

I'm curious, if this feature works, will it be documented in the user guide? I would be MORE than happy to document this and send in my documenation to help others. Thank you so much @FelR !

[MordyT]

You can always fork, update, and then submit a pull request for the documentation. That's what I did when I didn't like missing or incomplete docs and it was all accepted.

See: https://github.com/Ylianst/MeshCentral/tree/master/docs for all docs (it's actually why the docs are part of the repo in odt format).

[FelR]

@rogalskij13 The long string of numbers and characters is probably MeshCentral's internal user id. Maybe you have to check if in your environment displayName is the correct ldap parameter where your users' names are stored and adjust it if necessary. For testing purposes you could probably just replace it with sAMAccountName.

Permissions and groups for already existing users must be changed manually. Only for new users that haven't logged in before, you can set default groups, they will be joined to (see #1409), and default permissions (see #221) that will be granted upon their creation in MeshCentral

[rogalskij13]

Thank you again @FelR . I found my AD users had to log out and log back in and their displayname started showing (weird, but works on the second login). The issue I ran into with permissions is that my default admin account was the same name as an admin account in my AD domain that I didn't know the password to. I had to revert, add a secondary admin account, revert to the AD settings, log in with that secondary local admin account and add permissions to the AD accounts. Those were all quirks of my environment but it is totally functional now!

I appreciate all the effort on this, and as a technician who's school is budgetary affected like so many others I am so grateful to the community for software projects such as these.

[nroach44]

@Ylianst You can setup a CentOS FreeIPA server - it is very similar to AD in function and works as an LDAP server, just like AD would. (Only thing to note is that AD puts a large amount of emphasis on the search path, but IPA doesn't)

[turin331]

Hello. I have been also trying to set ldap authentication using MS AD but it does not see to work in my case. The service comes up normally but i cannot login with the AD account names (either normal or with fully qualified names). Any login attempt fails. Only the local account work. This is the configuration:

      "auth": "ldap",
      "ldapUserName": "displayName",
      "ldapUserBinaryKey": "objectSid",
      "ldapOptions": {
        "url": "ldap://controllerip:389",
        "bindDN": "CN=meshcentral,CN=Users,DC=dc,DC=local",
        "bindCredentials": "mysecretpassword",
        "searchBase": "CN=Users,DC=dc,DC=local",
        "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})"
         },

The only thing i could see in the trace was the failed login: https://imgur.com/F65EjQY

[FelR]

@turin331 If you can still log in with your local accounts, LDAP auth has not been enabled as you can either use local or remote authentication.

[turin331]

@FelR Do you need to change anything more on the configuration besides adding these lines that i am missing?

Also after ldap is enabled which account is it seen as admin in this configuration? The bound service account?

[tlcarpenter]

@turin331 if you haven't found this since your first post, the line

"searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})"

is missing a parenthesis after {{username}}, i.e. should be

"searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}}))"

I'm using a similar search filter which is working

"searchFilter": "(&(objectclass=user)(sAMAccountName={{username}}))"

Note that the preceding line is what I added to MC2's config.json, but after I restarted MC2 that line was converted to

"searchFilter": "(\u0026(objectclass=user)(sAMAccountName={{username}}))"

I used the MC2 Windows installer to restart MC2 (chose the "Edit" option without making any changes then clicked "Apply"); I'm guessing that the installer's "Edit" function invoked a JSON library that transformed the "&" to "\u0026"

https://stackoverflow.com/questions/12702249/json-converts-in-a-string-to-u0026

@Ylianst, have you seen that kind of conversion happen before?

[turin331]

@tlcarpenter Thanks indeed i did not notice this. Will try it out when i get the chance. Which account is seen as admin with this configuration as the local accounts will be disabled? The service account in the bind?

[tlcarpenter]

@turin331 when I first set up MC2, after installation I immediately logged in to the console and created a first account which had admin rights over the entire MC2 server as expected. Once I modified config.json and restarted MC2, I was no longer able to log in as that local user but I could log in using the credentials of my AD account. At that point my AD account didn't have administrative rights on the MC2 server. Since I'm just at the point of testing right now I just deleted both of the existing accounts (the first local account created after MC2 installation AND the one AD account I logged in to MC2 with after modifying config.json to use "auth": "ldap") using "node node_modules\meshcentral --removeaccount [userid]", restarted MC2, then logged on with the AD account I wanted to have site admin rights, and that worked. Not sure if that's the best way to have accomplished establishing an account with administrative rights on the MC2 server, but it seems to have worked. I'm a novice MC2 admin so use my feedback with caution.

[Smiley-k]

Dear ALL!

Someone made it work with MS AD ? I'm struggling for 5 hours - does not want to work has tried a bunch of options. Help!!!

I am using debian + MS AD

I tried the above configurations - nothing works.

"auth": "ldap",
"ldapUserName": "displayName",
"ldapUserBinaryKey": "objectSid",
"ldapOptions": {
    "url": "ldap://vdc1.doman.lan:389",
    "bindDN": "CN=\"lastName, firstName\",CN=mcentral,OU=Domain SERVICES,DC=domain,DC=lan",
    "bindCredentials": "password",
    "searchBase": "OU=Domain Support Users,DC=domaon,DC=lan",
    "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})(memberOf:1.2.840.113556.1.4.1941:=OU=Domain Support Users,DC=domain,DC=lan))"
},

and

"authentication": {
    "method": "ad",
    "ad": {
        "url": "ldap://vdc1.domain.lan",
        "bindDN": "CN=mcentral,OU=Domain SERVICES,DC=domain,DC=lan",
        "bindCredentials": "password",
        "searchBase": "U=Domain Support Users,DC=domain,DC=lan",
        "searchFilter": "(&(objectClass=user)(sAMAccountName={username}))"
    }
},

and

 "auth": "ldap",
      "ldapUserName": "displayName",
      "ldapUserBinaryKey": "objectSid",
      "ldapOptions": {
        "url": "ldap://vdc1.domain.lan:389",
        "bindDN": "CN=mcentral,OU=Domain SERVICES,DC=domain,DC=lan",
        "bindCredentials": "password",
        "searchBase": "OU=Domain Support Users,DC=domain,DC=lan",
        "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}}))"
         },

[rogalskij13]

Good morning, I was able to get meshcentral working with on premise AD some time ago. Below is a sample of my config.json file, generalized for security purposes. I do remember there being some quirks to it, like having to login to the AD account first after you set up auth, and then logging out and log in with your local admin account and give the new AD account permissions to things. Then log out of that account and back into the AD account. Also you log in with just the username, nothing else.

"domains": { "": { "Title": "Company Name", "Title2": "(MeshCentral)", "_TitlePicture": "title-sample.png", "_UserQuota": 1048576, "_MeshQuota": 248576, "_NewAccounts": true, "_UserNameIsEmail": true, "_NewAccountEmailDomains": [ "sample.com" ], "_NewAccountsRights": [ "nonewgroups", "notools" ], "auth": "ldap", "ldapUserName": "displayName", "ldapUserBinaryKey": "objectSid", "ldapOptions": { "url": "ldap://192.168.1.200:389", "bindDN": "CN=GHOSTDENALI,OU=Service Accounts,OU=Users - Admin,DC=domain,DC=lan", "bindCredentials": "Passwordgoeshere", "searchBase": "OU=Users - Admin,DC=domain,DC=lan", "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}}))"

From: Kirill @.> Sent: Monday, March 13, 2023 8:45 AM To: Ylianst/MeshCentral @.> Cc: Josh Rogalski @.>; Mention @.> Subject: Re: [Ylianst/MeshCentral] Feature Request - Active Directory Authentication with Mesh installed on Linux server (#1383)

Warning: Message from non-Cayuga Email Server. Treat message, links, and attachments with extra care.

Dear ALL!

Someone made it work with MS AD ? I'm struggling for 5 hours - does not want to work has tried a bunch of options. Help!!!

I am using debian + MS AD

I tried the above configurations - nothing works.

"auth": "ldap",

"ldapUserName": "displayName",

"ldapUserBinaryKey": "objectSid",

"ldapOptions": {

    "url": "ldap://vdc1.doman.lan:389",

    "bindDN": "CN=\"lastName, firstName\",CN=mcentral,OU=Domain SERVICES,DC=domain,DC=lan",

    "bindCredentials": "password",

    "searchBase": "OU=Domain Support Users,DC=domaon,DC=lan",

    "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}})(memberOf:1.2.840.113556.1.4.1941:=OU=Domain Support Users,DC=domain,DC=lan))"

},

and

"authentication": {

"method": "ad",

"ad": {

    "url": "ldap://vdc1.domain.lan",

    "bindDN": "CN=mcentral,OU=Domain SERVICES,DC=domain,DC=lan",

    "bindCredentials": "password",

    "searchBase": "U=Domain Support Users,DC=domain,DC=lan",

    "searchFilter": "(&(objectClass=user)(sAMAccountName={username}))"

}

},

and

"auth": "ldap",

  "ldapUserName": "displayName",

  "ldapUserBinaryKey": "objectSid",

  "ldapOptions": {

    "url": "ldap://vdc1.domain.lan:389",

    "bindDN": "CN=mcentral,OU=Domain SERVICES,DC=domain,DC=lan",

    "bindCredentials": "password",

    "searchBase": "OU=Domain Support Users,DC=domain,DC=lan",

    "searchFilter": "(&(objectCategory=Person)(sAMAccountName={{username}}))"

     },

- Reply to this email directly, view it on GitHubhttps://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FYlianst%2FMeshCentral%2Fissues%2F1383%23issuecomment-1466078348&data=05%7C01%7Crogalskij%40cayuga-cc.edu%7Cf4cde9d172e54032a4b308db23c0cec2%7C8e3b3c3c334542d5aa04d642aa2334f2%7C1%7C0%7C638143083245699798%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=%2Bu1j8oLfnvmOdBcAoJwiTzgH91xistKa6rm6rDlPVUU%3D&reserved=0, or unsubscribehttps://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAPMBJQOUENCYKIE4JVZTQXDW34JGBANCNFSM4NGIOXPA&data=05%7C01%7Crogalskij%40cayuga-cc.edu%7Cf4cde9d172e54032a4b308db23c0cec2%7C8e3b3c3c334542d5aa04d642aa2334f2%7C1%7C0%7C638143083245699798%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=zyymDfJXuszd%2BLuzX%2BpLg3LVhHF0Zdoxrgu2PfBBt70%3D&reserved=0. You are receiving this because you were mentioned.Message ID: @.**@.>>

[Smiley-k]

Good morning, I was able to get meshcentral working with on premise AD some time ago. Below is a sample of my config.json file, generalized for security purposes. I do remember there being some quirks to it, like having to login to the AD account first after you set up auth, and then logging out and log in with your local admin account and give the new AD account permissions to things. Then log out of that account and back into the AD account. Also you log in with just the username, nothing else.

Alas, it did not help, and I cannot log in with either the domain account or the locally created account.... (

In the logs I see the following (but I enter the credentials correctly...)

@vmeshcentral:~$ node ./node_modules/meshcentral --debug web,webrequests
MeshCentral HTTP redirection server running on port 80.
MeshCentral v1.1.4, LAN mode.
MeshCentral HTTPS server running on port 443.
WEB: handleRootRequestLogin()
WEB: handleRootPostRequest, action: login
WEB: handleLoginRequest: login failed, bad username and password
WEB: handleRootRequestLogin()

@vmeshcentral:~$ node ./node_modules/meshcentral --debug ldap
MeshCentral HTTP redirection server running on port 80.
MeshCentral v1.1.4, LAN mode.
MeshCentral HTTPS server running on port 443.
LDAP: LDAP Error: InvalidCredentialsError: 80090308: LdapErr: DSID-0C090439, comment: AcceptSecurityContext error, data 52e, v4563

[rogalskij13]

Hmmm, did you try rebooting the entire box after you made the changes to the config.json?

From: Kirill @.> Sent: Monday, March 13, 2023 9:23 AM To: Ylianst/MeshCentral @.> Cc: Josh Rogalski @.>; Mention @.> Subject: Re: [Ylianst/MeshCentral] Feature Request - Active Directory Authentication with Mesh installed on Linux server (#1383)

Warning: Message from non-Cayuga Email Server. Treat message, links, and attachments with extra care.

Good morning, I was able to get meshcentral working with on premise AD some time ago. Below is a sample of my config.json file, generalized for security purposes. I do remember there being some quirks to it, like having to login to the AD account first after you set up auth, and then logging out and log in with your local admin account and give the new AD account permissions to things. Then log out of that account and back into the AD account. Also you log in with just the username, nothing else.

Alas, it did not help, and I cannot log in with either the domain account or the locally created account.... (

- Reply to this email directly, view it on GitHubhttps://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FYlianst%2FMeshCentral%2Fissues%2F1383%23issuecomment-1466137179&data=05%7C01%7Crogalskij%40cayuga-cc.edu%7Cfc2b6ebf6c354fcc5eb908db23c601a3%7C8e3b3c3c334542d5aa04d642aa2334f2%7C1%7C0%7C638143105588511386%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=dXLtP9lylb6POgPE5EXjZz4arqIf%2FQA67TzCAzIQFRY%3D&reserved=0, or unsubscribehttps://nam10.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAPMBJQJIMSLRI3TTUZAERADW34NRTANCNFSM4NGIOXPA&data=05%7C01%7Crogalskij%40cayuga-cc.edu%7Cfc2b6ebf6c354fcc5eb908db23c601a3%7C8e3b3c3c334542d5aa04d642aa2334f2%7C1%7C0%7C638143105588511386%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=7Ih9TSKWurES13SOSocW6zLYdpeR7h3sbUrUBv%2BMWKM%3D&reserved=0. You are receiving this because you were mentioned.Message ID: @.**@.>>

[Smiley-k]

I did it, it works... I'll post the configuration later and describe it...(now I have to run to the plane)