From 21a0a1aa8c05cafe2136e1fb19e603adee4e0011 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Wed, 3 Sep 2025 01:11:13 +0200 Subject: [PATCH] improve relaing page --- .../docs/ispmail-trixie/180-relaying.mdx | 181 ++++++++++++------ .../relaying-authenticated-relaying.png | Bin 0 -> 19447 bytes .../relaying-roundcube-selecting-identity.png | Bin 0 -> 11507 bytes ...laying-unauthenticated-relaying-denied.png | Bin 0 -> 16147 bytes 4 files changed, 123 insertions(+), 58 deletions(-) create mode 100644 src/content/docs/ispmail-trixie/images/relaying-authenticated-relaying.png create mode 100644 src/content/docs/ispmail-trixie/images/relaying-roundcube-selecting-identity.png create mode 100644 src/content/docs/ispmail-trixie/images/relaying-unauthenticated-relaying-denied.png diff --git a/src/content/docs/ispmail-trixie/180-relaying.mdx b/src/content/docs/ispmail-trixie/180-relaying.mdx index a50fee9..ab5582c 100644 --- a/src/content/docs/ispmail-trixie/180-relaying.mdx +++ b/src/content/docs/ispmail-trixie/180-relaying.mdx @@ -9,10 +9,10 @@ sidebar: import { Aside } from "@astrojs/starlight/components"; Your mail server is almost ready for use. But one puzzle piece is missing. Your users can receive emails but they cannot -send them yet. That is easy to configure but it needs some important precautions. +send them yet. Actually this is simple to setup. The security implications make it a bit more complex. So this part of +the guide is a bit longer. -Please note that there is a difference on how **users** send emails versus how **mail servers** send emails. For -comparison: +Let's begin with the difference of how **users** send emails versus how **mail servers** send emails. For comparison: - A **mail server** fetches the _MX_ record for the destination domain of the recipient’s email address from DNS. That tells it which mail server to talk to. Then it opens an SMTP connection (TCP port 25) and sends the email. @@ -50,7 +50,10 @@ indeed John, your server must reject the email. Try for yourself: ```sh -swaks --server localhost:587 --from john@example.org --to list@example.com -tls +swaks --server localhost:587 \ + --from john@example.org \ + --to list@example.com \ + -tls ``` Towards the end of the output you will find: @@ -74,7 +77,12 @@ We are making sure that his authentication happens over an encrypted connection Try for yourself and provide a valid user name and password: ```sh -swaks --server localhost:587 --from john@example.org --to list@example.com -tls --auth-user john@example.org --auth-password summersun +swaks --server localhost:587 \ + --from john@example.org \ + --to list@example.com \ + -tls \ + --auth-user john@example.org \ + --auth-password summersun ``` Towards the end of the output you will find: @@ -330,14 +338,14 @@ As a result you will get the exact same string you used above with "AUTH PLAIN". Please note that there are two different TCP ports on a mail server that speak SMTP: -| Service name | SMTP | Submission | Submission TLS | -| -------------------- | ------------------------------------ | ------------------------------------------- | --------------------------- | -| TCP Port | 25 | 587 | 465 | -| Transport encryption | **Off** at first. STARTTLS optional. | **Off**. Then switch to TLS using STARTTLS. | **On** right from the start | -| Authentication | Optional [^1] | Mandatory | Mandatory | -| Meant for | Servers | Humans | Humans | -| Used by | Mail transport agent (MTA) | Mail user agent (MUA) | Mail user agent (MUA) | -| Your home ISP | may block this port | will allows this port | will allow this port | +| Service name | SMTP | Submission | Submission TLS | +| -------------------- | ------------------------------------ | ---------------------------- | --------------------- | +| TCP Port | 25 | 587 | 465 | +| Transport encryption | **Off** at first. STARTTLS optional. | **Off**. STARTTLS mandatory. | TLS all the time | +| Authentication | Optional [^1] | Mandatory | Mandatory | +| Meant for | Servers | Humans | Humans | +| Used by | Mail transport agent (MTA) | Mail user agent (MUA) | Mail user agent (MUA) | +| Your home ISP | may block this port | will allow this port | will allow this port | [^1]: In previous guides I recommended to set `smtpd_sasl_auth_enable=yes` globally in the `main.cf`. That would indeed @@ -352,7 +360,20 @@ or 465. ## Configure the submission service All Postfix services are declared in the `/etc/postfix/master.cf` file. Most of them are used by Postfix internally, -like `pickup`, `cleanup`, `rewrite` or `bounce`. But let's another section anywhere in there: +like `pickup`, `cleanup`, `rewrite` or `bounce`. But let's another section anywhere in there. Run these commands: + +```sh +postconf -M submission/inet="submission inet n - y - - smtpd" +postconf -P "submission/inet/syslog_name=postfix/submission" +postconf -P "submission/inet/smtpd_tls_security_level=encrypt" +postconf -P "submission/inet/smtpd_sasl_auth_enable=yes" +postconf -P "submission/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject" +postconf -P "submission/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject" +``` + +That looked confusing, right? What it did was define the `submission` service in the `/etc/postfix/master.cf` service +for you using the `postconf` command. You could have achieved the same thing by editing that file and adding this +section: ``` submission inet n - y - - smtpd @@ -364,7 +385,7 @@ submission inet n - y - - smtpd Some notes on that: -- Lines with options (`-o`) need to be indented. +- Lines with options (`-o`) need to be indented so that Postfix understands that they belong to the same service. - The word `submission` refers to the definition of the service in the `/etc/services` file. So it translates to TCP port 587. - The `smtpd` at the end tells Postfix that connections should be handled as incoming SMTP connections. @@ -372,7 +393,23 @@ Some notes on that: - **smtpd_sasl_auth_enable** enables authentication on this port. SASL is short for _Simple Authentication and Security Layer_. - **smtpd_recipient_restrictions** define that only authenticated connections are permitted. Without a username and a - password your connection will be rejected. + password your connection will be rejected. The **recipient** keyword tells us that this restricts who the recipient + can be. +- **smtpd_sender_restrictions** deals with the **sender**. I will explain that in the next section. + +While you are at it, create the `submissions` (with an "s" at the end) service as well: + +```sh +postconf -M submissions/inet="submissions inet n - y - - smtpd" +postconf -P "submissions/inet/syslog_name=postfix/submissions" +postconf -P "submissions/inet/smtpd_tls_wrappermode=yes" +postconf -P "submissions/inet/smtpd_sasl_auth_enable=yes" +postconf -P "submissions/inet/smtpd_recipient_restrictions=permit_sasl_authenticated,reject" +postconf -P "submissions/inet/smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject" +``` + +The only difference to the `submission` (without the "s" at the end) is the `smtpd_tls_wrappermode` that switches on TLS +encryption right from the start of a connection. Restart the Postfix server: @@ -383,78 +420,107 @@ systemctl restart postfix Your users can now use the *submission* port to send email. They just use the port 587 in their mail clients instead of port 25. -Feel free to send a test mail using the submission port and encryption. You will need to install the libnet-ssleay-perl -package first, so that SWAKS can speak TLS: +Feel free to send a test mail using the `submission` port and encryption (using STARTTLS): ``` swaks --server localhost:587 \ --from john@example.org \ --to lisa@example.com \ - --port 587 -tls \ + -tls \ --auth-user john@example.org \ --auth-password summersun ``` - +TODO: try sending from roundcube ## Protecting against forged sender addresses -A "forged" sender address means that someone claims to be someone else. Let’s say that John has authenticated and the -mail server trusts him. Nothing keeps John from impersonating someone else and sending email in his name? Most email -service providers have restrictions that you can only send emails if the sender matches your actual email address. Let’s -do that, too. +At this stage, a security issue remains. While Postfix is configured to relay emails only after a successful login with +a valid username and password, it does not prevent an authenticated user from impersonating another sender. For example, +someone could log in as `john@example.org` but send an email appearing to come from `brunhilde@example.net`. -Postfix provides a setting called -[smtpd_sender_login_maps](http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps) for that purpose. From the -"maps" part you can deduce that it expects a _mapping_ again. This time the two columns mean… +You want to see that this work? Let's pretend to be _brunhilde_ while authenticating as _john_: -- Left column: who you claim to be (email’s sender address) -- Right column: who you logged in as (user name after authentiation) +```sh +swaks --server localhost:587 \ + --from brunhilde@example.org \ + --to list@example.com \ + -tls \ + --auth-user john@example.org \ + --auth-password summersun +``` + +That should not be allowed. But Postfix does not know better and responds with: + +``` +<~ 250 2.0.0 Ok: queued as EEEB420F51 +``` + +We should fix that. For that purpose Postfix provides a setting called +[smtpd_sender_login_maps](http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps). From the "maps" part you can +deduce that it expects a _mapping_ again: + +- _Question_: who you **claim** to be (email’s sender address) +- _Answer_: who you **logged in as** (user name after authentiation) + +If you think of it, the mapping is simple. The _question_ must match the _answer_. If `john@example.org` wants to be the +sender, he must also authenticate as `john@example.org`. As we use the email address also as a user name we simply need a mapping where the email address is listed on both -sides. Fortunately we already have a mapping like that: our _email2email_ mapping that we used earlier as a workaround -for catchall forwardings. Let’s reuse it. Please run… +sides. Let's create it: -``` -postconf smtpd_sender_login_maps=mysql:/etc/postfix/mysql-email2email.cf +```sh +cat > /etc/postfix/mariadb-email2email.cf << EOF +user = mailserver +password = SECOND-PASSWORD-HERE +hosts = 127.0.0.1 +dbname = mailserver +query = SELECT email FROM virtual_users WHERE email='%s' +EOF + +chown root:postfix /etc/postfix/mariadb-email2email.cf +chmod u=rw,g=r,o= /etc/postfix/mariadb-email2email.cf ``` -This sets the parameter both for the SMTP port (25) and the submission port (587). Defining these maps is not enough -though. You also need to make Postfix act on this. Edit the /etc/postfix/master.cf again and in the _submission_ section -add the following option. Make sure the line is indented like all other options: +Tell Postfix to use this mapping for our purpose: ``` - -o smtpd_sender_restrictions=reject_sender_login_mismatch,permit_sasl_authenticated,reject +postconf smtpd_sender_login_maps=mysql:/etc/postfix/mariadb-email2email.cf ``` -Restart Postfix after this change: +You have already added `smtpd_sender_restrictions=reject_sender_login_mismatch` earlier in the master.cf for the +`submission` and `submissions` services. So you have achieved these three steps to prevent sender impersonation: -``` -systemctl restart postfix -``` +1. Create a mapping that matches an email address to itself. +2. Tell Postfix to use that mapping for `smtpd_sender_login_maps` which controls who can be a sender. +3. Enforce that restriction for the `submission` and `submissions` services. You can now try to send email as a different user than you are logged in. Let’s us swaks again to send a spoofed email: -``` -swaks --server localhost --from john@example.com \ - --to john@example.org --port 587 -tls \ - --auth-user john@example.org \ - --auth-password summersun +```sh +swaks --server localhost:587 \ + --from brunhilde@example.org \ + --to list@example.com \ + --tls \ + --auth-user john@example.org \ + --auth-password summersun ``` -Please note that John’s actual email address is **not** john@example.**com** but john@example.**org**. So it must be -rejected. The server should tell you: +The server should rightfully reject that wrong sender: ``` ~> MAIL FROM:john@example.com @@ -463,8 +529,7 @@ rejected. The server should tell you: <~ * 553 5.7.1 john@example.com: Sender address rejected: not owned by user john@example.org ``` -Sorry if the mixture of example.org and example.com in my examples makes this guide less readable. But I can’t use any -real world domains here. Please just note that sometimes it’s ".com" and sometimes ".org". +--- Of course you can test your new security feature in the Roundcube web mail interface as well. In Settings/Identities you can create another sender email address as in: diff --git a/src/content/docs/ispmail-trixie/images/relaying-authenticated-relaying.png b/src/content/docs/ispmail-trixie/images/relaying-authenticated-relaying.png new file mode 100644 index 0000000000000000000000000000000000000000..d1001a07ae7391d2c9f782d702c1612be1df3fc6 GIT binary patch literal 19447 zcmXuL1z1~6*ENj01$PNnDDDm|!L3Mu7T4lX++BhfC~gH>D8Zq)J1tgsq9 z`~A7#kjzO=X7-$IYp+f0J542g9BLdSBqV$lWsnXM67m(|xeFEs;wV!P$BOua=J8fV z4-4@K#IlAUUSqo{zxO~w!WsDQ7unW1d0{w;gXH7m!(;E_=wW5y zX2av^{xSDNiW&)t5lIE~M$b3zDBmZK&gSZ6eLtgfxxRgIywpJT6;mjq$vY5-;*n|{ zqlg|USui7ZKUrhbA1&i(f@mOKohAh{eLGY8L_hc|MwOw zemNq6tN-4N1+WZdoXe!h^~xEb5*O%t@f%%wxM)M1SrB-H7rs>f-iJT<75I?4k=B|C zQCB(H*)e9T|DBtQ_Q)AW9St=ASu@oV8D@>{l5-n19W}xyBzYUE3Yb8UWBldqj#TdR z;El4V9<(aHsaV4 zy{lInNPuiTeSLB|eoM5(#6%$x5gj8VH5Ou~e9g4UeO%Cw#>Vu$J=@e@))u3??nv~C zS>z~cp;ToB{;>6?Ro!T;scv81v5Ij^*mRjH7i_i=*WK1jBVS){)*#bhKIO-cH?z#E zbLvnp{C`b*){X(3g#Kp6V#iT0 zpcpHM;O#mmc1pDY;i90-b3W_gR4C3PaX$RvDZAO3CH{=

8f?XPyQc_jLxNMU`Ffr`aiO9`H9X8@(eolyJfvx`oCoft!SHq1sw*eG4<2I zgz}xVIcg=X-XkAh)!2XQuze+`AphVn#})FRTUF)Ekp0QD{})4E+x6x+l^tSV@pQ{H zxoO1Rck1d4$Jm8Vd0)S-U_eYa0+X<`t}Z1y8sqox-y^&3)&f+2{|PzHRU$;W?MIJP zXP98frO1}XlsTG$kgO3~S}(iw8BQY0r*No&`cugMtX7KhWk!*ecLkKDq3|pHowdi;7^Lt$9Xp=bObuY2dvxM* zSx1}Sr@QvonX7j@e)2qbJu|`-&J*VHkqdxN$BpwRproAF2nXJt zg{%I_e5IG}B%;Qd4n#;@o$Z%x!_THB0ndX!&Tw~x@~I!af;*&T`{xZ@3F9+!RzzzK zsMRPH+bDP7#Ik)>Ce_pCjouIi%yu9I}E50#gcr4wR-C`xuCr_%f^4jKH(_FL?0hwcc6)xVJ{K|vIJSC z56xKZDhs)&OBcRjJ`UaTL(GYB3XfQWNt|iEEe|$?{dcK8*iN_pdA{dmxp*oDVS%)D zbt9mE|Nhlspu_~iUq|t{L2Fn&Ap(6x>J1_+A(2Py)-gR$H#4>>pouVIMAw-fo z31SxTI%tuuV9`(7ThdTXPA7>qAm*R}v1qHYXv=@A#EAuqDVjxtet%ZRTiLVuFy%y( z$jqi!4!e2wh>pB&A!2F^-SrW4g7)RKbzhLdKVs=lq#o1Aob?0u4-lYfK#&c^{dEzgxU*a ztM~e`=W9~rMF-AW@MJO*$0EGLKmhrZa800nhwMH$S>1%iUCvKIAwd~!{QGA+6d~8T zf2MP9=ili`$AfR&e`I3v66RoDy}OcoN>3`j6CxvvfG#ah$DoF+{%?IqC4!A+K0#{O z8XU+l^A5*Yo=jZUE22{syi31XX5E_$3DGpC(XU_Z zWpoqdlR?M|7whO&aPGt=o{)xvIadW$AS7Oq0XTr9WPtWcS?_Uj z0-||l$Pum+URc&9bUAc0f=^udxhTfB#)@&Wf1mox-=wuZI-Qds77_|zk$6L6{wG3op;=Gba7lk@ zQi<=9jnZ`b{Yau#*4rWatR;vfQg?XG4mR1kFGSTt z^+AKM++>p6MfUrM+pW38PIs#oa4i^dtyQr z&Dl5T%<*fHUwQ1yo?i2!RbzBDrWdk z=I{$NbBtP?TO2pOT6NILa2A{)47xU%!d11@%yc;2_q>JPd^h0vano(Y4UDN^iIn!oqVE9^*Z;N1iXg+iZEZlfT9 zbj(Qm6|nA=#z~+37ZCU(WCXY87tp;8YKsjhCM3#R`JN_yV6(jHx7v7jEP2`?$gGrf z#Q4TDyc&{V$;WJ3|9;3vii z`{^X_`K*nJml|lW2517Q8chayrGB=Mb3jBsWTFDVta$m*vBbh~&#<=enA>!H+0K2+ z^T*DH*;FJpb4^aB0hzb6tHnlSA;V=6QiM8yk;u~MB7Qhmr6n!g{FG}XbV2|1y2-U~ z##;k;@p+kWOVergS#Tq*$IRa^*Ggfhtfzpo7mMmXfEMT;4hb{^MLUgtLW@=7qh)L9 zJFV3EIDdd`V`HNS1|tHJ_Y0hyoIig2_}bCYQOin6h2NNAL`4&lGo7~}z7XsE+(LOk`c_<)c8`PVXL>az0Y(c4#b0 z!0-3;F@yP3pMv#LPVBq};|H0ReVQ*|T||)35g4t2yDw1Y^~JdHHnM?@Hei#z*={En z32;Y!Ru6r~YQcb@d?#K2_k7rR5!og$)Siun-b;h?J8eqv>!jtt^C;bzTUngf-sVw| zM+FeUzx_H-4sB0%6SPTu(~61!Cr&ApR8XDELZeLvLP+Yhk#2_Y{L(XVxIV zFWyMc>l-v!73{ip0f<>3{oz1!Mw7tC5O4pVO%VoOyuofOym{)xyzGEwlqXAG|5YJQ z&#ZvOoYc?nNRJkb1t$!rGFUwqvsRkkv!#Hz&)f1L`uOarKjba3M==Y3FntjI;(IJs zJj=XL>yLce0T*fbi+N$Uvn+(i@Lq*0_~|y;%zchr_RY;LZmlV34&@`N)(@CtF9Ed8 z7##BhCfjsj__o96%!muxJ8Z5l5%>YL7dz65oO`6N@cH1&i4Uvv7vlWtq?_o_9ie^` z`IqtdRw^13pV!;dJyHOB6jRKlutQbJa@a?`tA%IEcMzHW!cZU7bxdS4)KXMj&<+Y9 zyG7VV>hnH0Q$6T$n0J|(I+LA7DXDVNV=GJfcYH%Bndxta35{$)KSvGL)3Jd3s|t#g zU*A6alGVMjg3Kl{r~Y8g9IvxD#v$*1qJ|qZd3?NH9^;e@EA?Io+MmLs;ja_`rj$#D zJf@zyOp$mdGxaEiog$HduOh00INVs+zGI$49lIs}cy~Jni2d>IbPQ-cjiI$Pk_YF8 z2DFKF;FeYgDS--zQd}X*$NH4=%|;*5en<+Na}*tLZ)WBCMM+;vCoRg8d$uUaZU~vn zZscb92h~EmHj{!VZq?cM^A3{kMl9gMhA_V<$M&B!n6#GDU&(FUj3{D;k@t~YV@Dc* z7bbx6(})0qTff=zn}-E0QxO3Stt48(Ht({!erpBYxQuVaYI-T!th)R;%gf!vn*a6} z=W~Z^y+$E>7#ChvD{lIe7mqg)7p@Jhz)V{RrHFxs)edJ*&^z3;!y@ zn_g0#yvl_+{ag+RA_4y_olc;MwN#BTum1zxhv_bZ_Rz9zWx5~7Taujv|8#U1TgABYLcFym=_#dsF_e)i2q{~U$`*~~v8hlUG z6>DTW`tO490pg^iPehi(a;|yrM)^F(%EIu07nE*^(6#wo8iGr|Mu0BEOI>_7Lt^G> z16;FYt74vArPKogGCtSqjR&V*66=8#-nVo8%887p~c+u8Y9OZm|~q4x-!ALN2Fb^dUj;Ra$IiutgnC8Iy4-I@OFN|NJKBrc$s zWX8M|TZR?rY5_kogSNGlkzn3;z|3{m4@b&pfhqBdiFEJj;z4#x@9@HTR}|A(D?IE1 ziCUFe-ejGpb;!km|?vsB%Kf_FOHk(%9#J}2e-Y3t(}@JrKGJgO8VrH z)NcKa>(q24R$Y*Vz~1Hq6yj<7a7>&JNS~1Mh&Wya6r5m9?S1W@IYp#aDBh?%D5fMS zF6jMq7N%aGXO>?Rm$7n=+RXfs$f$Pd*Hw5Y_lETB9dO6pZ;!`?Ro^txpT36c*Qc>C zuPAq~DZ4MCYldo-#pD2sK^VC}wv)Nd20fBtU1_3;;=GQTnNe$#{i-ZzL9OxUM?@wi z?whrDz|bQE*0}i-!u$n#rCJi$rc366bB;~r0YOF@%*#UDtA90=&n5rtgE32aQbv3f z@fbeL7L5HV_zeUglPUm&qj_LO#n$!oV&5O*ag9<8!(sKsR2REZG(@pqVJYK#y=Jr< z^lQ$3SB9-kiFG9~o7MZdI+CRJ+XlDm5MofHG5B&0wNS?9m<#3;z=jALdagSU<4G?Rk~XI}H2qX-fT_?nxj zrEXr4>FIp|H}Ao9Ya zR((TXI-Qn|_p69=_p~Qbc~9e7cKo&)(-FuJ0*7(sH5$&j`h_G<80`NwE_0IXo0o#U zn(YrNJpytdDR7`^s6d)l%Mxu*%sc`5+)_i?Mp)>(@@bfE1%XaQacbgH@a*hnnw^-F z7}uI3S5;NfLDbpO{-vBbxgt_Kf|!E6_tY(@qbFjj;E>u@ywzbuE{k5uGeUn}-$D`p zRw7?vR$iKrH?w!TgWr16H0w~}7NB7MAy_<8@ zvAqLy6yQ0Q#rs&j?v50LrHuoyACPiXD>B6XQ-j(MzOn`fy=(lr@MirD_Vb5AEO?DLl2%#`~vhcGQl3AcFG@DH*J|g{Hd*4;mf^{Zgao|FhHpzxNyqrn}CFW-# zR#99QJYCl3WdUJT`YMAr9+nNK3iI`@A`nRv^tzOI!L~P(d?=YgD=0|X%ggHrCjy^> zVAUDofxlN(;R7tjbA&-9+Ir~<@s&KkR$4u9nIz$R<5rt}QBpT69-xw`K4}D|qj<~o zhv>EotA%Lv*$)CW{SF-u3Yrd+sfiQuvTzniA0H?omLJFFDI7N!|aN4Ag}zi001&xhST^Ml9Wh{jwA&Z3}09U z&RPUfio-?_bje0R9B`KfmHCt0zXUs|`RERQ>_V+Xbs0SJ(Q-Y0@WwDB7Tba_E3*)P zo4z)Xx!s7!7P2Qs#MB5F3jrpnYG~ji07RZV0}~T`IWBT$>cmt8NVwnJ)a31;v_ik> zQ1)=i*ud&x0JGY|v`Em$d@9i-JA9F_8L%1U$Gsqt;g~?rpJLW&y$-4C;){CQV z!g}w-mUjJjkv2B#^KbthK^0sh-O1agQx;58$~N&4)ZdR}+#RmQ=xTF6efq|pg3K%p zfK!zJ=Gf#Q;JK9X-FLhU@q3+jL6?DW1#1KDXz@p~hRKdhDpPzn($&n^&Tvzi5?%2^ z?1Z7dI$IP2dxlb})wh@T*&-yEC}p+T7Ir~VU*$CgvRTqq$za^W+n->Ehqz6h$}D|f zICPPe+0uS+rm<_;Hm`b@l$J(Y3t;!`{7O?Pn@(Vm?P9dK6}lW3UALZvg1_l-=#-Np zw9dD{pjH$G0a)wk>koZXNxO%G^HB3nuZ5u}z7Yil~r(=h9bV%T zA1Ua;I$I=UuvKXTPQ(sMhI1**-uFynlQ;z0L2TiCF>VDz?j>$>|Ir2tx@^IXu)Hj~d z)Yn#b1bYd-g&#}<%)(nK#niz2V*d{8HZTBpr600EFQ!VZ{35X<)jf>hAZ-vZi|*bf z!H#~r;K8(!_VM{?zs*sKfXipU16ple3ZcdA*e$TnfmWaFG{++kqsF(p=KxZs7EUFr z(jFM%)3*|l3(;+nnZZ{~;A7}#weEg)g6UF?lH%gJ|xVdgf zd~)LPTUeQBUs^9jvqkL>^FQil7|d%UK#^erGV5KDQ)uwp1>A=?tNnn5G;jWw*Bt6bFNUU7cTP0Epr#E8_IN5)_OKN3q9TGp!VSzG5LfV}(uwJM4`m2> ziwWqu=QrE)YC4lN=E8Eh(hd5Y6`D&l-^4F|Z(;TN{L&c^);3(c!8rS8u41-USxS z&FL>KEuBdv?-zy?{F^SL_^Z0-E?y9PZ?9itYQjil!c;iz#~MA2PXTWTCl;wr4JE3W{#?$kn@| z^*Ol-T^F;zW!xYFWD_RzVWG<9LXHSKlqWao&3g4xT;oRkH*hI8<56S{X48T7G)?9$ z{f&j?P-mb!r2Pd&UDcjA#iOp6Wf+;g0+tSRk8Yoz=j+Sv!&+2<`d35pqWKTVve57{ zHvbVh6*bVOwJ~_!$Qprj^FhzD;HNU9cR`Vstkvs3U|fJ-=6*9~*i!KQP>N7=mv$Xc zu&Jfv6V914IG-2D;gh&XnI=2hnW-DPtaoJwbZ0;NPQT{$pTY;6c8Veb3_Nt{B}~F&Ms*-nQrbd&UBkYaQ;BJU!e=u1gU^d`YB;| zP>I>6?zZ9)gK`);@WO24HSi)Wb=$1}V32`tdOm%DwsoDZFk-xBng2sAu@Tlf{-ZMZ zNnpaDsXnQHgOxDADI=N4KoAnSL@x1Y_d3S=@1ZN ztsdBnB<0i`v`LJBbZRTwPhF}{8%f7WzGwH6w@lhrc8O40Jg8F5oiFfqCIL}RV^w6PQ4_9k%&~26)~EC119;YRg>QN0ta6YU zUZWIR{ezhBmyd>+g$xBZf8Cy@GzV{V(jKo1o|#4?2ji*Y*x5+FeYe}Z?9#5SudiQw zc-$~4!)4O;WohZd((;dG;d;ro+i2n81R*mFDU#Vmm$HdN4R2=98?Rdy(e zZh2D%QRcK*ZS!Iw#)d+nlp;=)v7q9wBA3grIXQjrc1_vOV7PhFPf8Og6Fq(^RxiWJ zEt5w4(4802HRQ9GOcODFZo z3%?ftd*Fnm%ItLBm9yami*?D%Ds)HdElp-(;olz$;{JawK>DW~Bi)~@4Lk0pN?p}7 z9#IQiUbs(%ny!zxPKWZwjjZ!s-R&(L?jfxk%*w`Y#$>(pyi#|*Q!D$`l3c9hi$)0> z@z#B?t2i?li3h`k3@_plV}?6>5uG`i}~;sXT~!MYP=MIXS0 z=qIR}#3_eiynpWkS}}DW)=|}a$=R045LH@XVPQnDgs3Wpy_=bvBgZ0?Lj=>q^Z{Ir zjg9D9D|J@G^-hZjzzPvoCpd|W_C?_$YNG#z&+1uxMG+F`2(Qgb9QzqjVYL>ZV~H1b zocpu3X8Kt`F_C)qg||PDsd|X=R!d=rQ+@Tx#^;FXD5RbEVX_h>_(Wa3KXl#a)2d)z z>BV-|o?Q?&{Dr+qIfTsU+lkUAZNj0mq7t?q3KUI1iu*_1LV}}GD6{{=2Gc$He|9=g z-To@zu+UUnPIRQ3rd=M0Us4Rj~Ydcgyh04emzX@V~I??ujU*yyEb z0ln}q>LQc(bEK|3zL`yP)&iL>x!tg++~8D~f^OPT#xFyC22Dcc!)9Tw7UJRisOxUW z?I`=P$}~-HyWfJ-G_Sm~)85TnqFHg+DqWw~2N;+Wh{5S}?@))-^({Hu$kkB-h22hY zNn?8g%@d*izzguk@I+l1I&S%ItAU;S)Q_A4H0H$TH+(eDL0P{EH}2$KShIrKey(=E zU;y49j}fw4utiFSGC}WkzP^Z`JV|d9Y~myU){fKxW~jluKtd~#--lt|H~-Y+dmknT z$+0)qtbPf~K<>m=$fOLwX2dCuVHJa^24fh(2~VZ{e8XjGVW(E{1@@%i?@@YoK_E-rC~1P>(%)eM9n?Pm#N zHDDW{g5|I8j+8j5*@Jng8Gg2dgeU+k)bWbI6uY0fjwq}cmEjvFes@khr(sal8MWpy z7qf>6X-Cs;xP^NwdBWXKONXT$MT*s4CbqYEq2k}3ItXiwkd61cWTKv)hs{NPEt(Xx zkTL2kN;2e5GV6 zi;BY9+9ar{sVSv=-QK7om~o=X-AX_n+q*R?5r2 z+`PPHm6eqdnJx&|nfB}KVw5-J?!N<`QBP@@9s}1w$3z))~_KVMIC}Fy$>mJ6=zm?Xv_lcMpbjO`Ps!5|8RX$CU z<^4kiEVx>*0QVvslA7k#nRO;EnJ3B1<|~07`XA92>;6A+eSH)0pSTQ$^YUA8UJ*KB zkEwhc>-@G6ANNO_@YI5HCvRCGi+b6hrVPa>*Ch(XFi|Rj>@na^d8-zp9NHNM8ABsj zTpJ=QegQDb$pGS7C+mBHA4v*t2O?1k#5N9;S#*k^QwR@-y*-q;++9>;;l@Jz2K1x4 zx)kyFyheQRE+0oi;EHhy!RJD+F)oDMJs@IdV;&_T>hB05RRAJ1K59oWL=@tP2mKR} z%iKId)F|5_j|6J$5|p|&>sYi^P(s(eD`G?1JJT#!U>lTYW#!yi12Xb~i(-hq>B?|z zbU_~uZEel|A18=&?mctp2kJq+jqhJ95;|W;uTkmp+8izRFg83frf3cIWzV6!^c`*c zh%bBTfHN^A;|IS%p%WhK%sup3;^uX5B3IqnJP$iZ@T_|6YQE?Pa3)5zBpUq7I$hSG zQ}FhIOa<7@SbHo!unNlKgIoQBJgpB;dsbL8k-nGq^tbW4*dF5n``2>{TkWqy(gvgz zLQSlRQmdg+~+9?Rg{|x~a zAVQS??z8f8jvo(FldrA2iBrOVzXKt7G*PEA4U-71gg?$?A;?oo3_(BXMu+(ra?L85 zwotA(#!gE%%7DOj^S+_wlNX9!@{8FlK_`(vK3ZdS9uj*>{KzGkh#FX8STITgd_Tei zi!OZpocyM{dT`Hk!ldl)>SP)6u2>a{h-^+ii7Bd_dD2Xa$GX>i_IeemZQb2#fB#|2 zR_1rJ=wVHqW7(eIuT?3z^*o^PtyY+ezm*I%iX_Uo(<^99@yC94nyDJsiu4 zII9|^**zyfcM0+f9adl?^j`diJ(v{!m&b>Giq}HZA{kjeZ@>*@FzeDFG`=>Hm=IMd zcH|_>*+0dQIKfqH?-`HWtesZO4D<}SBgDguMiDE6DCu26HWujM-HVB?KOv8J9z9h1 zCxmA#P3B?%F*4lUWfRbIBJ1J^WP}(jjSHujp}=LQ;RYsK;bwXRepSFYPPz;%$J*b5 z3Jl_>U+BsE*U%nyxlV$Aw422TT>k@ZEe~i7u~d%oPj0@?!m$qli1(RsMIK=76Y0ai z`6VsBNyLm&a-PRajn4CCAx~*N)4|$DJ@#~OqdA?zn& zUmYAAAP5v;pWX~TOZ7W~)AxGd$hP7A`uh>xS+atCZj_9Ui{Gy+M4cAS7|e^VEzql6 z+$c45C{hgSS}BJQCUA~I0s(t0*#mnQr!yBE1N>#iJv9zO%n)Tks)xm5lNamfUSaJ~OqPU)NwKf((2=g)A1i8!4wps>*4-*J3K1o}`| zV^;sa`8rsL5>kW04v1SN;&q1qHO@@}B2~+VJ~v&W$BvvE7U%uC1}6>C-c}C_Y^2AI z;B6QsZFYxeOJlZw?7|)mZq3ZS!MxhTTq>AahjY>=GXtMw{wt5W;?R<;yHNTe$-1dO zC~p`dC?xt*0m$7%YAH+6RU5%oJhRYTJdZHkS@Gl85i7$VGc=TG5;|NS;GwFGZq&RI zs8;OAJU?52I2%>rDP#yUEFF3u#D4r>|IQ-immF)D5wKtK ztJkjs%vgxa6Nk4!z!dXDyGeKl*`kwo)4pGP!{X7FI$J}__wP1S$Ia`{OL^iRe@PqN zy4YNd>`apSC=am>JxAT3rAo_I~Qu@;;D?Cr2I$0e%l*f=_D9rqg~h$pFA$(h*qZyAN^dK zG3Z>he8Yz?$8j>CH>V}(+@GC)iS6zui|5SGXB1DMz@g5HeH{Y=8$d=RKX}d>>}4ldyJCa%wfPHGXw{ zIl^UZUU46#F>IMLL*#8cYG(I;c}UnbrS!nMG$KxhKOJVFtb_>Yx}H@n!_`wc5w*+R1ETIfq985Y>*T&Gpsy| z$gR4D+pS<@MrsN>7zvAOHG^)G4CW#)*;zTA0JXn6{qy%>i>DL_la%le<2+Qbh!QZkGXdTDu%3+#_r$KB0v^ z0iIn)>i$%5j-V-A0qb$%jifQGwm#}u|4g=u+~oH;`ZQ1f7*^mm|I(iJh5gnF$y@v5 zBq3utR5z>~=#F3dDJw>W6Y@Q*ituut=Xx>Hn}HAs6ADuayD8C>C%RM(F$K%M-uwQ* zr)a)s8UI;)0i{%k#tbqpCr7gPQ3*Gv-I}DyTo%C&H82ahil;1rzYz8!Lim49Ry31v z4E6M2Vm7Zr9^m@W-d=?vMoT;2FUql%OAfBXZBX3`5yRl#-%kr2s+P~9gqHCUVrSaJ zPB;DTeJ>PQK%m*X*W>;;O@E~6rzwy01SW(A#kW67A02fDDS%9e$tUSxL}D7tA$5LU zEViRBug<Kp&;LZ{*F`*IwY_^(ie85R~*eCc91{&q+L6rfAAk%El`kP`3yM_fMh(^M4IMv27Nt^=l_6NhXXP ziOAx7Rv1Hlq2{`q!ZjR^F0|r&GOsUP+j2`7l8WY*Qstj@#^w7^M=8iLV=;^6>h(0y z7l>lo^X)ftof9IFv<;;mQ)1`hna0NG>wpP-tNPQ6V`fa42Mzo39VqZd(qG>+>8Xgi zPIiKLeS}wmaMauUi;Go_DnIWZg5Jl82^nS7?=mLckx&sY_w18uvm$AhNk9rr!;6#z z{yAOeAsd3HW1#Qp*t57nQ#4t)3)j$gUACRQz2&YvR<)5nbXxKEvz9cc5( z84d`57uQc2Gwil7aP&Tp2`^?|yd3hNm^wOD?vu@f$bMUGByEnbY9z7Z#o^{n5 z=7c^|NrXa6!Crps9<5bhirTOD`O^NhXWdmIS17hj(HhK_YFHeEJvh5inn`L-&ymOz zu2dLBpO{sA8EUzs7Pzd6aUb(3(OX`sIUv*Z`Fq4_NI62p#S3TExrAcq5;DZ8xE134 zOzzh+Ft8LUch(_8^m>G$frH3K-#=^DEnRdE=(U89r6fZ}oPqUnplZ_5$xw(fH*m83 zDF|ep1j%Cr0-8h8AyS+f!y$5S!1EQbb-gP*a3=`7zBaTiE)PCbrC?(cp#!?dL8Q2V zu8@&Qg>O2bYvPnepnC>HFMi|&v?DS9LJxS)3`E#UhA_WRvF$@P!1})N2n1^U7SO6| z%;DlwwG7(f0r)A6-L*A*qCz@A}y+x@@`h54>B z$A?Zx2M4eweq;(L(4Y9^(V0H8o?P{o-lJlWz4mWbJNmt`(v*?FEzzVTiqLQnFLyZ= zV)f(wgNB}iT6J!vHC8(PbPIvfB(HtlTMuQUi&5XBi-bIJdbL{!4-}RhumgYt-q>}p zgn296MFxv!Qugww&DE&!#O1or{qR-$m!3x=ndIHqx7CgeVG4v_tYVWi`)PS!qRHm( zTMnCF?|F*j!z0@I%GV;c<19WLijk*(qRo)~>iHN^hgDWoT`0RB4EfIAMFcOr&72N= zSPCuS$DC3zg6-&HSHG5gyim5ix@6?UjM27<@AoR#xLz_oM6%4N0xKFey$Cv4KGH>knT z^tvcZ<&Mee4RR=y$0G%QeUSJb&;9rT67}kZvPBX6G44BS_d6~nRXR2yvsiAdjJ78B zx<{s{0M95F`K1AYS2ldwFXudxh#n)$+_xZDXiykBvM{q{Y}gv+7?!_`Bz%!4OT$gz zEaO9TFQEmxyeexlf|YFqA*&T9GWsDCzc}pESHD|D@p^9>!aq#SMYH~z5;YMDgIhLA zMwi3zL|v~vgFf)3KM^;Ei@vT?=%X^cs8!ON^+>%5ZfV^a5~iGvZba3pfMEa@vEdv6 zL&?O%qrd$k+lL#fxryxph8w|FUC!{8zRh=)8w-xlw*d*dgoysE|9ZzL152x+!_J3w zp3$bmjNB;f{O#E+;ajgiCT2oh zWves3E(;$p=Hf$5UQCX-CU<{zk6p7YI<7M+SK@WkMBEY`hG#m0IZxTEqv)dlDjyQ4 z4rVymyVaDF`uQgMfE%2wuBN1p0|bM~X{=a?l&mQSCQDFgC}TT{zmR#kP` zLm+CyIM~ucpxc}NJjSxF&M}l`h7+REv$e|5bMe$2;di@M0lkSIu^XGd)i;;OC^`m> zq26GC^G{Qq@)Dz_=+HZgpcd8VL{AuiR$>oxnsEMu(a@*5ju+AL^l7^A-D!qIg+Qrq zgZFH3KK90w6K&)`!iG-)hGZQy1Ana<62-SV@m4DJNe@taGWqtqNNNRo9xONt%m677 zb@k2NgKy6t9Xnvvbssy;GkDx)nPp4vJrl)GF(6($+D=mt!Zi6LddM` zDH+H*0b<-lwT;d1cE(XTGW3xTBY=?nMgr$`TtnHRK@_;xD2z4xtkXMr7y`;9N|EQA z+(0+1edK_dE$m*CY&L=i#+CcA_K_YnRwyM;478P3ukTj zBYu6oZE(;|^l;jpsB){-axKj<5${lGxS(Q)?OGctSU4om_>42k{6aupe(~+FAz*_# z;uVK0K5Aik1X-~-j&DRLjsj>XeuQFBb%@wbRvDy8NHo)K{9p*k<^mRGSO!_v>Xg)A zPOQHNX_CM02#rsaLii(!lp2X*OnrvCexQ3X?fZr^!X5hXgCl|K8LdTB#KlTpY?`0 z=ABlboB#XjjaHfzFvZLzm(XL}HJxnyRNc44{Y|R)s@_oJtT*e6 z0BPDz#9sN^%8Jq2D_5u9c4|SAP;L>2x~SuKJ{?63jtI6UU7sj!C!y~A4Gw~v%q8ti zovW)c;d3aVeo>gPc-XDUuOZ=?XVkzq^u)m>4L3G0IhSynI8DsnetdB9Ow_@%QxcC! zKB6=~G&XFhGc=v`laI`|Xh$N`;zOjtQ++AazZs(LIZqigUdPTa{HQnP zM1-Ie_SEoy6y;O#$yg2nJh<`^m!vS)42-F8So0%0oy|^U`M+l71yVfEs|T*UrT#&( zwWL9K0WvKokkGOZ;M z*vA3|qHG-J^-YvwwALD9ne6c+-v2pA3?W@i+ZI((Oe^mr1QQ1cy!bTM?^Aoq+D*6l ztDqgxZ2jM*kx}!@AAHG2SI|Qt32w30TPFc}pld9a=<|ofKBw(OL%h3+9($m>t%~fY zB$wx#oK&}Fi?AmXkhSlxJNY~j3(;n*H=voF z1eNZ<)z$hm7NGp-Wa3neUvmAmlsk;fl% z>(27FJ#Y=aO;0tX+sIr&xR506*+!rMp+~(@l=w!F3OE;K?M}Fdq1JF{vqu;T8zy-; z-R9#mS~TXWzJ2Xd+1>w^MG?8I)h8FHl?`U>-#e z9w^pQ_EZ=zSM;=K-p^Ssh86T%#;_xGdkxcLCLupZ`c-D4zPJt3qhPc?xmu2qb2Y3~ zW!(hYY{;Y=B8R>pwYN2Sn?sgEFsyRS@0zsS9@IjgR-d!OWIR^(4Z>VopKvN$)@;0*^gJxs$k_3s<(7D!0A#{d0a zfY8Ibmg~ZD2gy)KUZP4{jTLT0P#qd}{HzXTIR7cd>a)9gJ?1pet@xhVVEw!agKsq< zDl=$D`KI$d2)I-yv5M@ezKxxs^@!5^f-?9{24(vd-83fl|8B))I&U#VoHiZy4_N=& zEfFGxOBPyCCsjkoawNk6UFgLCW;}4($iWEsc$!p2#2cs~$?knV?&BMfK-SVT^*&a!4!Fjv>0e0Ph<27la1M=ae zZ~mY<@|zWOVX$N#XG z;|dWXM2HaE2?n&ITxW2FR~ms;K}pm(nzfX)?TS@tyBf2#*J9-+|EgAcGI-s=K)b32 zlkRtR|7zE-S2d;s4snCjve9+bFM-+co4e^#k5w&72ihuBHQCiUAvPZ(@>O7gs?ONf zV=0A*9E3Sz{z^pt0$l90O2Ixi06%ito}R83!RE|vSlQ#1TVvcILWJlXJCvjjpjPH` zBSNF98#-y5=hWn10M5od+;1sm=&o;)!&OqEmpy;1sD(9tE!hdEz#dGC(R1Xq%@wQq<$apHn5lb{H3a{7Ln;#6viqM zIT2grdRRosBY|gaz$#VM0#B*xX(IAH;CO67e3`1gEFx!M3y1@Of2oxu4iO?mA7F=* z)I)^mXH3GRVIKzpSE%agBC;QFu&RF2G2&Z+V}Tz7pHa(C;3tS04ZNnR9}$tSV8w%` z0+$14xqI9xA~UdPg^vR}yZvWHKGwT?oC=(VMR4HykH(xm zKM9m!&Y1_KkHQupI|E0lYHsshYlsjbI>U~VQ7%M? zZG}cGd6AC|6dB>?fL%r8X3Sx6yvu6%7vR56IuE8LejxC9tjq2m;=*NH$iO7GP#NC;iuERY_j(rAmFuf7D4jAJ6PP)Pr-~m<5s_L6SgVPoO zObZ!$h!A~`P*M*OV(a1^Aeh=W8E}$(9V^58>ymSB5s_Pg4`7-6Cb{+rz|-z?uBx_+ zNJc~w&X;0mis6cx!1WX}wXFb-5s{IY^XD2&jUL1V%qesNmU%FU*MVnL^^8q?_Bptm z1}@cb#D#%^MQDTw5u%R~GW8H4wl1Ef>oCE)un@;ujDb#4)ia$6`$bIU9#q|bO+yAV|Mx*y6GDtM2J2>=qMK=#8!rgJbcxK30+#>%g?jL~%?Cpv3A@O``%&dtuFX>pIPccJ8(pkWUQhHmcH1067 zKM&$-O_HPnxu_>em5Id?Gh2HQV=M>el`o=6k|aekP%cTTfV`aVp|F23zgR7l#BG5) zaOvU>Mbc8yT99nnf=s~T49wq87~BsBuN(_1LcyW zosrZFxD41QX(Vt@be${dD!l%{i&1c=51#uy3RrArD=UmQ5Lcz!3p{UTzemNt*Uao! zNz?HB@((2~1WvfEbv`;PWm>0$jz=bvrQ57cDAHnaLag1{4@a5Xj*~q z5#z{90gs4Z z8SUF7?a!}|c!2YPO}Lf4H=b#AVUBa~sQJmGeYb^&kDC|I+-tbY$p|EC;U7-KW+-|*~?@f+|Gz)6y{ z6X||WlIpM)m@H{jb5ZY+2mT$djlK^ThB>P2vO4@-^e}u89BF3tQ50nZuBHA^sKoUG zdIQG;_w(OPMN6D1=@Lm(fu3geTj5#v;L@=(W85R-d6D#_q`trkV3edOl4itx8!ODS z6nH!;AWo;UTy2shZ6Gc6B&iOc;MLHk;8L;A;4W)`ucHk-NbWq~cHEk6QnAd;8YE4` zUEOnmZ(@_s4Y=FP_DZ?|7-44bNqP!*zt`c5e))X$_uB^I z%)`ZNZp7b-FOK#Nz`k&&PXcD)R(xrU;{2G|1Cl1-^0)8eo`@t#+JO|GNsO@jHvSqjJL3TT(}3g5Y*97lPm<)| z$UwOy=^{uPOohK$NdwBxj}DpIA(DDTTfagrbL5;-o)?b?-XW=%q~4NhB-Ir9>wqgl zh$cyrPDZ-llcbXqi}p)+uvtx^{Zu@s{r9-$Rx|q+cptCuwgVU^>1Dk1=}<|t&1@Ag z2N(bxA*s8WmD1oo1%~2jao6A?HT@*LYGyA+#kh62I^D-r|L{qYw2HLUlce)=C9ouF zmp@x*p9MT^X0w3Dfa?l<&zRZuc$!&%Gnu7(x3|SZZ@+kaB0{X zh4vruO+u0+os3-6lce)A4pQ96{@Z zYEA~$x8nLFNjivpr=BF8pVxusBuxQ!7TOmBwUVyHg>B}xV$3&ycOpft*%Y>BI31YZ z%6pO|=>RgNElIivlKPt2-xb<>nc1#3jCVM&vo$&Ak|qO_%xpnx=Sz~L`uq#URV=oF S2srcr0000v8&y?51v zj#O5ZLV(4E1pxs;kdYQw1pxtV1HSt}1Ax!SLVzr=0dp0VQHO?x-q=&x1py%jkr5YB z|6zEU1Ea4nLDVVM3|cAN`VNDUhV4h;eb1R~>z6DfZpUMA11r~yv{V!w?A~Z5DHzJ}d0w}nI42Sy;UFA96AN@jhWpv~d zbl`G)VUc*SCWZ}NQRGYuMuBn;(^1{1J$oYpm+THKwg?qtEP|I-%`w_U~^LbSG+JEonJU5~uO?NMz z;V7T86q=5yHy(p-oOkG3TPs@LuWS9)4Rer9XtZz6p5yFqm>O-o%$MZ5KDs9%Z$zd2 zV>&k!AoPm6d?Im{z}uat{jbQ93Ox-Krm5hN*dE~#GD?OPG`atPg1@4J%D(nCU1-aqz>?J^_pt8U1o;$kPv6md~q?n zT4B2$>Xq6myrJhe^qdQEBQZWmO!X5Ir=(Cvn{^Pw}`O^U3{JreM&tf5i(nNKp!xF*-){ zv|-H`O1WevKw`DE-t|XDPs+2aJbERUN+HS<5?9xCP;X{Th}Nwo_4Ee;n_TZn`qV3D zz41q$KmsO2LX?)&%4!x~>;g-pHmW;W!~lOddXBcSHCmH>IFo;ud*TPV zy_i5cM+9Qca{c;E$(k^OxbvBm9qtzITIga!X_!7zD zS>0Bso+ntq7*VfBF;UFGog4>)=5R44x&;-1wp~g40V^kG!da;;L#*APL-7%o1%I@2 zp3Oe)C_a43kU}!Y6xN7;Rlf3g64K1_0-_aY19UOXr zNA5=Er@ z)N;ym{Oex$xnx?asG#}>zEOwoy7UmszoTfE#=WxKMW|v(5m8q58J?{3XXk$s z#qEw}0tyOUHNIAso&a3Yjw=p{i64i>N=xc4YgsvWF)V)d!J;{8`a=Wo^Y$+1JQ!$&MBvoO$(}KhG;caLkYPVbUW<(jCn}va`;cEXC0$8& zL0zomVxv_zCDG^d#P#K+(()WWO%31T%ASw<($Ew|_3J=iG%W2HSFbs!0gMA*lYW6- zAmB;^431T0YHmedBJ_{Yth5orxCNr{YXn;<>j;zn9>4!=V9;6Pu@Z)t`?Ze!$HD?u zB|H|CZVVxHX_0_qi{Q&m?9(DxaKSAYNgXG$irXg$y2RQiZ9!TVsYXz5`Pm)&gdL7bw z_$kkBlt1G<3z!@zqP(uPaP1Q^zt=vl+Cz#qjv_l0Q+s-s10^xQM&Dl2`Hb z8}H4KiX`|Im8l(8)idndE~sUH0)D!~=k)_sC%&Xm2J^_RCQ^Pnd6 zuN;_tXJ=trL>$oCY+$OpImTPEcrNhqt*Qr`xb6E!5n+(kOJ}lu1L7Me=m_i;2n56` zPm{!dKC-gm;ac)!wwCiMT25NG`MTev#NnzJw8rd z>(e>rZAvW%JDxuam7a<<*LXhBpmnxshZ;Li^K-=WDEmnYxbq+Gl8R>2Z#?0pSy3eH zv?6W6y1MG5g2IS*$r#s0Sn+PygYng12^Hs|!x?bN%uGy7?FA?%>W!7rITHL}_Fy>< zGjWQ9=U8Ujc^Lm8i&G?wc4}4y{3}loH(@@3ceZ_v?{Nn~u#w!Vf|}VSkv)m%LIra=+w@_yg_-weeK8c-rAzh8s@R=R;_ZA3T&P>1%B%>A7~u|=ccV6gWDAsEARwHq$u>IVdG1HNS-~vW7uD*DWvkMyr;?Sw$TZ@z6vN^Z z_e!@6Eikur+&5ANz2D#V>3oP;?Msq!h~YiA;q70SR@m16ofU}=u^@Vcs1>&6N{`df zKBv@~J#nmBrxl1(S$j5sDpz@;30Edf6A6AKmQ|Qt;?x}u(Z=piz{sd~B}JjWK8ShW z6=Bl6{Hxd2*9qh4zTif|K!-|bbj2&eI6VCIbwExrB;j@AB9hnRI}xx=8rX3@sXNUlP5Lu&k)4YF*e*kH!8dQJ(fg zRE6dP4Dw-$;TID^L(?mz6l z94Y!k-7W=_`Za~|xeL0{wzdW*fEY#PMT~sgfayj-Rv3P3Ma(7ak>FS!OOn0*NU$J>oC6kEQ`@r2$y@@fE z9;F@hcGuZIP58HXWCAWp_EkLV2<{J`j|}2jVWWEm1nNh&-wv?EwO9Nz4<C4>CH-{Y580cl>QWS$I{Y6)GEcb$p+{R7WoIHc{A)&5Cw$UI_hERT3LT8Q`^Kng z2g+}#2uq84d)dlQ3T3})n?QDDeV_{!Y?>zL&whLk=zD*A$ zkjh0jh3Cb(-%X7viKpgnW;p6Et-9B`AsOBFD2}%C-fC@FMKF0!73zlReOt@pk8bfHL~B6Y$;$(yKG%*SKuj|0F0I=$UPGB6}Mr_URft z=G#!=9h7xcwojt14%cb!u;H;fSf4^!QDxD~GvtMg=~}P1=TOM)5GW=M?mn7pAg4c$ zO)A!G!0BDV7Qj+?)NUov_0m^?qlX89{#g%$Xf&V?Zm&e{9IE$>Xf3sanzjXTj#{_ngQW;llMk&#;(K&mUx67!wxH`UUR51r+XM2Q?*c1 zX^&}RI5VPE$LwL%Mgaj5Wdz>j$tsMt^O!~S%{K!ng)Tw)66uN1P8%UpFTvqw6J&nt2I1az0>8XFfQ9VWuMX>_ z!C1vni;#heYnnem$`fE;j%`$r8NivgS00{3}jpc5>%Zj;&v*5%PU15 zze$C|c&g&BW%XLV5dz&u-iv%Ozf2JNnpV4yjC9b6-;AYc91UqW=W_EqR;}%k-AcA= z6?f8OFM;j;qj>=|jAOnSSk9cbb-8J%E6?$Sy|B*n%Ag$}fGKd}`mr9L$L(moF3+`^ zY#UfG%mjk}cmrOriw$qYV+dK$6xTN=ZZ>-Sa#JF7UkYsGKw&+=Zunh`d>cEI&l5;_$(4_VyBOJdDvc28 z4|4Q$MCg2viAE59bg-C+7I1APSx_ap|KK1GoM=G*={YiT@ar|}T-|VeL1$CwDHA7e z0EzaPJ*K0U(InL}2fJpXjm>%g8~=JSIHD63Xr1I(j)!A4#}NfxMFoo#4JkP_3GMtV z^D`o}6Bj75ic9N<&N|m{Qbu~pC6mmMVI(vvke0tIf@~6kOM<%^pk_In)sr7lICC?T z_a%UU>!N{JN!XHZz7Xi84_R*Z$+?t11T7N)H>5#K9N!S6i!E{x0e~YYOr4MlIwR(phud7n6^IOjl zC!3pSG$^GlX}VIAUZVX(Y>Sh90oQquT!#dBaS#9js_|cHDkeUUB?1wWrhjMNc~)kv z;cJKk`-<7Z0YQkxL4d$MCcqD`S>LU`&}`>r&xP}PIIZCtJmSC*Wtacv!wf1p zlLj~y31+FNB((7Xx%fK>V1H{PjoHS*U+Lg+*_HoG_}zt#G(<)@^Ukj27bi;NxYUxk`T|=geO-e)UkDnd&0{mmvRalczFRK}4|~Sm z1GX_X`T@t9_V!;v=V@6I@FnX_Oe`o$BamUi`Xa>s=e|A>C+R|vE3~!xk zYr`V<#MxRgZj5k=i?~UIXS@PvA7$az)4N?u+H6b#jV% zS61O%M}LQn=lHSBb~--Woo#VLMNUu2^|dPy?V7f}9vqc;76r74(s|+xj{8_3p3p$R zR7$AF+mm#nx8MQi2eVw2>pT?%Vfx5 z@*q2NG3I<+c@$mJ5q$uJ}{Z@W2pu%${z`ay`A zdq4AP)>@l$pX}Xs_pX(eY?;EQt|gV%?n9z}zHz0H9_5eVRYXt1{%k1}zu@VRV?^yj zLw=+Xt%cBB2?SvY{|#-Oi>$kQwuTBO8lc}j9~DR>73;9?Qt;tQex2Sha?7UN+ci3x zH|%$Plq!wZ%-0BZ&tKay+A;%W#&^7+SFKhexwRizwEy;=Qzwr%BB?05OnR`eFqgAW znProV+@22t%;{vuwL>Dg$NK!FNVfh z{)@~jLspd4>0vDmO!GVT=pWK)9FaqQK`&WTq?Ys580w?reqH4psnJC@usl8I4~7a3 zV^1T3e^SL7L@RbHfiFx=P1F{Q=hpTM21gu_DT_@z#w&EBmkV^-CzFy6aJ)h^G`Zl0 zsOs32wyHGA%j>QF+?!2^vVs{4F*s66{7WKhtB2E9i^k?}|F5aCA>ox>OoD_o?)LK( zPe;y^3_`>(vOX=GY^^Hj15efIf(h-U%P*n9=h$Jdp1 zx(Pb!vAsvN*7_b2H^Iid(fk0F_I3|HcZ9;c6m={>>XAo(-dCvbaSlEi-#2+2yHA=7 zO~zrOk3vgDA5FzbCruzd!b-T7umFdNoUZ+$hFj+Q8^ElZ zqDRfAje}Q*prO%)nv_9pqrqV)pG{0kxxPdBJehejlqQa=rj$31!yog5g>uZdx&)c* zQd?Ml>h}kWn#GSlo+0;4ZmER9VO{Jf?kLz5#u{M~;t~+e{7hl;7KY{0!>(c+!LYzcW#rVa_0Qz)5vSAQ{hz>;m3O!NQRuGmQ(#U-B~tql>EB==f&BgwNxxx+-v?1T*7xcEXTPnC%#=?s2k#r!ZCc*UxaEBHbcK*VQJiLFHyAkMy%j<+FoLR z=*8u6vNglJl}BR9DmHbq77dc>y2*d3sEV2oO{`ick;r^80(Ky!NzR1N(VRISQ6qd9 z0ZhvlSQWFa56%y1ABO!>Gh^?WcyYv2CjWPWETIJKIzo`jqI(p{l9ZD?Lo9mCc zrd@wL+wPY}k%k|Anf-Xd@dz(oP5ajD)NN3k1Nm$i91eX22Kp%*?|EHBVc}g#1mH2N zl@G~ASNOPN0#3P23;^9-P}Y{Dq@2G{Z{|Y^L#FQ=zNv@f@z>RU!5=9^U3>GaX87^! zaohJSB1aJKFWdP^ECiCN<3TL`li5S>lgF+-qi%4uM#~A@&!$1cr@a-Fu`f)h>kB_dN44GJizy0L-Lk=(_8ImCupKI zDd@kYmZIM3tUW&~A4-|4@a5P2A4qf7^5}j0C|dM-qv-zGl1< z^8V|tLKYekNlN<~cXy13h#J@q3(%s5!>7>7Xs1dkIx>XQpFf}=$*{_wS|1MAKccvE z1b?HF?u5EPRK*++LvAL$JnQ*+c=*Ye1BvDn%$@MEg94&<{T1hDWQ|k(fgW&jFc`e- zs%o>{OjJ)kA?FaITgnv16TPGM_c$7lU@CU>TxYe4|Dh(0gQW;#d#!$Pa@8p~GI_Ly zD$I@k*#2j6$V#{d8-cx>JVAFHf15k=Z2z>RRc7?{8dK~fueHHz*pkC?W=F{a=B1x{ zcwIW!+*LJ;yMFJ4V{T*Osasb51dh6;ND=Le(=NV&fEd9jM#Ofac22(e&gPYkeT9kf zUsMmOC$2+fRoM$xD>wvuGqBc#XL;5}?#^53{=)>)UemzuSiDd>L1 zp=*Q7m%oc5@T@Yz`A3Y-#w|6t;(~0p&*J~qkFeh%sTO@h9#kpc+@s!8e>MY1*|hCR<1OT%jGxco*Y!DijVQiv zNmWTv`7yF&JvUb+>FuYP9UpeMt>l)H>%3?%`tff=mbaRe$EN1xV%3iKVT#f<*{gmB zSEXt1&SaFP!^20_2Bqod4n=CP4;(dkk>9}9qIKU}QK0!%V-f!&A8HAjkB9ofAt9*5 z2VN7WTq)9t70!1tkX4rHO>bSC98bx29mpPw>E`p13EY z|Bv8-O$%>g)V$EOTZ49*vV3u}Dx!~~juT~ke+|Fvu=ll3Bdmyu?B@q`-pled9GFr- zl}JJbo^9GtI_qll1a;@3*;U7z+S-=;GUmqia)I?n#w9A$&tgPI&-GBSu7jgpO)aR4F$!ncL3yI^E zxv!t;YmKiKStFi&43qCl{^iALvV@^iix0hq-JYk(UE~sJNdpL3<2Df@wNyX z=cRV#3TK*mc`zAret5%s5-%Y|M1mQV74065PU}^gO=rhDSsayg8Iw~^g6Esb$*1cB z2nc-M_gw%^%*Nf~#Sw&q5Muwsxj_jGw;1&>C&JgPfZs$R5#m9?50P#8J zWl2`YywZe?L@*TfdwEHi{<^-|Ik5kVi#hK99~Aqiy!A>A-XJFe1`Rx7T?hW-xr=Aj z!W~zskF2>Eg2KF?#kIu{K8G^4u#rY-#{bb!(lLozUS_NNmEGj=@lNkyoUl~0u&(Y_ z*hNt=R-w~PKfvs(-87x^*-nn&`no1gfa;gj(!=Z(g}17B*R%E(3&4T`qY4DEmfNF> z9wj(TW0dv=afw6uXiyMIO~a0!#=<^hk9=taX+%@>C51kRoi?|d-ngzKj)JqwKPRB+ zsg+1n?U)w;yfMRyN5b1L^uNhgY1}}w~JhYkj1fy5XUD`Gw%ZyCa$1;TJmlmCt3rd&4Q6* z;}heZH-5hb9vFe~3lier)a=&knTJ&;HmvBTj2_hAkTE{>?ox70?UJnoOp!U$tePYw z2Yyr`Rbu5)>yLubm*xrMw>FWWto#b&|Hl8wsHbba^H2P0XNKQ%no4)X4p*Vytu8OK zdH0?i=1$XqD-c7o!Q~@?3a{(1w(x=gUU~387)Bl3Ou5*nF6{K*!}~pm1`s?{z^vJfSMW%wWL1p z>51s1v5epL>%;n}ivF2Xp&{pjI<<3{7A=aqR_593U7!DHVh~VhC52w-+3T5s8v_bp zpdL{M0NR+Ld6CpKH0pA%YknS8)EPn!v`Up#W$A?UOZ1B3nwt4%J{l9{9I~WK4{Dby zOKgu%jLt_~oN=htzRn*UwQG+QnqSQ6MX9M;TqPS3BUB9P3zzGr0w#ey$p}`ae=)27 zxrEap4c3jm;_=8Ey%-mMg-|ZlYtJ*1(@K|q^=7L#jR(8vL_hfG?}opJP6>YcU^rH# zoKWd%sLO_^XFQY@7i*Y;k$*~nH?m|WlriUJJ`D@76$MNOU>muvj+NV+VQGu2t1D03 zss33sx^B-G2q6E>YWt>xq)C;DnzZm9q@T9KZLavw-?54F$4Lj!BMB@Tj z9TW@Xyxz&ELLU}wV&Yk!o+%=XH03BbB)4R@W}|26(7!`NjsIh58QLHMi(F1kWB-YW z<%q*RVES7WqxcY-eAK^WO~sM>nVXLooD{`@o`HhH$ky0otC;VpJ(kq;DYG4Snpa~r zMM*AdcE!Lixp_5ii%R9yuD5h+@rKuO!7skcI#XDg==EF?NzpXylls(PGyK;=z5BRc|fq_k~vx>^J+R=hHxnSXzr!$c;8m|J$}Sx~X`kQ{Ka~`Rx+^W2E7Z&sds5gI z)hxLn_4bi7jhR`V2706<%2=6*#Am`}Rl*EU7s>#Z5 zY?h3KyifH6g4vHY`Ov-YRu(breR~~G$G4cqsgdJONh0*??if6c%B%_EcC`Ag?t=v%=Pd=Sk`>OV!MOwAg+%(xO*amlw~KnY;Mu zyl&Y#%CLJMw8Z z^db3MtS*1kskuMt%VQL*@O{`eb9nv3>gi3ff*Y^x!SKcLXX55_^8_O^{W4LHi*F&t zhpF(8fSo;fwRam0Go{kj@$=fMm|@7mZ%u~)A(yGt4JiBK=cW~YFJzOujl-Ii4%E17 zY(vR_;Q|HB@h*8Im^+#^Pjop>l)Z(2@QtKWKHBoLo@+@$7F)rQzR3Q6s&@1Du0t;5 z*)K)6%Ndb8RnCa>hjdezb@5C!@fwwlc7{w1NWWH5lG+p}`p5XHjW}rN#;1prZ8Z;| za2^VR>vqAfrL}_O{97_1TMX0xm@S(7KZ0U%>9%{QULmf~@LEn&l|2SA7Q!HB-SW$d zy|4;t{QhvWrwV}1J8gbh`?(f=x`*gMH!ah_pnN<`xmLY#$kbc^W*u3-GTA?XcGMB? z-|V?#dkgL3NcZ~EzEGXrQX(CTH@qTkYQN~2Vr;T^3rC1aIWj>s)>i9+_X8?9WMQUt3KKA&pa_1*q=-Kwqd(5)6yU1uEmXcFIU*oT4Ieej+H!}i$q zrE-0^JsfS?JFB8QuX%n0+IqhB1b^Vc78J1d@YzivIaX-@n0CiW8-~n<$pm!#*96+u_>()+*`5&aWM)`Yy!S2o-!#1s^}IIyOa1_ z$%RF&3yTW&`vw&cIsZV7LK&tn$8L4FTW!6m^?MSVnDbUctIdn(j(otGuTbyOf z?mF=mZ2n!9l$(_kfk?<(^wKcQHRtn0n2w1x3iJ!tzED83n`*w=>Eo^K{tgr zBp}OCDrbr`+3o4b5W>QGFJs=NEMI#wEe^78U}AiXBnnfyBisL}ICrf(s@;9bdF<3o zTCzpF5@e}CBNEWk1^y+<=XAfxfVusg&SDaHn!~@b>iA6^ykAru(mF$M>l)WbMj0YE zI>gd?D+~aCB?jF#xofHE_M#tg^e4v|A%X9zx=CWzx)JJsv(a?_mjmkTaH?Yr$3IvWi%PS(o>uW0<=B$!&_(47S2adosba!u+iW1F2 zj?0>ScUbd<)x8f6VcYRQ^!?;TZEcOX#8zR&xsCMh8xj#|lHc*g!=hu}4!IrAzq;4b zLUCHhi^z_Y>|crAJ{vuqF=Hj`rVOMKgziuqB1UnJ+Yi)*b?* zwzUod&j+p|BJ16Lc%DL(FwuYOy2(U9*}n!G?}KTbYP~(zasL3oL4t(H`zU{hhJD^_ zbQ*mAn_EqwC|D|+4Mg!K)bq3d)vBqG(K$fj=#%keuWgg^>+#30E~08w$gC{r?d>k^ zBJiY~U3?T{>YI(2Ozr^&U#KQBo5~eu)Xjj<#1-9R6K#1WlQzaK-@7;h2P>Or$e3p6 z82zfq4^l8(-YJ>uxm=BCInBJtx=W;zqX27NWrS~b9}N;?f8v&2wd_)c^d9T^)1kXf z5p2_PHdEpHWqNZVH2>a_r-D|tyHqQmDp0tVw9oQvi{Ya%F-k~CZd!bZT->K3(&3Z} z`P;V%6pjG*{u51d_(XP8<0H)c%k0j!v~zGe@LTi%Y7>$G0iK7e*wp)>VfB?Em%YRVj_uc@3Hr=grcPIjI@Xv35?Q1$hFAf$CR(;7hKId{%45uv&b`}lU zni8leV8hA-Oi2ftA7agE5#Fkqh`$r4hOTRmM`hmU1gut9h`#%_Lkx=p41XGd09tEY zfPUJmhd5Boh=X>Xa^{aCCa2amP}7V47(oAa^sGg`Z{6b8fh4^Yg7G6#^-WBy#7pU_ zWQTV&mD(MEE{EPOTHo$$Lun`GR5HYG(M|x}= zqcfe!t1Yjtttc;4E$7a7A;MH<&BKaBWfJ{e}xt1-v9sr literal 0 HcmV?d00001 diff --git a/src/content/docs/ispmail-trixie/images/relaying-unauthenticated-relaying-denied.png b/src/content/docs/ispmail-trixie/images/relaying-unauthenticated-relaying-denied.png new file mode 100644 index 0000000000000000000000000000000000000000..34ceb94b81a6b245069251863e8bf8f824b0f765 GIT binary patch literal 16147 zcmX9_1yEbh*Tti6smI%)853U;)B8Hl#6v(xmv zcABH4x3b&vDcS8Zvpm~gcLuNh z@!CniTUSMf{F8=rO+je_#8@4TscEc@FeuK*+kHJ9{&mM$hT4i=hFwLC)&!-nunM(H zfHZ%;!TDB~mETO)oX=@R%TZA}5lle0IY^n+KNV2tWoc=dlbah*R`%`q_?VWFQ35Dg zJhRv&$46FNT^(Ch^~2NCGi+ez-;N{1h?pG{B*$oFtHQ7fm>=A4w=?))j35m?ZKd07 z1%)O1YdVPw?4|hug_R#0A3GmB*}667wRfaf)fHVI^mMU+U5xsToJM+KCvCweTkNB? zJ9y-%G`%-gps$XOvbf_82y|_HTcRT3jE5(#-^yNE9c_E?&9JC%vaJ`piY&Imo5ww&xbs=mbP{+ z1ARL@Ou*@W+mDzX%*ejOlanuak#Uk#hsVbNve@RP#zwia%E~iX2i;^L3L!^FW|}Pb z?Rh}QcH8jbYIW)^w&62U5ngYB(^a%8q!&|}2T?-l${t$xG1u<*-!+}(qp*q%~Q zg=OT_dLjY$5x<+`*g1upM5Hva#05(|n+^}k9uF-|aGfzNCz|B_?5QR_@%#_D+xz>w zHiv78A9h|n7x)6MxUWwWeq^Mm2{q1ymu}w~9!8?4q4A&- z0{{Z+s-cRreV>akSAhl}5Qs@=C5<)!x33Cx-G+X$e)WBx4BwKYEQ|h7TW=Nxc}Vj! zCa-tq9BeqL>os0BG3xMz0d|+*PsGJNCv;VPDkL}cU838QRM~wc6*s@Ok5PW6McgY; zlE+Sr*;#g^!tFx=9-dg_6?(|U{+d$@)mwF~-O%;6v2S_Yj;!qO@7HD7H9K`gOiD_M zCoJQDETf7F>>uh1)o)^exWV{8CvC8LtOd!^h3@Z92U1knOB3Hm00gMmD8Y3>#h{)h zTbq@BN0Rp}8R!_E>%lMCB;r`p^Yi_&zPI@zLv|a_Wrw=$(bWvR?h_%`Z?2W$ z=N!55s>9T&O@teYT9`_u0a1G%N}@@ne7t*yJvOO3-{e~^kD8j(d1Cb0Uq(KNfmnF* zo*&?xj;|yrT`OF+W@=Jz&Z;~i%IHSHlUrQFw4GGL@|(-ds%7|`YmvW5VW{s4j7cl> z-sNSvfBiH3Xx=jIB7S4E%M`wOJ`DE=C-1 z=GY4WqY^|ONE2n{44zvf z5_0Q1#MxP7Xqvyz7PX^GLKs)Vv=G0S(|x)gG_AMV?^=1ELws-Ee{8jHYLI*E$;{Sy zo|x!L=l=LDd9kFg>hl9P+`GYUIx4IVCk(Deq))O04jGS99m%0lcLGHu>2f+OK?DZ* zAKvMDBWO-8DeJsSEAjLl?b4@90kTf{9UUb8=jZ3pyNODwdhJUTR4o2TV3(US{Mdn; zc%7=s2^Zbzqg(Np;u%Zq@PFbFHJzQEITza6dbg1(u~~d?8473EYE^+}`!t2Vbwe5) zTuP;U6-|yy{h~&VwTAYSb#FzgbsM0FvO?@VyP}o zGJP{ISEwBLt%p)|-R^EK&OXa`bXR%BvBq{sb_jKY-}GMGH0#$ue-r7n$MC7}NQOLiMNz=^uyTH-Yq8<{XM&I6YISU7OH4BOS z(q0q0&-1N~ri__;nv!j)YJ@XSCYr(cpET2-#BqB4WGNo{NJrt4&ci9wQ~BjRi%q@$ z!e+v7Y}a)G86_wTD;7e0HcPWpO6ZG)M$4V%f}W}lkCC=xVYp&}aKB4{*vLRJosFBN02{yIbAauRr#Ty;M8{mkxi0Gb|u* zr3{Z4Ty6I){Ym`W(Y5Xh4oX%yLMuW-{M*^CK#Q@|BuD1cG!|}UOj#_hnj|w%zSLfH zTFbaaSE*um1X&RXMB==TxYb`zFVPLsZuW1kB#4Gj(92qyC3yZ~65+0Wt4W4Th6VRgSH>9W`CFo|{b z3R8<2vN;zUe(EvM7K&q#*BP}k4j6$QO=)^)B_MJYYCOA7!Hm^-O#yy*i>@?0Pl6BWU0nRP40l9Yd`H`VQola~|4pOO zBknCOm0A#P6H}1%nzkGfSgwR~C5>+U^SaR5f$UmN>QEK7|p z9uv4ZCr0mu-E?L{jVQXs(T25jhH{HJ;nmz;Pj5Ft2Rw=k@w3(JdOodHv5Ex3an1$8 zDN9lm7~i8FZb{LLM}uK9DnZBWt&d<$ zw2ZF+LD){?cXD&Picey@BBCaKh`yDe=XT2%bF+^~)Z9)eZz*6W@~!QO{N_%el=Bm4 zbzkpg^j)P$*6?((R#aYeaKU?y8|z+ou_WVCRQN`%#W$pNdW#Uz!*f)yTueBL}715 zS53o#iDdHekXKz@O(Dibu-rDI58ggk!}!=J#j)bdED;yi>-7u^RZZ(X*mff6W5?jA zzKCe0S#^1LZl;(|UD3sFKOTcU@YdJkX>F-UGx+(%b;4@ZxuUy$382Y>;-6TaHrulw zf8y)z_2QNO?5rxCNe^g-(ub3WKF5!{%KB!xDZXj6`F%4L3zMvSs2gF^zB}8=etxxk zHn+n`Ks<;uAk<$S>xsspT={qo1N#U~%spMiJ2>7jH$}k5Q#isQ?BY>cP3kfxRNs>K z>wtT$`r1j$ay5Abm(>pdu5CM0S5J+_O;BchjzHVsEM)X}03q5!|vY=(2*d*YuCEWjy2*#B0D7dA*W5#2ym z!peCdELy@tPR^hMx?x&{Z6SG#4&$>#y40iC2WM%gzh0N}UDSeSCQv9lz0W>BldemF zhkq+Y5^ShWtdrESlYFDYO1+veU$OIiKg-G==P4^{qcXBp%OheK&@(iBemIe9S$za* zSbJ5^nE$M+Vaz3yDq8D$KU>+sd7C*7p#akj=(c_mW^b-Cbl&@sFrc{xcGU7T)SF^R zQ=Z`}x^pFJ!&lZ&kymQSFetz-H^B`HuESX@)r;5t?(FO`gQdb3FOV=E?{j#5X!^X% zqt51*)KFpF>O4%tc%u7!sbEL8%eIHPDx&gURU9oLw`8QS zWZSL7I!Y7=y*z+-;t(4#sAV8~o&(LbY{TEZ76NquWu;xxwd%j&UBFJTgjRIRv8Urz z7AU)MfYX89l@8`4sgsJR@xNI9D~ye8)r%@}dc^HqmG_lL=x8l2Qh#9gLk zo6(PUPI12aQ^a^>uWC`3QZ>aGFsh9N7HX7i#y^#a4gSSiL($@!VB#+BdqT!itDY0V z(vAYor~^wqv*E@ScbUj-&m_O&lx;NP7&5z07n_&ZnUj6a`exzhDeU5f zn0{;i&XmssiShBJE$}=Xd_R$d>6??J5V5w$w`1x9^=rWZs88mry3D3&sx9>2FJmu= zx8OZ^6g-SDUv%AyR&RpzFe)ZeSzA%S&uy^}_>nh%vhYp2kIb|!$<&*nWt!$M7i3JH z;(y~wd-ui}QA#dJ;Wc&1v1F25^V%VcrO1~Lh?y*KM?T;CT&+C{Q;Yp7P`1**b)>$I zIco_Ry375k|Dq|THo2Tq;`?F1+a4R~uy_mTSH%#hIhAW+(8@HrN@M$^LGyHVr8WzK zM|tJP)exMWnxERqxEiRJ;NPKc^^Rcr_}LQRm#CqkE}O}o|q8;4x-BNGu`hiYDSHSQH=fG{RHZ?JK=cozky6}yzU|n+9+lFIVT+!`!?a})x z?d=BvuiZ%!K#Qy3=w%$kf)~pR*V(2X-96oXXHE`$$N$rT( zu1Rf65o3)EYWzjR!*K(ElHe@0iOqYjaR*3s0#((w+i;+f;9!D8DD8Y)vA{zV=wdu30yHL2}OSkBdh&$xFT_gBR*f7X_RP?*}eM zyIzZEg@?ZudI?6GG!8xF&@cKhrrQk>UsNP)V*sl3*v>M2GF*1F1ZwS>6OKiD$?7?` zt~bkT$KgkIBHMS4gHF2CyNZOwxc=M{bzQz#NVXW=KGsslDgI%%UF!$sndYVb893%h zw~XE^s3gzHwRn^6Euzf4K+ou)KGb8c0JkJ;f|U!PA-A29al*eE8m zZu@*)V9W^ieG_N)*^ILJ^` z&gx*LavYrfYu3|==khx~ba?F6jj-ygll^*!WE6}P`n^cu+fnS1%M6?S;a0&$RV|KX zyO*e2OI{TpChhlSE@2V<>AlQG%ZH=j+W983V)nRrdcTLcHtkQUL95rYoIb8Ga*UJ7 zJYTTC$M-9#RV+wN& z>s`8PVx#+9hSZEZN^)oIZw=h_cUveNU$pfe`iUKdK#j@4+5)2`kXl+npRVHl6hSRF zvOp7yu2+KVDE@cl9PL!BO{h&x;cG zO6*2n7Y2^bdg)ookJn50;&o>wiqc~^agVqCbrUj7%8UU3DohcolF+DO)2m_EPR}E2 zdiBPCv0UD<)1RBOn`yAaUPUS<8EY7X2;8QPr;1i$!^}T#?M2eXF54Wsme6A`1p#)C zf|-{+NwDcCvyN$A4L;x{zLJ)IO-d9$iY!(f7OP>~+R6i^pk97O>loI2qKI=&d70-y zUjuWjT+(0IFcBuOQXSkU=$bh?h?bJBIf|=&R#7JTes*;JLdAnlf3wrbIvN$>&4EY0 z!v2FmcrCi4Iekj$le(v9+)feZdW@w1mXJZUPm#KYOb*fr171iW-NBuk_H1hMxNch; zyQ{lcZR3x>_fFWg~`eKX-1Enp!=eFJY z2D^+WPHd~q@36#g;Xys5{9v=P@JOht9gCz8-)m9Kqu92r8?#TWMThVK3rz!-M^Rp3 z<7;7$Is@}SQ^^|6xPl5c5e0=)hpvf>+Z2J(1LD3TTeQ59O7j(thc!3y03m+`zvr1S zqzS$oR5dlVQ}Dz3Qd@P`I}fC-Rn*eLCF9`Z;{(i}ik|Mg82q=ONGf2{96l#ZPcXE6 zSM$3<6Sx)?S)4!wtFDY%V3#F5_}%xXZ3)ozQ*fX>Ed^El z(P-aKCdRlN1 z$nD6_O(_T@! z)@F%C&*x5U+i{I@WqH~CtZ^ZQ)m+}SE0JE~*9G{Y&T6iVVT+xU^Jdj)VrqT8vsa*% zArj+kx@5d zN{$L_#>bB5(&@EIE-lpz4mu0aQidujJ?7*G@%9N#hb(_6@Y~q%K3V(_mCS+*alAAC zzXKmNip_%UrR#Og_-#o{_ZUV#$X9p6MKNO|=I10Dq8uLx> zBgOM&Gq~c8kFCCa`-Tuy0~aW)vryRFjPH*|%z=rDpd?*u1Zg=3QOhKm%rx0A)&%VD zo9THTQ9}q1^x|tE5RkihxNV`DphqFngM1yFz1nVebbN1|sBFy_@n`L;dV*Sz8Oq6U z5}Wy(8G5<4vG(o55W4+$F$IRWxGvR#3298gS#Jwd06 zO%<}~J|el8Nv5XtSx`UYSD_sT<6dIRC@_Bu5mX=*zus2uo63^L~eskaWM;F(8=LQ_X-xk;%CrvcPxlQQlo$b+q)Tg<>;1$tij z`i@WyHA1*9+JVpl%jJT@d#m9O1}Psr-Ez?0L&uo2-as604n$ew&L_`AFj{0u#P7)_ zlmz#EWcweELIK3p+Ce+FM>EI>fwCz~lvMl`ANW;GbRs?Qg+gqh5CYtH+sE zjB4G1#M)Xw#@O`Snf9KRnUwue)NNikqjs)4K#Yp&_P)Qd4QEPJ>*!(e-iryr$W$h( zX}zHqnds|ieC9BZ1j_|AL66h`G^MJF)UvCCZa4yUn^DTmI$9?36ZR&Yv+K^2bSWpF z;J&+o-1##eKp93Bew}&7x-(i20~V_kh}hHwn*dT?hl8g{U}e+*eua{gJ`(ehTQNP< z@y79QlrC+d`(U_~!h#gNRT3CHjw0F0WdjGiiqg7Do3JM7JkTt?E2`i6U@`cF*ogL2 zvY&AQJ==YerInS1O-&qL=t-t%n(Z6}s4PCuLK~wcO8Er5t~N+a8XRnJvy$3>B$Fk&#H`N&@(tXvE!gf`8gKWo~DQAo3ci3<^+FzDDBdU zB(b~LG+Hm)&%Eq0exY@n3c0tl8p+?J!lGZaPrl*$UWXo)VXI~xrB=yYui)py@Z_ftjDj5GFarjO>2NsTLffr)#d;V2sg=>8b3yjBMVB{GlO= zYfvdD!~Gu>B*HXn*yPZVZCKIZ-+luDSG+W;n=6P<%4G5r3$fa;@uazVCP^XYIt({z&k}^;Jr@S_%0lk+O?IlWBF(PI{=2^A3;XlA~ zYl|B5lAh7U00l(``cDgxAE?8~Y~mV0$dd`T8mEP^L=5FOtiYp z6`E%u-OU{g#WjKo?y@)@6=F1-_0M9)hxc*tu$-m%<~eAAw&sY^tu2a9UkVC zl|{51rKE0|bCDFawx&XGw?CFXP&+^txx@9}WIf#+I4v56Dk&*3=ZtwTcx?3qJ3Bl7 zfv~M7C;1Rg8N%-IkrBz@QCwO%f0 zW8z2G^^ua(Ti>!3NY5JDxqhx2w~>@K8Oo)?MP&a5rPJ4lAIWjp}KCt&5 z%utX9#)~p^rHE7qPa%;YLQ zsMV243?wi72sKvTn5L{? z?8B;)0wibU<^6_)Kq~AZ9$JWF#_ZHUQuX!~S0p~;elPhu6V!h}&Q7<>l_BC!9t4sMl z1>APw2RP75idkZ*nTk2Pxzv{}xnPGocUV8w3ohueUS=Q&i_qQq0j`TEyRzvEeJ$!v zVni9wXG{m}s+2SbU=Jb&NyU%AY=eJ3=!Iw$f1~@}31sq$?Q-W3aP?#E(8y^M{*LlO zVhg+z(gdPIuQO-At)SLd-yH1*Rx*4a$!lpzapvJSm^xi^+sG86_@m}CH#hfR6$eU8 zG$lnxLqq$I9A9vOq?M&UUyw3`W{p2G&R0~$noyEogHVk2MZV%kjg5`}RS!nBn)9p~ ze|;X-H2wfqBe)(1eag#OeBM`a?&+T83yh*56kG(zI9M8s-rstl^&zfx=unvKlgUC^QMaKL9X3vS{}j`!k2Z)-Pb{XvPMe(r0>Ta&w$>)D}Qdu`j8 z+F8~PGTGKQ*c5oaSiPD<@y##Y)=we4?~3K8FFv7lbV`$c1nY7vIc-FO**&@&`9IE5+)X@9~w?m395LQxy{EgG`3(q5{sV^7sw zNpj%vj6ctPQLt_~{;dKSZhV|;d~jZWx|C6<__=Yn=kkyV>U`0kuFVFVh%y>)b(lD2b$@4C0wg$*0E0;s^z$tMA1P%3g**}ru)Co??H#<>R zQz34ioojKEUCVM*Bmy-qRWN0?R`B@_&K3uC2NdS(9;08YHH51#7Rj9q_-k;9ldDLp zsiGnZ(QB}?v(L`Yn<4+G_ek6{kStVY(C^HEz)n$FIi7ktD~l{GElu)kLZGL8@75)h zwl2iCo12rxBJnbxS2o`7>25aVVXn08TKmRmdt~|jXA}f|%3odQ_HsY<2+MFd7q2^# zq(w1V*paARZFp4+oP0^>kKLcW`B-Q1+ltu8c2Mjy734Q%go#6`fL;-g_yd7ycF}&- z_i03`;(T~Hi66|p%|Fet9*SEB|e@If*=~H2sR+X0KLSoryxf^_)hz8&jLSTV1 zou`)<9V6oe0&lT$X+@fBq4LrPPB_pNi8vg1cy_iIjIZ}Num66Xe1LXDE$cUonZxRJ zZ!@>DB4ce$e~|6>&e2}nW5|8UT7U1p*{`3W_;9Dc(Y1Ayoc!8AWwYTt&umQhgD$sp z%+%C6zR?yLf;*D754NhdOv=cZTBk%|o-}w|!t2Pi2do<+4(&mk z)bt)AAx}@tQ>dmT<*e^VtxS#+eM-U34p^z5ItoEN62N!3(^3$R32T^=zwXotOGg#R zirgwCRYtj2H|jgP$>+Gh$*kiWkn+dXk!3oje)sADVW|G3O|AnM$@B6;r|ae6RQ^MG zNy#E7QS><}65KFEBT`yYlGE0fc71(aLCVMq97|ppm+@>pncvqwUEy6t3l?#9bGv~Q z&pHkRq;4IDlx=!9odX@s_MJ~=jTTb?-pg$){1}UE|sKGitpLV&( zSqhS6ye%=d(5&j|H(^fW36+T?dcD%Gh)Mio(zSzQ(%Y4R>#*arCNbueoFjN0xzhfY zW`}3SCp?U}29c8c0!?GqA-B_|s^8q-?iK{m_z>ZGw;V28c4E>yHhf=5DFIkmwbIhk zMe_>_7yMSUB}5~2m{^d3l9H0a<-1?_Q4^qpAIz3N@v2VD5>37(_B5SEZJ(rb+UpUO zz$fLxp1$~x^ImkYo~Z>vGGU-VN;4aD5gN1$1$VWuPFc z9-6yzeJ|o==VwTQg^?#Jy?xld6`80EDaY7&)X(b=OD!7r+p{c&V_CZfmJSIC=Ze7P z0Y1Q8^_zEj=adn8=~Aa?L=V9m=Ql=&TxF}qFr7g3(x+_4q*cQhFESpAXNE%6X5=cp zD0G7?q*r-57tt)@JL5waF|$1Wzg;TQl|$eFv0XUljP0#%K;djIfCYhc;E~%2z4=?A z9ex}}E^IBim{;LWH%9bLA1^qQ(k}2vPdmxocD>7WJ?Vl5? zUi1<9Ike~2@idv1lx2^h)|FcZiX7)l(SNiE*`sjH(4e&k7-6ZQzHvSxA4VvpCkE@a`MF|k{H%CE8!=7458dTL5uUO zmcng8B&~AF^U$}sznUk8eH|e=fP0?dc!T4DB?bC0IFyI+*)OM<;XaX1Zn0rNZ7^fR zW#_5XUZ|E$(01zd)T0vaCz%fYFus4f$^PI&Bt8A%?=sGPaLVj)z1ur7JS>2V9{Nzv zQ2w8g4G9jC76@Gqz7?u3Hoaxpu9TAu{DdT0br)CHA0Dq)0~?uwe!l%wyD4Mvs}N11 z2wE;uDyRKAM=ha7a_~5p$-{9!{e}BYW@BY7BU(NZHw5IXZ@b!jOy*c)-?bTqel~&X z4YY|i#0vUK%8bQ!DGfrD%k+Sq;d*&LYBl^lDH`*G&1MW43m7oD?E8_$`#JW z0qPieocF!+MY35pUfhb#4x$4OHoBFhOY1~3*?4Qf3J70XNStC5&Dq!}(AkNihb@aU zIb5!HhY;xtu_2qY^7%^b=Hn>|a^0EPSQcRVIf+=wnOc90J0vh( z&Z;Qb-dR%t`l1`-+O5J8;NX{J}E3yRv`xAXHCDAEjG^eWt$gDRVGqcJWC>e93hCaGbqKbmTNp zNq#5l`z5dV8!1!C%Ou&0=xBt=XB;Yr;dh2)f$2Q;c zBtiU458Z_9gca?`RK#%~wmn>O(FwI0?vM?I#&(?9_+;(KJhtTBQmiVB%VU&J9oi(> zCwgFK)u9)yI(-Tn71edDxs~i%#lH=riv`)PG&D49a-oLaGb4#F$xr<}{8a$uV@fb+2u#L7&_{632b!BI?kIOK{QzPw@Vmn&hNfQ)C z>H`M!_x-nCaY}wu)CoZrs(I)Nc2e*dEqxUKsb_wS9n;H(_37_aN~ct%kW6txj?@Vn z!uGAP?sai2U1Zfmuv_r3j=djD{;>Gl=cnph82;lxsn3+`&Ie6CmyxNPo)pWM>EsGbPJ zs0u&3y*I+M>QL%0Xq}>Z{nu_XK5~G~_3>FxYXWFMzPDYjO&oHH#J0KSDYd`m5^C@l zj0NY5X;7w9P=#WDZQU}(r9JyQ8;2KhlVJ6SD8Zv5-%kQ`$IQ#8=+!FOv-vxs?RqGA z3j<7}K4OW)T+**P@c7^srQVLX5Xp$%2l99Hy-5KdSr9WOD5__xoAxchPkE!N2Y$s5>ep$oucXv zGg+LSsa!!nR{5IIZH)uij{~J?&a^n;a1Xya=3<=&e(w*9e{Dnr+BtyL{r?oeL|cJ7 zqGpdb4YdjUh*9j6=!CCpi^&F?W$HJR;rtupH%sb1!)W&c*|Gl$N$Mh39Q-N2FWs38&4m|(}`eRQw%>>Wv|3u;yy{&mbX=6VX0RctLtedn{ z7_6&~ez}iuFA~Kk^(PNoiPr!lX&lbDln9}fga>&ZvnfL~;u z;&2{WTI&_moT+1>v6=9(d1uRhxN(g6#q#exQDIpkUOpeN-dr2?XK$M4za;t{{tl4~ z^U}WujH{j|PWZe}9P~=)b=ZcqFcPx-0-6vlGc@2csnD@++!k)+8%qp8C+Cq;*b~CL zGr!d)3p8Pxq~OX23P?507MPF=xQ4|P;D3{#yGsch6`Ck%bt+ks^1v2FE!%Y6xAeOp zK6(-?!61hyP+->NW_n-a)uQHYM!<*YonC$eq2CsdgFDB zZxx@oN84`j!q(X=6YY?oRr!|hw0Y7gOJB%K|AGAl64DTOkb_`;a}O*IfIbkI;fWB%ZpI2Hs)RP zNgq)UTlxB7xlV-Z(c|Xs2s}V~RFWdlu`nZ^;KHA*9CKORh@pKKI-bKvi<^(u!_v?X zAWcUKC19O<`~y~;zVHXM9io8wHC+}8UopsYpaDyim-K?&>h4Pxhn~npai@uS*C0gR zdN~#A22!?k-Y1+4*JEv+gH*8?n=a0F{bnixjX&VwG>z}JZu6v3HzRKoaG18WnU8HvkGjv{}IQN6#mMY4;0Q&j{xHMcr~l0R^P`JwEBfc}a8Q$NYvY zAjF9A#|xFwRf6%^Ie-w)3)vUd0iLJ#f!hq65IDurTb-XtnbH)C_->`==KaX5_1=Wj zxBW)$P)C#KMfCX9lRNNjQi@%i*u^=rlyd-;TeMqM<(^?Vl4lq)jl<-uD7Hk)TZ+N= zqhBYPAlo1S{ncx^*}Df0foGxs69Yx0G20XkY!P zgFCY)-RMM)#=yv?XQ3+VrNpK?gismyyJo($@@|2`&B+#^C6Vhwbp6Uz<0YO+#GD_s##jlG&P_;MF9T_X>m@%?+`KXEUCR`2wvyyl#00nlGoIcpe=koYFWhNb62v?1c^(sNbqq%R`p4{WG{;_G8ajv(w zb*S&*F>mF}qAG|jst~;zDkrZTIDP8Mw;0Orl4M8xKOQq|5bLm|!6@u%A@411r)$4wDB7kb!a z#zkD6k;(h|O0mTRIRrEE|AG-S)lcu4#U+-Whk>V1v^pbfGGXf)}(XpRIIhYuatTZ84v(x`(L(3M^8EHW$73xlWhkZO~xP_-wh0R-Eg)BBT*bhrHsWmJe)+4IJm z3>Z3A0m%ouOA?dTE)DdBSuDaMI8*BBmorRrc#bVC#pg~$B9diMs#LzC{2ZT{KT_mj>SXqNZNpZzfzQ{kT)Zs zmXk^LkXpy{+^c{tY;H)1K>`3Y?@>0$Oa{!+ZAxL4j)=N5<_A_PV8(T&#>NQqI`_kn z0)EkX)?U?6Zj$<{|8KD;Aw;>D3EicqIJ4>g=C{Im!o3@2tS81A8lF}fi`adMsd@$$ zF7!-j)8Hj}>^Ml*Kn?IKyYvOJ4MT9sc$q9+UdVxst7bpr%L6?}hIPQas?fP~l={US zXx=0$YouR4g*bq%Zrq*i1SX}#1wXwm)qiXiMH7z-e3IQ(@-K$`hB(oap68{0M=6(= z&Aafx*c>QA*ErsB0rxGs428gjgOpUT`G7ffNi;G>3U}x1*L;dQXQJ`~7JKpVb zQ*@TAx@XK;CgrwVz&0AeImadn4!+;t^ZDw z@*<@DlBCH7=oo}VOyn4Ey~l}4<`|#$!_+4#bLO!UxrGlNpyg)3ty+N=eY+#2OG771 zS0vI(Z)mYfvErnJAoyOsSwb+t;xS*3KI}erLtDzC1mN+YUszz3V#gf`K?Iu|2fW3y z#58Fe2a*3FwAOf2z@Q^+l^!5wp`DzJ$r^E9e%RU^n`i6vnfquaIiEFIhaM0Mg`Z-0 zP#jP{dEfam#`H+(9PuQ9y2Wq5tcg~^et~mXYLa@df4|%AHIJ&nh}da3ypVbWpUJjq z;Z#*0P+K&9AlGFlYHsn)dg-&taB;=I@j+}++z;7AYaGZBcYP_0e+W$Qc^o{${UVE- zR=sZUg15LY)%`=dR3A;vO(k~g>;}N{nP1c-Ln%svu!rRS#kTsAlu*DMH;gY+-(MQ* zh}KzbLP~WOLzPe;<}OtZ&5z$aS2EZ1cih8^hW9_fGs6^e zB1z4qUzVcwg!7+pB*r)rbDSlPE_0~ci zG96Cmd#Ml`c%=kr`pSjrz3G;#q zd*;$|5?b+i$;?KFHvcr@pT%c_Wx6BgjpB$2$~8V$&84LI`t}01iSZPpBDpwZ2B-K^ z@L$pv@ou#;SJ_z)`H~=_I%iP(yT}{BqoMb!;2;008`*J&)5FsG