From 8cb4e23ffc77a9842e1304f3de20af5861982746 Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Sat, 2 Feb 2002 06:08:43 +0000 Subject: merge from 2.2 and regen (This used to be commit 7b7e4190739bd7df422e3f239fd89373edb97ee5) --- docs/Samba-HOWTO-Collection.pdf | 3626 ++++++++++++++++------------- docs/docbook/Makefile.in | 3 +- docs/docbook/projdoc/Samba-BDC-HOWTO.sgml | 233 ++ docs/docbook/projdoc/samba-doc.sgml | 4 + docs/docbook/projdoc/winbind.sgml | 2 +- docs/htmldocs/Samba-BDC-HOWTO.html | 245 ++ docs/htmldocs/Samba-HOWTO-Collection.html | 1839 ++++++++++++--- docs/htmldocs/Samba-LDAP-HOWTO.html | 335 ++- docs/htmldocs/winbind.html | 2 +- 9 files changed, 4389 insertions(+), 1900 deletions(-) create mode 100644 docs/docbook/projdoc/Samba-BDC-HOWTO.sgml create mode 100644 docs/htmldocs/Samba-BDC-HOWTO.html (limited to 'docs') diff --git a/docs/Samba-HOWTO-Collection.pdf b/docs/Samba-HOWTO-Collection.pdf index 3a67638a57..0c6625e6f9 100644 --- a/docs/Samba-HOWTO-Collection.pdf +++ b/docs/Samba-HOWTO-Collection.pdf @@ -1,6 +1,6 @@ %PDF-1.2 % -1 0 obj<>endobj +1 0 obj<>endobj 2 0 obj<>endobj 3 0 obj<>endobj 4 0 obj<>endobj @@ -94,7 +94,7 @@ 67 0 R 69 0 R ]endobj -71 0 obj<>endobj +71 0 obj<>endobj 72 0 obj<>endobj 73 0 obj<>endobj 74 0 obj<>endobj @@ -325,210 +325,187 @@ 229 0 obj[226 0 R 228 0 R ]endobj -230 0 obj<>endobj -231 0 obj<>endobj +230 0 obj<>endobj +231 0 obj<>endobj 232 0 obj[231 0 R ]endobj -233 0 obj<>endobj -234 0 obj<>endobj -235 0 obj[234 0 R +233 0 obj<>endobj +234 0 obj<>endobj +235 0 obj<>endobj +236 0 obj<>endobj +237 0 obj<>endobj +238 0 obj<>endobj +239 0 obj<>endobj +240 0 obj<>endobj +241 0 obj<>endobj +242 0 obj<>endobj +243 0 obj<>endobj +244 0 obj<>endobj +245 0 obj[234 0 R +236 0 R +238 0 R +240 0 R +242 0 R +244 0 R ]endobj -236 0 obj<>endobj -237 0 obj<>endobj -238 0 obj<>endobj -239 0 obj<>endobj -240 0 obj<>endobj -241 0 obj<>endobj -242 0 obj<>endobj -243 0 obj<>endobj -244 0 obj<>endobj -245 0 obj<>endobj -246 0 obj<>endobj -247 0 obj<>endobj -248 0 obj[237 0 R -239 0 R -241 0 R -243 0 R -245 0 R -247 0 R +246 0 obj<>endobj +247 0 obj<>endobj +248 0 obj<>endobj +249 0 obj<>endobj +250 0 obj<>endobj +251 0 obj<>endobj +252 0 obj<>endobj +253 0 obj<>endobj +254 0 obj[247 0 R +249 0 R +251 0 R +253 0 R ]endobj -249 0 obj<>endobj -250 0 obj<>endobj -251 0 obj<>endobj -252 0 obj<>endobj -253 0 obj[250 0 R -252 0 R +255 0 obj<>endobj +256 0 obj<>endobj +257 0 obj<>endobj +258 0 obj<>endobj +259 0 obj<>endobj +260 0 obj<>endobj +261 0 obj<>endobj +262 0 obj<>endobj +263 0 obj<>endobj +264 0 obj<>endobj +265 0 obj<>endobj +266 0 obj<>endobj +267 0 obj<>endobj +268 0 obj<>endobj +269 0 obj[256 0 R +258 0 R +260 0 R +262 0 R +264 0 R +266 0 R +268 0 R ]endobj -254 0 obj<>endobj -255 0 obj<>endobj -256 0 obj<>endobj -257 0 obj<>endobj -258 0 obj<>endobj -259 0 obj<>endobj -260 0 obj<>endobj -261 0 obj<>endobj -262 0 obj[255 0 R -257 0 R -259 0 R -261 0 R +270 0 obj<>endobj +271 0 obj<>endobj +272 0 obj[271 0 R ]endobj -263 0 obj<>endobj -264 0 obj<>endobj -265 0 obj[264 0 R +273 0 obj<>endobj +274 0 obj<>endobj +275 0 obj[274 0 R ]endobj -266 0 obj<>endobj -267 0 obj<>endobj -268 0 obj<>endobj -269 0 obj<>endobj -270 0 obj<>endobj -271 0 obj<>endobj -272 0 obj[267 0 R -269 0 R -271 0 R +276 0 obj<>endobj +277 0 obj<>endobj +278 0 obj[277 0 R ]endobj -273 0 obj<>endobj -274 0 obj<>endobj -275 0 obj[274 0 R +279 0 obj<>endobj +280 0 obj<>endobj +281 0 obj[280 0 R +]endobj +282 0 obj<>endobj +283 0 obj<>endobj +284 0 obj[283 0 R ]endobj -276 0 obj<>endobj -277 0 obj<>endobj -278 0 obj<>endobj -279 0 obj<>endobj -280 0 obj<>endobj -281 0 obj<>endobj -282 0 obj<>endobj -283 0 obj<>endobj -284 0 obj<>endobj -285 0 obj<>endobj -286 0 obj<>endobj -287 0 obj<>endobj -288 0 obj<>endobj -289 0 obj<>endobj -290 0 obj<>endobj -291 0 obj<>endobj -292 0 obj<>endobj -293 0 obj<>endobj -294 0 obj<>endobj -295 0 obj<>endobj -296 0 obj<>endobj -297 0 obj<>endobj -298 0 obj<>endobj -299 0 obj<>endobj -300 0 obj<>endobj -301 0 obj<>endobj -302 0 obj<>endobj -303 0 obj<>endobj -304 0 obj<>endobj -305 0 obj<>endobj -306 0 obj<>endobj -307 0 obj<>endobj -308 0 obj<>endobj -309 0 obj<>endobj -310 0 obj<>endobj -311 0 obj<>endobj -312 0 obj<>endobj -313 0 obj<>endobj -314 0 obj<>endobj -315 0 obj<>endobj -316 0 obj<>endobj -317 0 obj<>endobj -318 0 obj<>endobj -319 0 obj<>endobj -320 0 obj<>endobj -321 0 obj[276 0 R -277 0 R -278 0 R -279 0 R -280 0 R -281 0 R -282 0 R -283 0 R -284 0 R -285 0 R -286 0 R -287 0 R +285 0 obj<>endobj +286 0 obj<>endobj +287 0 obj<>endobj +288 0 obj<>endobj +289 0 obj<>endobj +290 0 obj<>endobj +291 0 obj<>endobj +292 0 obj<>endobj +293 0 obj<>endobj +294 0 obj<>endobj +295 0 obj<>endobj +296 0 obj<>endobj +297 0 obj[286 0 R 288 0 R -289 0 R 290 0 R -291 0 R 292 0 R -293 0 R 294 0 R -295 0 R 296 0 R -297 0 R -298 0 R -299 0 R -300 0 R +]endobj +298 0 obj<>endobj +299 0 obj<>endobj +300 0 obj<>endobj +301 0 obj<>endobj +302 0 obj[299 0 R 301 0 R -302 0 R -303 0 R -304 0 R -305 0 R +]endobj +303 0 obj<>endobj +304 0 obj<>endobj +305 0 obj<>endobj +306 0 obj<>endobj +307 0 obj<>endobj +308 0 obj<>endobj +309 0 obj<>endobj +310 0 obj<>endobj +311 0 obj[304 0 R 306 0 R -307 0 R 308 0 R -309 0 R 310 0 R -311 0 R -312 0 R -313 0 R -314 0 R -315 0 R -316 0 R -317 0 R +]endobj +312 0 obj<>endobj +313 0 obj<>endobj +314 0 obj[313 0 R +]endobj +315 0 obj<>endobj +316 0 obj<>endobj +317 0 obj<>endobj +318 0 obj<>endobj +319 0 obj<>endobj +320 0 obj<>endobj +321 0 obj[316 0 R 318 0 R -319 0 R 320 0 R ]endobj -322 0 obj<>endobj -323 0 obj<>endobj -324 0 obj<>endobj -325 0 obj<>endobj -326 0 obj<>endobj -327 0 obj<>endobj -328 0 obj<>endobj -329 0 obj<>endobj -330 0 obj<>endobj -331 0 obj<>endobj -332 0 obj<>endobj -333 0 obj<>endobj -334 0 obj<>endobj -335 0 obj<>endobj -336 0 obj<>endobj -337 0 obj<>endobj -338 0 obj<>endobj -339 0 obj<>endobj -340 0 obj<>endobj -341 0 obj<>endobj -342 0 obj<>endobj -343 0 obj<>endobj -344 0 obj<>endobj -345 0 obj<>endobj -346 0 obj<>endobj -347 0 obj<>endobj -348 0 obj<>endobj -349 0 obj<>endobj -350 0 obj<>endobj -351 0 obj<>endobj -352 0 obj<>endobj -353 0 obj<>endobj -354 0 obj<>endobj -355 0 obj<>endobj -356 0 obj<>endobj -357 0 obj<>endobj -358 0 obj<>endobj -359 0 obj<>endobj -360 0 obj<>endobj -361 0 obj<>endobj -362 0 obj<>endobj -363 0 obj<>endobj -364 0 obj<>endobj -365 0 obj<>endobj -366 0 obj[322 0 R -323 0 R -324 0 R -325 0 R +322 0 obj<>endobj +323 0 obj<>endobj +324 0 obj[323 0 R +]endobj +325 0 obj<>endobj +326 0 obj<>endobj +327 0 obj<>endobj +328 0 obj<>endobj +329 0 obj<>endobj +330 0 obj<>endobj +331 0 obj<>endobj +332 0 obj<>endobj +333 0 obj<>endobj +334 0 obj<>endobj +335 0 obj<>endobj +336 0 obj<>endobj +337 0 obj<>endobj +338 0 obj<>endobj +339 0 obj<>endobj +340 0 obj<>endobj +341 0 obj<>endobj +342 0 obj<>endobj +343 0 obj<>endobj +344 0 obj<>endobj +345 0 obj<>endobj +346 0 obj<>endobj +347 0 obj<>endobj +348 0 obj<>endobj +349 0 obj<>endobj +350 0 obj<>endobj +351 0 obj<>endobj +352 0 obj<>endobj +353 0 obj<>endobj +354 0 obj<>endobj +355 0 obj<>endobj +356 0 obj<>endobj +357 0 obj<>endobj +358 0 obj<>endobj +359 0 obj<>endobj +360 0 obj<>endobj +361 0 obj<>endobj +362 0 obj<>endobj +363 0 obj<>endobj +364 0 obj<>endobj +365 0 obj<>endobj +366 0 obj<>endobj +367 0 obj<>endobj +368 0 obj<>endobj +369 0 obj<>endobj +370 0 obj[325 0 R 326 0 R 327 0 R 328 0 R @@ -569,41 +546,56 @@ 363 0 R 364 0 R 365 0 R -]endobj -367 0 obj<>endobj -368 0 obj<>endobj -369 0 obj<>endobj -370 0 obj<>endobj -371 0 obj<>endobj -372 0 obj<>endobj -373 0 obj<>endobj -374 0 obj<>endobj -375 0 obj<>endobj -376 0 obj<>endobj -377 0 obj<>endobj -378 0 obj<>endobj -379 0 obj<>endobj -380 0 obj<>endobj -381 0 obj<>endobj -382 0 obj<>endobj -383 0 obj<>endobj -384 0 obj<>endobj -385 0 obj<>endobj -386 0 obj<>endobj -387 0 obj<>endobj -388 0 obj<>endobj -389 0 obj<>endobj -390 0 obj<>endobj -391 0 obj<>endobj -392 0 obj<>endobj -393 0 obj<>endobj -394 0 obj<>endobj -395 0 obj<>endobj -396 0 obj[367 0 R +366 0 R +367 0 R 368 0 R 369 0 R -370 0 R -371 0 R +]endobj +371 0 obj<>endobj +372 0 obj<>endobj +373 0 obj<>endobj +374 0 obj<>endobj +375 0 obj<>endobj +376 0 obj<>endobj +377 0 obj<>endobj +378 0 obj<>endobj +379 0 obj<>endobj +380 0 obj<>endobj +381 0 obj<>endobj +382 0 obj<>endobj +383 0 obj<>endobj +384 0 obj<>endobj +385 0 obj<>endobj +386 0 obj<>endobj +387 0 obj<>endobj +388 0 obj<>endobj +389 0 obj<>endobj +390 0 obj<>endobj +391 0 obj<>endobj +392 0 obj<>endobj +393 0 obj<>endobj +394 0 obj<>endobj +395 0 obj<>endobj +396 0 obj<>endobj +397 0 obj<>endobj +398 0 obj<>endobj +399 0 obj<>endobj +400 0 obj<>endobj +401 0 obj<>endobj +402 0 obj<>endobj +403 0 obj<>endobj +404 0 obj<>endobj +405 0 obj<>endobj +406 0 obj<>endobj +407 0 obj<>endobj +408 0 obj<>endobj +409 0 obj<>endobj +410 0 obj<>endobj +411 0 obj<>endobj +412 0 obj<>endobj +413 0 obj<>endobj +414 0 obj<>endobj +415 0 obj[371 0 R 372 0 R 373 0 R 374 0 R @@ -628,255 +620,411 @@ 393 0 R 394 0 R 395 0 R +396 0 R +397 0 R +398 0 R +399 0 R +400 0 R +401 0 R +402 0 R +403 0 R +404 0 R +405 0 R +406 0 R +407 0 R +408 0 R +409 0 R +410 0 R +411 0 R +412 0 R +413 0 R +414 0 R +]endobj +416 0 obj<>endobj +417 0 obj<>endobj +418 0 obj<>endobj +419 0 obj<>endobj +420 0 obj<>endobj +421 0 obj<>endobj +422 0 obj<>endobj +423 0 obj<>endobj +424 0 obj<>endobj +425 0 obj<>endobj +426 0 obj<>endobj +427 0 obj<>endobj +428 0 obj<>endobj +429 0 obj<>endobj +430 0 obj<>endobj +431 0 obj<>endobj +432 0 obj<>endobj +433 0 obj<>endobj +434 0 obj<>endobj +435 0 obj<>endobj +436 0 obj<>endobj +437 0 obj<>endobj +438 0 obj<>endobj +439 0 obj<>endobj +440 0 obj<>endobj +441 0 obj<>endobj +442 0 obj<>endobj +443 0 obj<>endobj +444 0 obj<>endobj +445 0 obj<>endobj +446 0 obj<>endobj +447 0 obj<>endobj +448 0 obj<>endobj +449 0 obj<>endobj +450 0 obj<>endobj +451 0 obj<>endobj +452 0 obj<>endobj +453 0 obj<>endobj +454 0 obj<>endobj +455 0 obj<>endobj +456 0 obj<>endobj +457 0 obj<>endobj +458 0 obj<>endobj +459 0 obj<>endobj +460 0 obj<>endobj +461 0 obj[416 0 R +417 0 R +418 0 R +419 0 R +420 0 R +421 0 R +422 0 R +423 0 R +424 0 R +425 0 R +426 0 R +427 0 R +428 0 R +429 0 R +430 0 R +431 0 R +432 0 R +433 0 R +434 0 R +435 0 R +436 0 R +437 0 R +438 0 R +439 0 R +440 0 R +441 0 R +442 0 R +443 0 R +444 0 R +445 0 R +446 0 R +447 0 R +448 0 R +449 0 R +450 0 R +451 0 R +452 0 R +453 0 R +454 0 R +455 0 R +456 0 R +457 0 R +458 0 R +459 0 R +460 0 R ]endobj -397 0 obj<>endobj -398 0 obj<>endobj -399 0 obj<>endobj -400 0 obj<>endobj -401 0 obj<>endobj -402 0 obj<>endobj -403 0 obj<>endobj -404 0 obj<>endobj -405 0 obj<>endobj -406 0 obj<>endobj -407 0 obj<>endobj -408 0 obj<>endobj -409 0 obj<>endobj -410 0 obj<>endobj -411 0 obj<>endobj -412 0 obj<>endobj -413 0 obj<>endobj -414 0 obj<>endobj -415 0 obj<>endobj -416 0 obj<>endobj -417 0 obj<>endobj -418 0 obj<>endobj -419 0 obj<>endobj -420 0 obj<>endobj -421 0 obj<>endobj -422 0 obj<>endobj -423 0 obj<>endobj -424 0 obj<>endobj -425 0 obj<>endobj -426 0 obj<>endobj -427 0 obj<>endobj -428 0 obj<>endobj -429 0 obj<>endobj -430 0 obj<>endobj -431 0 obj<>endobj -432 0 obj<>endobj -433 0 obj<>endobj -434 0 obj<>endobj -435 0 obj<>endobj -436 0 obj<>endobj -437 0 obj<>endobj -438 0 obj<>endobj -439 0 obj<>endobj -440 0 obj<>endobj -441 0 obj<>endobj -442 0 obj<>endobj -443 0 obj<>endobj -444 0 obj<>endobj -445 0 obj<>endobj -446 0 obj<>endobj -447 0 obj<>endobj -448 0 obj<>endobj -449 0 obj<>endobj -450 0 obj<>endobj -451 0 obj<>endobj -452 0 obj<>endobj -453 0 obj<>endobj -454 0 obj<>endobj -455 0 obj<>endobj -456 0 obj<>endobj -457 0 obj<>endobj -458 0 obj<>endobj -459 0 obj<>endobj -460 0 obj<>endobj -461 0 obj<>endobj -462 0 obj<>endobj -463 0 obj<>endobj -464 0 obj<>endobj -465 0 obj<>endobj -466 0 obj<>endobj -467 0 obj<>endobj -468 0 obj<>endobj -469 0 obj<>endobj -470 0 obj<>endobj -471 0 obj<>endobj -472 0 obj<>endobj -473 0 obj<>endobj -474 0 obj<>endobj -475 0 obj<>endobj -476 0 obj<>endobj -477 0 obj<>endobj -478 0 obj<>endobj -479 0 obj<>endobj -480 0 obj<>endobj -481 0 obj<>endobj -482 0 obj<>endobj -483 0 obj<>endobj -484 0 obj<>endobj -485 0 obj<>endobj -486 0 obj<>endobj -487 0 obj<>endobj -488 0 obj<>endobj -489 0 obj<>endobj -490 0 obj<>endobj -491 0 obj<>endobj -492 0 obj<>endobj -493 0 obj<>endobj -494 0 obj<>endobj -495 0 obj<>endobj -496 0 obj<>endobj -497 0 obj<>endobj -498 0 obj<>endobj -499 0 obj<>endobj -500 0 obj<>endobj -501 0 obj<>endobj -502 0 obj<>endobj -503 0 obj<>endobj -504 0 obj<>endobj -505 0 obj<>endobj -506 0 obj<>endobj -507 0 obj<>endobj -508 0 obj<>endobj -509 0 obj<>endobj -510 0 obj<>endobj -511 0 obj<>endobj -512 0 obj<>endobj -513 0 obj<>endobj -514 0 obj<>endobj -515 0 obj<>endobj -516 0 obj<>endobj -517 0 obj<>endobj -518 0 obj<>endobj -519 0 obj<>endobj -520 0 obj<>endobj -521 0 obj<>endobj -522 0 obj<>endobj -523 0 obj<>endobj -524 0 obj<>endobj -525 0 obj<>endobj -526 0 obj<>endobj -527 0 obj<>endobj -528 0 obj<>endobj -529 0 obj<>endobj -530 0 obj<>endobj -531 0 obj<>endobj -532 0 obj<>endobj -533 0 obj<>endobj -534 0 obj<>endobj -535 0 obj<>endobj -536 0 obj<>endobj -537 0 obj<>endobj -538 0 obj<>endobj -539 0 obj<>endobj +463 0 obj<>endobj +464 0 obj<>endobj +465 0 obj<>endobj +466 0 obj<>endobj +467 0 obj<>endobj +468 0 obj[462 0 R +463 0 R +464 0 R +465 0 R +466 0 R +467 0 R +]endobj +469 0 obj<>endobj +470 0 obj<>endobj +471 0 obj<>endobj +472 0 obj<>endobj +473 0 obj<>endobj +474 0 obj<>endobj +475 0 obj<>endobj +476 0 obj<>endobj +477 0 obj<>endobj +478 0 obj<>endobj +479 0 obj<>endobj +480 0 obj<>endobj +481 0 obj<>endobj +482 0 obj<>endobj +483 0 obj<>endobj +484 0 obj<>endobj +485 0 obj<>endobj +486 0 obj<>endobj +487 0 obj<>endobj +488 0 obj<>endobj +489 0 obj<>endobj +490 0 obj<>endobj +491 0 obj<>endobj +492 0 obj<>endobj +493 0 obj<>endobj +494 0 obj<>endobj +495 0 obj<>endobj +496 0 obj<>endobj +497 0 obj<>endobj +498 0 obj<>endobj +499 0 obj<>endobj +500 0 obj<>endobj +501 0 obj<>endobj +502 0 obj<>endobj +503 0 obj<>endobj +504 0 obj<>endobj +505 0 obj<>endobj +506 0 obj<>endobj +507 0 obj<>endobj +508 0 obj<>endobj +509 0 obj<>endobj +510 0 obj<>endobj +511 0 obj<>endobj +512 0 obj<>endobj +513 0 obj<>endobj +514 0 obj<>endobj +515 0 obj<>endobj +516 0 obj<>endobj +517 0 obj<>endobj +518 0 obj<>endobj +519 0 obj<>endobj +520 0 obj<>endobj +521 0 obj<>endobj +522 0 obj<>endobj +523 0 obj<>endobj +524 0 obj<>endobj +525 0 obj<>endobj +526 0 obj<>endobj +527 0 obj<>endobj +528 0 obj<>endobj +529 0 obj<>endobj +530 0 obj<>endobj +531 0 obj<>endobj +532 0 obj<>endobj +533 0 obj<>endobj +534 0 obj<>endobj +535 0 obj<>endobj +536 0 obj<>endobj +537 0 obj<>endobj +538 0 obj<>endobj +539 0 obj<>endobj +540 0 obj<>endobj +541 0 obj<>endobj +542 0 obj<>endobj +543 0 obj<>endobj +544 0 obj<>endobj +545 0 obj<>endobj +546 0 obj<>endobj +547 0 obj<>endobj +548 0 obj<>endobj +549 0 obj<>endobj +550 0 obj<>endobj +551 0 obj<>endobj +552 0 obj<>endobj +553 0 obj<>endobj +554 0 obj<>endobj +555 0 obj<>endobj +556 0 obj<>endobj +557 0 obj<>endobj +558 0 obj<>endobj +559 0 obj<>endobj +560 0 obj<>endobj +561 0 obj<>endobj +562 0 obj<>endobj +563 0 obj<>endobj +564 0 obj<>endobj +565 0 obj<>endobj +566 0 obj<>endobj +567 0 obj<>endobj +568 0 obj<>endobj +569 0 obj<>endobj +570 0 obj<>endobj +571 0 obj<>endobj +572 0 obj<>endobj +573 0 obj<>endobj +574 0 obj<>endobj +575 0 obj<>endobj +576 0 obj<>endobj +577 0 obj<>endobj +578 0 obj<>endobj +579 0 obj<>endobj +580 0 obj<>endobj +581 0 obj<>endobj +582 0 obj<>endobj +583 0 obj<>endobj +584 0 obj<>endobj +585 0 obj<>endobj +586 0 obj<>endobj +587 0 obj<>endobj +588 0 obj<>endobj +589 0 obj<>endobj +590 0 obj<>endobj +591 0 obj<>endobj +592 0 obj<>endobj +593 0 obj<>endobj +594 0 obj<>endobj +595 0 obj<>endobj +596 0 obj<>endobj +597 0 obj<>endobj +598 0 obj<>endobj +599 0 obj<>endobj +600 0 obj<>endobj +601 0 obj<>endobj +602 0 obj<>endobj +603 0 obj<>endobj +604 0 obj<>endobj +605 0 obj<>endobj +606 0 obj<>endobj +607 0 obj<>endobj +608 0 obj<>endobj +609 0 obj<>endobj +610 0 obj<>endobj +611 0 obj<>endobj +612 0 obj<>endobj +613 0 obj<>endobj +614 0 obj<>endobj +615 0 obj<>endobj +616 0 obj<>endobj +617 0 obj<>endobj +618 0 obj<>endobj +619 0 obj<>endobj +620 0 obj<>endobj +621 0 obj<>endobj +622 0 obj<>endobj +623 0 obj<>endobj +624 0 obj<>endobj +625 0 obj<>endobj +626 0 obj<>endobj +627 0 obj<>endobj +628 0 obj<>endobj +629 0 obj<>endobj +630 0 obj<>endobj +631 0 obj<>endobj +632 0 obj<>endobj +633 0 obj<>endobj -540 0 obj<>>>/Annots 17 0 R>>endobj -541 0 obj<>stream +634 0 obj<>>>/Annots 17 0 R>>endobj +635 0 obj<>stream xuSn0+rrT&%Yv|tE)iU]VE!hޛѯHB%1M趈n+ij\|]U[r[ݽ*v!UrO}=񌓇TCWd"ٛͦm#q*C3EiQ;!"ʼnYYZ9:dCs=S d6) VAHd ~|\Ti,U[*UMnC826G8sٞUp堚f+~Ů7վF;Xݒ۶dCQfwUQGؓ bU[ն1TqE0&;ppL>͉GGRz2-93 Vb6O }sh~>zcm㗱!2*^a<R`a,>C&$o[i'&cn"Î9 ?(p~^ gendstream endobj -542 0 obj +636 0 obj 501 endobj -543 0 obj<>>>/Annots 20 0 R>>endobj -544 0 obj<>stream +637 0 obj<>>>/Annots 20 0 R>>endobj +638 0 obj<>stream xV]s6|ׯ:cS>,ovNf륏 H(ޑ4eK{{ 5JiV3PVÆfSfmNd:'R5Q{J):zoCTUE!ݯw?n:颫s=O*[nhzK)jeQ{} J~lŻk(7!zkhbIQKT][8"huk =*%D !L:wsgF:Xt[v{F[D\ci*sз]/`t*[fwyv^˺#_4lJ6\ΰfLw=v">\α\큷#_h%g, hwUSt; &+%.116xLHmHCX\X:/N/YN7ƳaG-ݷʙwҽʛVrLxַ^ս8AdcfzLfǰ숄/΢󧄶Otmjcj3 \TM|6Z/d`zr؄)D]'=T4 y`V\\J}u>s/mxIW`hc1=QSt ]NGkvxmzZE,22jc; 6d[hfz@tԍod1"/w闼&aig%>5`^:G PdEeu*3ċD,HJ P@a"'@MݜpٗQ.-10x.T5^!i$Up(z86j˧w"]v*;]r|oo j/SUܵ`C wBL.k)I:uv#K|q>*)oQ咾(^wi"^ PEԀyʽ h궒K蝎L 03MQb hM q!;#sM'PD"{sȥpMr4,N~$&%i?:>!endstream endobj -545 0 obj +639 0 obj 1091 endobj -546 0 obj<>>>>>endobj -547 0 obj<>stream +640 0 obj<>>>>>endobj +641 0 obj<>stream xV]oH}ﯸ AG4ۦEtc{=f-{ BZ_sνߎ4)dIYsrszs4IV+?Lh^&+NZIl'q.Wd`L|fM9m ].ɒ6yx{Bl4M ]z3ze|%5)eFlh*T-gp84:GuV>ڔ$cT;T< >! F}0dp𠡾KѤ.,r*"X^^| \zjwE}T~0~4jP|ԓl9:DB8]@Z h)ACYTN֨_;@{NƵ3n1|%mkc*bEdϜ0/hkԉtMYOu-Rq6H)ZAgC ƠNṉB'RZ<4Ez %u$"WIp`XBaCd\}8ׯ.79!:1{~FN'mBqNU ʹ(7[cyZ(V*n"f~c.7kJ+ֶ &'y5DH6":^;,"K:Rb'is!PGO(4pS8sFK. `Mr#H, 2д[/0+& 3o#Y0VR9I_Fy阑 |sapa v:6hU#\䷐> !9v~T Af?#~t) 1Y "Av_I]AMV\ [J+D8EI?Uӄ~/_'k s=oϵ>_M5N3u?Ŭendstream endobj -548 0 obj +642 0 obj 1435 endobj -549 0 obj<>>>>>endobj -550 0 obj<>stream +643 0 obj<>>>>>endobj +644 0 obj<>stream xWaO8ίҴiK[OvCe9iJ'7qZClM[X@ E޼{S1zRR}}uv3?]1 #| IM K>suN&!4IZq4\Йa*g]*KDٻQj@q{#i||&sd\/yR9M%*ˤ#uEts}O4YgԴr2%+͓JB,l'v8OI8c(d}6tIyz{P0Putas])œ$Q5k'tr$S?A  cdB(.`K笝Nd!EA,3Z;TtrcE1*;B=A1=TXҙAx%q/\đ]NHg/*0O(~*RBsUVFTkB$S=T^mWﾑRlV+m!t X,B0/&87]5,* p=47Ps ) Y2P_J,. @@ -885,11 +1033,11 @@ E sWӖ0\R͚T]M)z2!B|90j` v͈ mk =1̘p|{_km^qh-pCo޲SٻXwK÷x\ɤrbKnTr2/`1~k3}|ևg mezO G5C6>>>>>endobj -553 0 obj<>stream +646 0 obj<>>>>>endobj +647 0 obj<>stream xV]OF}WLV qJSҽ6iQaco%ȿgvKH> ̙3ד=qJ#ʓ! 4_h2yN< mUQIďN(I5tN::"EC\m 9x?#}ꦣdD)}ZT;}H IJ3ĝ[ƒQxPa̖1=xhΓQVt=wg]uuXˬP)z&ʥ+A$a~6it>JF4qJZE/i 4<yYhJs8:T6‚sq'T!h.Ze=2v~l]Y;oeC[ɽYENki)2PY1Ј4MھFəR ͌2ŮE0'ѠxDh/^wMN$ @@ -897,11 +1045,11 @@ gh)Y39 Y/B5.#; lCf8=Tllc y' j.2])"eZ:S%76G+=Q 3v%E F5i,CX.E12,g?5["8yުT^A?~jHfJX˄1T 5vK7Fzh|6xg^sdl}72V"q{_xUVm\^|WLEPMдu~ÞW\לNWiIb!tF{ZY}G| #b\zF 7NBnp+'ٖ0$갺*X+AtY(RMq[_/Hb6z#| eȅX*0kۀ+$R_۽^ 8@ctbnt8 q #3)׳0[ˇj~F1ݞ1fsYzKH,I'jGup^G_&ttfXHfE|VȧW,xthX)㨌)Om_2(dP\ZA8i hYq?igt& $qN;0|y~.&K,CV7᤟\܊sͰ77endstream endobj -554 0 obj +648 0 obj 1189 endobj -555 0 obj<>>>>>endobj -556 0 obj<>stream +649 0 obj<>>>>>endobj +650 0 obj<>stream xWn8|W4`+\=\'3X /DٜPG﷚r(E{g@C::ػޜ`DoNQ?4O;dOh&9ʬ]Y󋧅-8 qox5jb#a2ي'o_>vmi[Z/?qQZɗ­44!WVpBfqАJ(C0%C<WZMevkz$D;s Z{*8(j2<2C n_fRqJ#`_!P) @@ -913,11 +1061,11 @@ i sڕ/"GG=\+>>>>>endobj -559 0 obj<>stream +652 0 obj<>>>>>endobj +653 0 obj<>stream xWoH~_1%iRZth5m5Yfwݐ]`N)z0|B3`hv4'4Oilـv*ԪhzuR^D^G|)uFkmmGSUh|[ aNƧلZ#kT{Ƈi|Psg@taFZ ^˃ ~s QmwR&3P50+-/ޒ[$ 6՞._SL՜ C#Z$?f2.} ڟA2ze//kP^mA{[`j+TSp2#*P Ka-ݾ+Mjk`273d*[ܺt8 I  B0ljN54G+-Tt/MΘ)nD!霕ounJÖk2@sYB/[”%8=v~>xgfV;F{B^)Zi+&V(C ,;4gۨ`ʼ ÓU2Z_tAAJ.s  @@ -928,27 +1076,27 @@ x NKD/d#ч#+3IMb1:zu\aN 0f- v4n!ЁH99TH?HG¨-L4iKly e3Lj c6&~M"90@Xh$q@ Y9hO&H>o>&y=J?ݿ\^cp+4l@Ƽ#ӕLH{Oq/E+u9)+4WG+ JTvʪQp&W̱}Y3q̂ǛjiH#24bXw^t߸ =4Q*֘[h&Wp6n0Eˍg(qܻ.7s\ g޺l'4f'I<ӋQQܙf)п'Ճendstream endobj -560 0 obj +654 0 obj 1764 endobj -561 0 obj<>>>>>endobj -562 0 obj<>stream +655 0 obj<>>>>>endobj +656 0 obj<>stream x_O0)TK6i4fo熘&vf|]'tJC(e+HIQ,P䢜| ]KMD$IRR&"}~zrFvGN\"MugG#J592cAhT{rrGhA!fz,N<<"6}`K4D^(kj6[/br3"2^#O6 B;ᲑN-p靽o%"uKR֡TQznjf~#}V ;U Xy_-V눥!~D?F"FeI 8,EEƑ@O[K>l}/KBD;[_v{~sq[g&X6Y1}/׉>+^cpendstream endobj -563 0 obj +657 0 obj 452 endobj -564 0 obj<>>>>>endobj -565 0 obj<>stream +658 0 obj<>>>>>endobj +659 0 obj<>stream xV]s6}W#)66hLLs_"ljlɵdg0靶sLlhݳk177i\_,[̃%%1Vv/)mv@/{ #>`2Az/u֮I(5Wl LjvgrIoLZN-r*dzZ’CD'9CRm.=B&ܜ `>>D͚%d=<9@Bg,Ho(xل:DMn#bx*JГ$OPZ54QH`[ל)0)UDτ2ڧ@1s j+3/ұsB[_;m+ϋ;IW a7xb#x!>zi])w&S2])5z]nV"ւضA く-J!aWídqs͙l"r%N)*«%Azˆf)L}ʙ)+d1[sIR\~uO 0v8mL)A$ _}x̋R0͗Q V*EyNh2%l%ÊpflPXf,jd 5-+s4UaB5/[̐6fp˳sl @訾[/lRo!G#x`.g@M7BUQ.XZc>i[+3Oyv:M[b7+BD #r8Mw.9/l)Q *1AwuaΥ@kEm ;gA1,eLz狙|qQw%d.=EMfX'-BKJ.Nj ejpBn#ʫS\ftvDtXEj3|Z^mhye\Ò4xhv0F>>>>>endobj -568 0 obj<>stream +661 0 obj<>>>>>endobj +662 0 obj<>stream xWr8+rʢے99[U&'Qj.@$("&-5ML257zy_7\,hςKZQZ]^^̓͆_v ,&+ެrlJy_bA6kfݓ'}$v $IhxDY\BwΙT /3:*_s+8N//4]\%KT >ܷ'J O +]8EWٹKeIN ΩndX;b62R+PsT`'JO 6dj+y(JN^ޏr }U+num_: %C{ wҎr r^u)l+< q"2[0NTsKJhY:H2I&#^_0FZ[Lh!u ϺT0*?rd yu{|(xF3/r{Ժ\% f sHqt`yC=2VGZ>-B͛ԔCB,86fzE%_/ @@ -957,11 +1105,11 @@ f 8)~rri܇"2R·,pgrЧT ,6RΞU!LǃSpMd lty)Q7+k/(bA)JfFu ^ae?KLZxlvP/ .: &-ߴztLMEB=p xįuFs<ڃclw`AѝX(Ǟ5[1L͝ YrI uu pn 9`x {|Vܗ%jq,fhq, x*ŮѦ0ijsa0[aQW7%'(6](6eY\ p8m0nd0k[wi50Muuu[kaF΂EeCHj'@tKشbz{ ^?jQ\aG.t׳hIw=;(Y z3J_̸=F%8JVNj bY.c?14]^݀M|Fs^A4"A;A,j|(fB$cI~k\fxOyaRf }S˸{V&Ɣ0X [bm2CgnӁ` 輭S~/vce%X E7qj+ N= o\a.B?ٜjAvꫫf/neC_(q¸hH4҅0k}ݿQ)ߦQj)EOw_\Қж8i5&V+76*-_í/0Wendstream endobj -569 0 obj +663 0 obj 1684 endobj -570 0 obj<>>>>>endobj -571 0 obj<>stream +664 0 obj<>>>>>endobj +665 0 obj<>stream xWn6}W ܇zD8oI^KhTIʎgHVHli8svfEJsZk닻yrsC?v/sZi  [9{J@ >t,eBo/fNl:>ieKJӨjT6!oMȗD[Q.g+ %L<EU.%}'\m  0t01UeCD7 .ŻݜRBh& {s/NB^oԶ`(9w{H롽F Ň)4֍m0$q%c)1 "w1#aekCGrp‘F^B4W:S8ȕ0~kMۜd:Kiwa.2xsam/?c~!0/TUAEq 9tZG8GgC"xpL>kц]6&],^s<=?\q^AZ%Id6LNR-R`}O@x#|d4V L!rU)ϵ.t1C8ZEuءoNYM L>ZJVe񲈖["rIg5-0#/i٧o4CjSN}Vz@jz%sՀ9$pxTzKFhj=u&fhܪ"Qi,䓗EpC!ށR}Rzcc&iT畂. 3M!>_07}Л IEbp'-+4#˛V<J@1Z"3 %AEa! QTpF}TH|M)KrV U:Mw<'IKh{B v0tlg @@ -970,11 +1118,11 @@ M 99vL/#ڗ#W\(R,l0J )@E ,nYZNz*&w"[w+tЏNrq8,Bd% pq 6ҏyL LU~C@BEasܓ1cyϫKQ3RXRyH!L6zsuԻJJs$qV õښ'U|8#R3D+c!ٜ>)]'î%܁ҨS ~z܆`%}=x)) Y \|U pѷoD 7}Vp8 Rf)9QI;$p{j֑!@a@ z Pb(äb@-?sX0&irüz[%0dP#S6a(WAQ´y&[\HF}VeKλvŦ@`m=J0,Baq|t=}xK?cg=s:f:׼2\b=[S^RQ=pH3d0j:uLmL>WvL"#Atm_xM$Q%ͣ:AyF엞gl  GVqoyfi6avWT!Tr*eCk77XQC5V߸n+}84i."vcHCn}X1j(^~\+D^> *r糋s3V >>>>>endobj -577 0 obj<>stream +670 0 obj<>>>>>endobj +671 0 obj<>stream xWO8_1*hi,:rW jJ'7q[;i -H$g{3{=G}xBqw퍢n쌶t)~:xc6X~t}LE ~rvJQw)Nhv%0X+y_5$YJ$AVۓr+2S)%ra.{i8ɶ)%2k!%/h~E&IYRzk`п*5i锁k1e2LiS9ڙXWƵq@F'V05/(+SzI SPieaT ;Y(TLfq&6i?s<7d ʭ\"M|0&]L)c@ZzKl.^(QRp$68 Z_O2pEv]5ϩh?NC`[;i/hJ Jvhx>x~DDk1!;XM":Hy\`Xfε'$y\4B*e]cP}+h,A^Ԏsz lg&_jr4;gw~~F*.5 E^+8u5-!rx,}Hbc ʰ4L9>Rh<ʂNCj󳦝Mσ>#>{-gi9A flD Ƴ7WC4B$[ɮLIGBP*0J- l<q;ML*.944:*̾`k~Jgn2G e hpѠq❘Kֶ6 -ׁҔHz|, \2DK͉K6ИF^;F e~a`BB>ǜ7줶/~_Kq/;+^|NLB;KǓ׫}fYm65FA'];uFFBi7sK>4E7 d^M2TFzb[ax:7e#/Kx ] \C QoSLx6GA @@ -1001,11 +1149,11 @@ h R ͡NٖFL HF'mu 屑 ]UIG' W&.X;!kNN}ǥ=9xu|ziݯy+v ̣endstream endobj -578 0 obj +672 0 obj 1741 endobj -579 0 obj<>>>>>endobj -580 0 obj<>stream +673 0 obj<>>>>>endobj +674 0 obj<>stream xW]OH}W\% $!o@n$HYnjbɴ;c{qZBiil8?C:)EUp0 sJ3|z+x ;/? lV $XIJqD+H:iSR5R|;Î0DRZ[BfaJ]DF֤Nx$퓂0L΄ki0VdO4\;v+akG @@ -1019,11 +1167,11 @@ l G cy@+U\y5=繉u{ ΃f98P&}!H\Z yM͑w5uW3*,]&#!JyE>U-nN?*+}ha'>>>>>endobj -583 0 obj<>stream +676 0 obj<>>>>>endobj +677 0 obj<>stream xWn8+.rD\N th A1@6DGlhR89YM4a}s.$ rZL͜d]\Gs:gٌf |N j$m+9~ƕ|a~KV_K'*FMvя%}_~?(㉳'Fq296^6Fz[IK<59|Q$WV= i܎aIT Gk) ݫG|®!=#cb%e%9ZV k6E@K] 69nCJZ۝2T!r2RmԷ󸶒 C qnx)7u傊[A粟q,XVZa_zrat'fE ꩮ]FjxrT[Ȭ W>6i1 xdbQBrx͠Qn |_~̠8p 1BWLm E;ksή8*#σ>z"٠ܾ|m 2X,l͓+h}+-_eL.t(yZ cX*L 01U@b3$O.:φn yJk{QƑKR_qWCYԈnGE%|oYw?@W9؞x`ռDI{߱eEi=R|e&ˍ`$p•#;-5_g2ak\4~5>7v8K}]_2]YY[_to4 ǧl |ŀZ~endstream endobj -587 0 obj +681 0 obj 2036 endobj -588 0 obj<>>>>>endobj -589 0 obj<>stream +682 0 obj<>>>>>endobj +683 0 obj<>stream xWMo8W |rFNȡ6tDLDQ%8XM-R"͛7G)M7ŔNˣOˣIr~Nv8vzivlJ*pi2m߄C l%?`jJiJ~ ZٸqVBK*,,Nf1❗#+,wsUR2OsD-w؜LEwן"s^jGţ$xGY |6pKRTFxR ")mݦ@n۲K7Uf♲Rʓ7Yxt+J. R\T'' nLxew-)a8D*qVwųҍ+ (gmZi<Ʋ]D:л6^AfsůEI?qevW D^',V%뚒K9**'+d r)}q=GeQ:7Oր4k+a(T~z#&RDM ޥՍ`ĺ)#Ԡ.׀<% £4(~?$3zY!TyfVKTl%A$Ss8\㙭YVbU_k#JB#Au '5~7V-MUucCTJ(P :πǿ p:;MYMiV"^Y&trۓz5A˶f{%cb7& L_} Sf˥E2*aXP \MH,!ZP^ϡu._]3_Zon7qͣlU'5Yg [h@ΆiGP B5D xB7 ֗.V@+kUh&um|`E/;F]!j 7]PZSe&5FuA8sHSlhV g0 YV̺AH"dN?_e>i0;[lIWbA@ˉv(7бp|*BX;LaH1 ~$r2 QygJȕݰwqG KL'4<L`3 K-Qf" Њcnmyhq)8?^LO>kl1&9E[yfhendstream endobj -590 0 obj +684 0 obj 1525 endobj -591 0 obj<>>>/Annots 32 0 R>>endobj -592 0 obj<>stream +685 0 obj<>>>/Annots 32 0 R>>endobj +686 0 obj<>stream xVo6|ZItC7 Dl%i;,HV` Xy{;~oEoDzCJu;ou񘚏r.A(%-Kɛ}b-8~ Pxק(G4O݂.͓ t?ϪHdN΅*(х-uɒF+rKg?+iJrU!I$?ͿԉzAS3/ ~%UnG:w~݉&Ѿ&s#2'(o݃*zLc)uJt-u=>@JϤӉǨЃ(YuV%*jiХ[. jZH|Ɗ"eJz<gC)X}*RQ*&~ Hoґ)-̵߼ \DD~v"7ARP$ez t \c La[!Mք쌴م؉ U2.Px8 )6 }O}j 'U+"bY 74œX2 x* fVڹssn Qk;fȓ>xpiE_#l[*FBA{{h $=TwJ]5o)' iFqmF+{Cd Shc0q0zR }GO8>>>>>endobj -595 0 obj<>stream +688 0 obj<>>>>>endobj +689 0 obj<>stream xTo0~_qIByLU{-H}49$nNI~w(4 $wQc#0IAԣ|-YѬc yHO&,FBIi! /1{ /12fS6a1%<)](-a!i_QxqyqoojdFWH K^8( \iakLUɆlp郂ǛSi} Afm2__AZ}Rj(m}:3nJ:>dQbCLTF 3~Nԏu } h{x+z3mZ>_I4ӺЧ%'w>>>>>endobj -598 0 obj<>stream +691 0 obj<>>>>>endobj +692 0 obj<>stream xW[o6~ϯ8@6{hi:{ mqH⸿~!EKV4, (5swis] هٯYvwGncF7 wxϗ솬 h"[OPp|A[Zh;Z;VR켴tG7jXgKrުueAxYu6:&ފ:B-ƗXUhͶζ/W<{Q ]uIyuqߓn53Cgrea"to*a{xsA^VDx>BQ+xɦ~Sy mxUaRXR5ۭXWޟCM%<|~x9yC;kT! p`p XLcTSIe*$BL?M2*S!sx '4@^5 >!FCAT|S 4U}kn,?p bck2K!gM^"޼4@SѬp(yV=w1bۿ5 fCم( @@ -1093,11 +1241,11 @@ x |3PVi<"PܙST{D̵{IcRSa:<`prrw8%%OU ~syPiB{PzhCZ^#My87%J-v<5C-^J6_@muq= io؜8ðyU'rAځ|g,U C_v myz<E[)8`L~ԻKbиQyf@s]%J8d(>=Abl);vxZ)|Lz_JpxM!ǵJʧMRB:=2G$/XԘ~F/[g}oXs74HD]YcZ>>>/Annots 35 0 R>>endobj -601 0 obj<>stream +694 0 obj<>>>/Annots 35 0 R>>endobj +695 0 obj<>stream xXnF}W PQ]}pPihWR܄2d{f)*6ZeqwgfŔ&jFo?/&u/f&4 f4Zj\\-'"X=\ TwdJ-V Q)?l)կן.»yszDTE)VZRI"XTb#lG*{muRdCYɘX^5Lh L> @@ -1108,21 +1256,21 @@ K Ŗ[9Gr7X&j8H(ˬ!WαN03ޭ1h95(QpM;ܱnw*pB Fw7Q Xoxw, {zw7OX趿 ?>^K>>>/Annots 40 0 R>>endobj -604 0 obj<>stream +697 0 obj<>>>/Annots 40 0 R>>endobj +698 0 obj<>stream xUn6+ޭb$ٖ=8Rlk{Ʌ([tI*^)9Z1D̼7,sZTurviIYFebiJe5 *+A/厤&gᖸ#+/&Iւ'c!Vh/+-oYc9ܬ jJ-GJ˜qBjlypY/ -?ϲ"Wv=l1~*FA.[cT5A+%jѧwgAk){-=Ѕ-+g:sH\ObΈ 9I}bk:BDI-ꈟX|)Ed TWEI^rͿݞy@=  Jx4^  w ݊nSoH W_>DnPmy'R5j$t{jY"mH͵W5LUez ݭ 炳;At1 U8X^U{ PۻAj(gw 9Ƀ6(j?b(i}Fu(jgG,eq5;2$`S\]lO|b=8␅ЏS$E[l8A}7J`ʞp#v;d#ˡѡ]c%at87 qFin։ZQԘc8ҡ7=?қ0rHIzM_.yw*ڌML% S;7=Yf}dϏ[b7$LՇ9nǼ z6xaʁFendstream endobj -605 0 obj +699 0 obj 822 endobj -606 0 obj<>>>/Annots 47 0 R>>endobj -607 0 obj<>stream +700 0 obj<>>>/Annots 47 0 R>>endobj +701 0 obj<>stream xWnF}W Ї*D;@ I!(ZKr%nBrU.)E3C.))Mٹ93.1tAq~qs7V+{ LS E*SEUzs &rTdkqpnme*OHCNE=]>>>>>endobj -610 0 obj<>stream +703 0 obj<>>>>>endobj +704 0 obj<>stream xuTn0+VUKv8&MskѢ.z&鈉E$eAߡ$'Z0 \cgc'ǺbYMwK9vG6k|>NNS#]up'#q2% :ؘ^2/:s Za-UQ:fhK`>\cӂuvFM60P[7xS+rg#5Lt(1ҥVt̏wԎGT a%'j=_r_sJ jFF;T'ì`5'DZn8=jV.>2oAƛءn|1n c & }eJqpΥYiՕ8K:鐆|JdS5F9]W؋u=fdt qŘvDmZFj*Iv#z=sdSMK\gCl(^rdzsEn~Lpendstream endobj -611 0 obj +705 0 obj 687 endobj -612 0 obj<>>>/Annots 50 0 R>>endobj -613 0 obj<>stream +706 0 obj<>>>/Annots 50 0 R>>endobj +707 0 obj<>stream xXMoFW rbdY{s ; P$i="W6.$,hEaEr>{3'soN](N?]bF[YCNt67YrS՞.S_E4qޛ!es-\gnqL6 vwv1Oe:Ow>ѬP/m=mkpH竔HrJ[|['#cƽ6,]ץV&-1%,!GF[:ĢQɪʫJ39O2vU"9_j2uE˜4lSVRյ|0#3 ֖+:-Z̯߁lVo%ORVʚ+usv#EJK%z|NgL9Q$,,n^~u;E`vqr,F;0f.8P9>ev-#<-uLM׶,Xhc͍ g S䞅^xۧ-R@ծnκC4V}C/ޡmKpD Chp#JKƳHQWcJ=GHŔXNRcٱ$ *еVm .51Ռ&pdx?R)H],\{F3=5S_c'ɋG +YO&!Yԓ_E?&NQ@X{ UI5x G5[ſe΅`&qnʓ 9d\ua",v @@ -1154,11 +1302,11 @@ x z:|]t  1p6=6d]l$J󹕀 h?)GmEZE7_(PzL~cub;o'^LcPq'4_F Q?~˃D;r3x~bLB\˶&_hֈC M#?'>sdamyFɁWs+FpzӇckX>^5r5HcbݔB8#yC TAn,YC\8$ p.T1QS3{g4=J-ZIwM_gx *cu)YR-:JHVx.bKftnTXS`Ip.hKr&8쀣 2Z\V9"FS'|PE,lЧճ2ȓ8gXsqƹtc>>>>>endobj -616 0 obj<>stream +709 0 obj<>>>>>endobj +710 0 obj<>stream xXr6+vx3ВlN/۱;$NI@$h& ,_߷)TNf2o߾}?GSߔgt27 p&6l{>_OO_ixqB6endstream endobj -617 0 obj +711 0 obj 1783 endobj -618 0 obj<>>>>>endobj -619 0 obj<>stream +712 0 obj<>>>>>endobj +713 0 obj<>stream xWr6+vtRfRlͩi&6_ }$ r:ֈgSϔ3z7:E =M!~}~2?zr=/67ŖY*"Wy?X>d73vB7UcQe7&uʍ*:ʾ(+M `V]zB^?kwǣZ\]*MeZՊ#5ž"Jo`nSY"b }(G^rJ'NOMÉJm 0T`InՓX^eT @@ -1186,20 +1334,20 @@ Sj N":G]&k ٜ?cendstream endobj -620 0 obj +714 0 obj 1613 endobj -621 0 obj<>>>/Annots 63 0 R>>endobj -622 0 obj<>stream +715 0 obj<>>>/Annots 63 0 R>>endobj +716 0 obj<>stream xXM6zHФ4mc.\^3+$}3$JvE$|yoW bL91% 62_.h8VhcTڔ:myJGZ^}iv<>T`}KJ3>UѫOoQmIvّ&27UelQg?(ծoYl0d >ٚ;ܽP]]J}CXɂ&(IHx!fLQղ[#SVW>!%~Ji>arZۇ>s TRY 9%2{[y#u5'TՓd5"#کReDo#IVD]jdK^)(l-9A]k2UgxQ75}+NS-٣]4D,`{WUʲ }ץuݼKƨïV5*Ԝk7M8ԈٽfjnJB9'VwwJgç9jp1^Σ{ͦQ XM?56miij^m!vGӳ}Eq|~r~)i0wW IYk"*]ic[gETj̓ɘzNG1([Ch;>۴Q߇4]Sh6TwRdyQ[!&[ sˍ}[8xX9j>!랺L3!_j0cӦuCgN".Ax~NScߛ8@(d+0@R.=1O)E܆@nܖڲL[< I,gH< \>gIgZܦ0 2ȂQlG@ז̖A[@׶n`r dB g䞺QsV0J3>r<W7Ոf©t@cHhOlymHlÝfx K q'g;&8 -yt8gm5 ?v1X#ǖQ8db5[ߋ~촴S"<@I.'ȸxgZWiiX`6W[{\ ,9 rUPdK-=QgD}:}o)i$C[4T26HpZ/?T  9tbLv"Z"xөZC_M;~W+/t!yѕ(un "SS7d2]gW[SUCjoz*KY)8'r0 \hNw|aw-V͞oum&.GNN@pΔUNzPFWUq]{Ep{D&gw*()B"nMNƲfw:oݷ)$焉FS L*͗k˳Zh)rө٘Y~$u}Qc+},*sUMi~`^oҧ)/pO7߾?J/6縀˴bpŷ1~AZf,rJ/+>]Ldx/P?)Kendstream endobj -623 0 obj +717 0 obj 1658 endobj -624 0 obj<>>>>>endobj -625 0 obj<>stream +718 0 obj<>>>>>endobj +719 0 obj<>stream xMS0; qHcii3큋"+X`K$ɿn.1v}]$9RZ-d5&o>-)M)br,y2)+OHF"'K pRA9ONG[fKtJEOgN:[);~x=?,ϴWNQU*|P"'Wk/k{ NXlt\& ZW Ffw2!dg:Bm u(bRɅ[[]*!s P(vҝق3mz=TWȇA O'hANdMy8?`oNJ{ b= em?sԕ؃h$ٖZ|Rū@Z4+Y;D} 8vhClqX ,Dh/Q/SwR@Rd9 )DgfF9 ,KbX#U0CH Y ll 544PCf,>>>/Annots 70 0 R>>endobj -628 0 obj<>stream +721 0 obj<>>>/Annots 70 0 R>>endobj +722 0 obj<>stream xWvH+j9$0윇g2c;N 'q@g$ϭ~2ǠGwխ[V?.(-^zJ4[rLQ+iJTi}FKUTISQ%Q=}+CRwG ꌢ8eSMK?\sR%oQ͊ F݌ސ}ZKLo ͨ q2]R*\ldƻ\tk%nOo衣"e>LTBfTJ>ȵҭ R1eD>8s#[Qn96yn"1E-̐2 mij^ ϟ\r}~[$LW2 K-tM̵j @&Z\jEo2z 3"@4VL"zשg2HH!]|o *D S`*{e! %𒐖}}atNF6ܻڲb鷳atA?[NS w-IvЩ [U%uVMS@8nTJ.br1gH.F&:p4]04mDݼ=G*szWzn9&"p3X :PL@7Dn8R+܆hZH4ba2*TZkMw@bbh|,؃8 u{ܟ?D#~k1ITCo4+^N7ʠ_@77؆-8d{'_TkBh~ ,$܁(j.FtAlYn2ш9tX,Mz>P݀l%Q8$ .Ѥ\,$mh[ B*B}p]@RÓﭪs:5; (9ճz7UilHy[/+m:sඋp[-j]le*H$hg>`# ,DdR@iȚc 7}qhw-LaJKmnFL(,}n!92feT]?FZp^M{r ά̸&Rsaa,l{36 b)ɣ5+kFߙ ò4?^* {iST-A",j2~3wJ:UXalWLQ~)+rЀ ;лL.(bj!Kx#No⦷7qͼkkkTk/_;Bq.d ؏g>>>/Annots 82 0 R>>endobj -631 0 obj<>stream +724 0 obj<>>>/Annots 82 0 R>>endobj +725 0 obj<>stream xXێF}##H#v6Y,<ȖDd+(=UݼH#g7<ӷSN󏛈?eLɂߟnՊ)%djߣl"i[0saFQDO[iS&SzJGO{4UuwWidyO_owty%?yQ)س|LVuFMSdT/[#6$dM%\fr Q809tq$Gp* Urc40+Ɩw2QWNLZh~+;vŪ1X#/֑K[?;p:e#~#2['+l%>̤Mz Fx2` xԹ6B0YL[?)1pcv hēhBoB7==4ۧ<9%͡0JitG!$,Wclojmk`.S߳ "+dlpfiʍu`R#gH, )'K@U5=,zS*KJ oNDΫ}yzd)`Kሀ8 @@ -1235,11 +1383,11 @@ t ].Z, y{>=Ӛ~ 0S//c0O%eɔ" ~/)endstream endobj -632 0 obj +726 0 obj 2102 endobj -633 0 obj<>>>/Annots 85 0 R>>endobj -634 0 obj<>stream +727 0 obj<>>>/Annots 85 0 R>>endobj +728 0 obj<>stream xWnF}WLQZۇB5YKQŊ\I\KZqя]@k;3gΜ~=P \.On'mo4[6 z]GC>["i;pǔoX޺m-8zݦ}83{|ҦlaQ>F7>GzohoA{'~u1zak;͎V94{񄷓٢4M顩2y͡ZmdyE(um-N)M*zu8{7z#q58%F0]Ĥ* i- ~kJ1*P NЉՕHT(gC\!em lid"nn)@8|zE' Zdaj;)/hTi[JǾ$.-؇=FcJ 1ep*yTX.2Fʮ>v(Pozhj0yzfT\:S[ЦY!MUu#SQ>CQmpQǍ R5LRW2[A@d,HŐZVr$(a2YjJkdT2HIRQJ!,[r,e:POސն*-dV7 7_,awvSKR +C噰dQsIY\A,&ca<_o&3#_Oӣ;*!oEeoX/hL @@ -1247,11 +1395,11 @@ x 3m,Q! PT/\R,Z7̵*4m9Os5J@|x'lStTҝ rs#bpGo4tvߺ:!-HB~Y]:sφ]_9[{ 컓xA endstream endobj -635 0 obj +729 0 obj 1803 endobj -636 0 obj<>>>/Annots 94 0 R>>endobj -637 0 obj<>stream +730 0 obj<>>>/Annots 94 0 R>>endobj +731 0 obj<>stream xXo6l Ċ$;5m3IJFq~(іdh6EqA@>4 7(?8\L|o4^`S8>GZR[0s6XOA@FCvާiZJMiQI-M 2i, KJ UKQѧՔ,Ee(VVFbs*=RhyDwGx1rS7y!tZS-*{$qs*0l/a{{G4]J(R+ ,˜U.ذY_AKKᭌ1B[i&8 xN˜cay;߸k1He"VYEyjL gE!c{l=wg"%p4qŽԏYZuA V6-ipս7pMA_Roh/zMVeth h߁&tͬn\LbZ9`S# W],eLK$<KAi`޺Ȕ(MfPv>XpZT|b3Fr8IG,5_&+T&N7`t!3s 7lFMljbxv6@$P98e>`m @@ -1261,11 +1409,11 @@ x mY.8q +Kwsu ⼓zҳ| ]`m=n/^r4R;NG0o_Mh5yEC9b3MB|;]^ `۾o>b6\lX̽jD{FuS|WR#.ٹ B*bӖcFy4̩N:XVѱr/8EE GI y9.v_YQLOE[`ѧ%93 rDn a.[25ڊQҶCҲSk66Y;H7B67{DtP?[-.Dw(SG1(oάu,^)]8ٿQOB}+y_TPfek{1 CzY^ ^endstream endobj -638 0 obj +732 0 obj 1839 endobj -639 0 obj<>>>/Annots 103 0 R>>endobj -640 0 obj<>stream +733 0 obj<>>>/Annots 103 0 R>>endobj +734 0 obj<>stream xWMs6Wش(ʔKpueC. IHHB@ʯ[h%v;IbQJcIi6,>z8:Rb'Ō%xLbd*jRT# Ic!ˢ(Ydk ^$m$Kn#b']Q4͒ rm^QLGJ>Ȣu64! su¿b9RFU;d4jE[$1.z,(ɔjJ,9* -6HSPm%k5ua4I>:|SY5TJhNMO`@QQڣ||IJW`c%Y4%cPY)f^xIrS[G]_ҧ< (\ k/1H5 /Ck {T>zF/߿T_f8sݿΦO@u)Hendstream endobj -641 0 obj +735 0 obj 1730 endobj -642 0 obj<>>>>>endobj -643 0 obj<>stream +736 0 obj<>>>>>endobj +737 0 obj<>stream xW]s7}'2 0ĉ'qt҇}/FBN{ϕ|=ә ~s Mt1|}nvavMtxK|7t>|# htB"iwB-e#ZD%裮>vB\Rp mUTI,%fK# "u0Wg\ Yѱr!ųJÌueEx1N<OMJ$Zjb+\t2;W2"PNKYB@x/`qw W4%̆1jEoԣ'2nJ%u+@=d;ƕ^O[Pzy:ӍP%'P8Dn ^-T5CU~Q 6 5Nf.E'$'鰑Ag!SAK+*(YKH B鞸p bl^$@sk٨8 ZK1?jiwt0(A6A9*,(+_M O 7!qZB3#meY9cT21)Ta:3dm|z.­oJ rm=ZC*o(tN2$e8r$[0[aaMè˦]<P[l =wH@w:*c}{Ǎ %P^7|n}&yKQ"$5 Rx⊛-:7va$, K4s{ҟ>_7A^.Nsfqi.(A9Yzpӊy8cS~YRnN2C&@ƹ2C˜`ڵ#sh m \A>?t\Dbк@U'\j0%YL`s6i#25^K {0P)87t\iJN՜8clE m.+:K Ds hWȀVݕ2uܡ,qs<O;5xHlUYrz30/LKT(~t B,Q;؉&9,4jG|ϲp!njlP)ǟ, 9eQhjkT` 71s(bxj\ l$<] ?H~J@`>8{q=3ᭂE$7Oa)vĨ0# Q@}[˒7ޝ9!PjŷRM#S~xcUq#R%P)ҤYDyh2I iY@\0~V GWWӖ GX͔:TEz=z`>>>/Annots 106 0 R>>endobj -646 0 obj<>stream +739 0 obj<>>>/Annots 106 0 R>>endobj +740 0 obj<>stream xWMo8W-Go Ewc  Z-%8mEIEP}y͛W)M/eFjrtN=,V(hLSE2OzjUpJ74퍮A;AY2MYd3:S>'p8i0xf8Z6Ja)/EsmG'In%5IkR )[hCFVRXi?P4NgGPECYYYm0xC{]UWT WڄF+%Z$\6G[2t9# H sEhG۪'zTMOP$amJNbF&DUufl+%tIprwČɊ"Bl_LN!'~ `@T ˙{I}`),= '(bBû(U>Pw d:KYs!Zs/NP$n>ݑh UYR@RatOd-BPT0a) opbH&&]:Ii]De5ىIH,5vRy 3bb5#W#gg*~)wvAR(mj$`"Y'>jI&LgFvy@uf)/Tk!C/\ɡyHL>o{#C70ձwCfX(^spUf6F :7uҩe~/h ۵n:rSEy:PD6o\jaFOCy3ؠ;>~F(!B@B?xxhMX+\qR3B2|)]fɺ;`9pso|\q\q2Q$%|I#݄Ͽl寰\ /dJgQG=E,x6/ݱ9&UR4OSjtKt>`Xݠ/mph\Z!ijXAd损*;5>@Fj-Sr){e}2:7bsˁ%}^;fW7Wt+q,e3Ww;lN0x耵OaJ+y^,A6ԍG>>>/Annots 113 0 R>>endobj -649 0 obj<>stream +742 0 obj<>>>/Annots 113 0 R>>endobj +743 0 obj<>stream xWnF|W,P`)YDž ic/uIdL;Ҳw< I'M'EL9d|sA+2_2I84M#5-B22muT%AT8|nE3h4E*^~Im}Qu?~iL[Iکr,IO~6Gнln>P-p^D6`@_f (#%}?՗a QSE?? pG,f(S񬧪n2m*s]]~:w2viyVgmMJghC,䲃zJBL6.eBVx&_}"UUQG+ԡ|SMl1یF ifFXS2Bh(}!_ !zWfs1|EDrGHwci*m^V,wF$D iz#â.kaغ0ںțQ֒+zGsQ5T$tnB>DarjK-#7IkLf?=ݧف߫):J!%m-Kr"V$qmu6 @+18{o6p*R9Zz 뙸͜3쿊i c`Bb;. 78D |rSY*)xm)eȚFA,=a ߜw߀iw,;<endstream endobj -650 0 obj +744 0 obj 1500 endobj -651 0 obj<>>>/Annots 120 0 R>>endobj -652 0 obj<>stream +745 0 obj<>>>/Annots 120 0 R>>endobj +746 0 obj<>stream xW]oF|%ja"eKrG]VuNIbB򘻣ei6HYܝ]};i1L)-.,󗘿4Jh:Fc*)>F[A)1-V7hǴHGwRZHq $:ݏ9@tr,~"*uUS;N0GT䕤rZj) /*Rdoؓ=NF|ts' D)Iϙ*@l% -ʫZGGgI4.)(x?S5T6ƒ(xB# 8:ߗ^ld]mƀ|FZ&9v҄{%j45Fjc8@hhveTXPw x}YMgx3߳E{M^2zI|{Dm?My/pwurV8DgSw./HoWqS`럧y)DR_1aHRUY;~/ʥ EAZYBrh1E eUSOXdHtf=0a!bG[Q9 Z9f}bLNC(PRUWhp:1yQ`+aGWfeƅ!>, d'tT8ӵw>xl J|"G^TO QevE[xlȚTfLWH, @@ -1323,11 +1471,11 @@ b _1wAQBJ7hN@m,c_Op3y9[B,N ' du̶'|JeNetIe<&W>V l3Q˺l݀2|x '5dZm (1zP2]n!^SZYh2ꢁ9Z|py|͢ID7;`L%Ҩxw~^qFk= IƆX&ۤ?6?gw8p`0Baӧ*.` fݡÇSgJ)*\71$?:q=<cB)؞BA\jqClX[RgRr&xd 9^c iv2f>bĸy7} dpU1cYϴ?S|^#18 T?ۯendstream endobj -653 0 obj +747 0 obj 1709 endobj -654 0 obj<>>>/Annots 129 0 R>>endobj -655 0 obj<>stream +748 0 obj<>>>/Annots 129 0 R>>endobj +749 0 obj<>stream x}WMs6WQi}KLNt<8n{"! 0i} @$D7eo߾)M3+JˋwۋۋI2c_~M56dB%dV=򩫏 Ni}͚`Bt,WT1LɚEde֪yd~~c X\.,k<̒9 N.c5ӣ11 -2p6!g7t96tR(?ZiAГҙ9ZmNJ;~(%+ ^Sכ2uDfʑ393V!r|{(XRXK|[Ns񀻀`h?꧴+ Wq6(^ lYu/jU`_tLܷA8V6!R_, ]L>T%KZ4Cgc'>>* g#wXctNVɂŝ"{ɧ2` ah I=Da}yxOi.e\*_Dsىס:ϛ̐j,Rhj`'%mI(J4znKΉ檲 tIf"=RLjZJQd:qUk7WKk:F\<#qBm_2>|:p>Hs Ѥi!++¶dEe 95KPG]Y+[_GѠ0{/)N^RKYzj0SIT)WEQpiø0 @@ -1337,11 +1485,11 @@ a$ qD!\1CH`p-Gzq;/:fT ``@u 886~C'k; *^i,By%,c|p6}`]ZsPނ|T81 tTƽvqms7? *b k>pZI6iB7(xŦ\uc[+G/go6-&PY0~.5sR PfߑBpdB(  qmrH_z w:y9 L{nA"\sC}5o''N';[fc*wV85=|O ˪dzZ)΋ 6>0٫n>>>/Annots 138 0 R>>endobj -658 0 obj<>stream +751 0 obj<>>>/Annots 138 0 R>>endobj +752 0 obj<>stream xXMsHWtqY*Vm[>B-@̲Tm= iH~_H!+ׯ{q2 i>jyr~{A-x3/h  wUY-zkwTXlJA%+E`D*'uv2h{gtceR>S8Wo_4@6gٳgu]9^8:ٵgۏ_Aa7btf4ỸaҺn$8nE0 J7Ζioh˾-keYl#'yְ@>a VLIЌsQO&4)̼:t͵`A+FݲO@+~=zze]#0lT l}n&gQ(2gcqw,VE BMaG,&,iB P'=)2ʝߠ h"3`VFkT3(A>:bal7٤sJS(ؠ(&NٲM M ,YN,㹭h>GlB0Nr8\ ;?‚ @@ -1349,30 +1497,30 @@ VW 5F i?2ƨs"U45V%*bY"ia!82bUkB #y4=,2 D.qE,-sZfG-g] <#]A;6;pa9Vf&s- QYO[gRXة'œj\5$Yk1.oɜoHR{úendstream endobj -659 0 obj +753 0 obj 1781 endobj -660 0 obj<>>>/Annots 183 0 R>>endobj -661 0 obj<>stream +754 0 obj<>>>/Annots 183 0 R>>endobj +755 0 obj<>stream xXMsHWekkI 6ru:ط8A D_ &_{H@bW 43uOw]ߧ8QDI~ o0bSUZKk,ӆڻÌEjjKaJbMi[WdKu1טQxDNt]+Klހm,[P3\`D烅B_'et+C m~QZR꼲^el6l~$Ů>I3gP'-mwv"EDltM\gsMh LB0Ho a]#1;ᨑb[9М-QQy^ߛrΈ-o2z gqZu'p*Nlgt]}ٰGlmԡgPRYsZ'Cq辗Q[ sa"6DZ3 ~$xDXYxRu4G⺁mͥ%)NMm8#G1W6F^q3{Ҋz]U˲(3Pvpr!>k?)OHIFѮ-bʔ4_j9}?h$.IpW:N=~bOrs״*sMsHsb /AML>,T3DǜAlfnp ʙ=7ÉV*.c. N8u>6V4s"}JǭrAUV8pg2w,V3s( #z|_$ؑp{+`/nH ޯ~: O {?Dmendstream endobj -662 0 obj +756 0 obj 1576 endobj -663 0 obj<>>>/Annots 190 0 R>>endobj -664 0 obj<>stream +757 0 obj<>>>/Annots 190 0 R>>endobj +758 0 obj<>stream xWnF}W [vdnSI((VbB*ܥe{f/4(i$x˙3gf?h?#irAiyr<Ni4o]\i0L{?oh+*3TJTbU,!I+V;")d79Je;g'?,O؅C#ǓE28Fḫs_T.wB~}˗o^'[K _4ޟhaw?~_$S~H2zD> SoȵB?heHD0=CI^l <*ḃ1@aJa,]Uz AF~UDiKehNB8(=AR|Uk|--(mMZ!l*- vXBYnlj :ZX#LcϘZra(WƸiiHiKzr[Hd5=TR)[NfT ~Wy,g r4]6Wx8rzn_UM{+)bO s.ROۂڅfsTdL޺,i6KZϸYqɠ;Sd%t v7]I\%VkM%JTS4WBY:r N_[esJ I"MuIY@yz9GFcC]M.hN;dMv'M$-+VEg+Ƶp8gBGXd{ 0`k-A-[԰#S7n4w߫Cl7 3s}#&G;|3Z?͉>*IRsip;q @{a7aZh,,5NFV1KGP65*ӍVE!+ `Ka`[G=U+UW F82# 7Iź 8<ЛSG+3Jmqd =YKp3F"Xzj `C'RyDwK4XX aUR)˕!:CWBqM7A=pË=>H] ̿l$g Gh8Da21ԱMLΚ@#v*qsPn=Hک@%c *EA(~ )% i,c&?;}Lhŋ"V+ډ7ѧh tEV ]k5FYww޽njV{!CYzF؟Bz]78ݔ-?OAfA+"?02ajUPn܎3j0XxGR5e33w]F|jie'*WRt8cG*]R=g4^ٞ3J(-<Hѝ:ᴱe݊9 >>>/Annots 195 0 R>>endobj -667 0 obj<>stream +760 0 obj<>>>/Annots 195 0 R>>endobj +761 0 obj<>stream xWko6_qv IJm@.[ð -6[tE)w.)ʏ$0-sϽ|S1{Q\NtɄv] &cB[4c^{xV |@Nj@qLԎ&cnK5[Iz1xҹInO#ˤnRNHFeeʖTt.Ғ%a\$kS賒VNbI6f9tG%HWX+OS҆he >ULJSl#2{3oDJgYg[eiWz?' W2̘ڽa4`qGncoO1N*:Egtg!2[o oΫuz!i[MsDJo)6)ԺTHKL&BIE2:Kae&_W,"ouиFwN[xb`z'˷o~SOM 0oOM.fxؔ}jqυ6%'1K&a`UpT$t[wfkSVT*-B$[5)^ErkpI;2RbtR~A!?iф5\k B jؤ^Zu&fa<M4?dt$Ӱ!asB ljN&ϙ-8uvήd! d0|VQ(v^/A`z,'[.HS]Gg[bcrARkBȝK=r5\6 |%7$X+LK8-īKk \ @@ -1380,11 +1528,11 @@ x t\zV~<kwߝ6:WS,s] Ez t#3j)FȄǻw)oN$I^}TEE&s/tfDUbb(UljmWa7S< 9f)SXx. c~WkcqdmX< kksăs[kphE"\m/0#v Ď}raY*_~!n`ðH4|q״ZdD#{->G0?+]ݓbʝxsra74B"zFDQTHM-QkQ1,[|Q[TXxRs!bVmK*Yi2|&_8qۻݼ=#.U$lz۟jcObAcݭA%=5Jendstream endobj -668 0 obj +762 0 obj 1656 endobj -669 0 obj<>>>>>endobj -670 0 obj<>stream +763 0 obj<>>>>>endobj +764 0 obj<>stream xWnF}WL .h1MSXEP@/+r%mL*}̒2EA\93/'&C]SZ\޿+ܹ+dkʍin-tߝ+03 '0ӛֻTg״r>׆Gf21COhgʍX>gɭ蓱ۅ$]!:{ "x*O' ÙzBgms' *-ןVhBT-s,4uR6 a|ƾ?%CܨLz#oCBtK"(E(*͓>XL Rͱڵߨq+i `̵>:_SQPo䶚Cs;R&'⬑!mAkopG+7 W@A Ym@EHpBpQ%B;0GL/y)3y{_H,A7k ꣂ 8QHP-ŬRooI~LZm ^ nTzTZ"kj 1.n#c-W @@ -1394,11 +1542,11 @@ b mH&\FuJ(,+$Qt_t*AdS&Y%D3DNUi˧Uvx9N G:b f 1lSCHCx 6xHEV;(C[d54q@4Ƚb[ vQ_:Cu8O0.i4&4K&ZN30^Z#God6 Ӎ%)tlʠsެ*P]tN`(n(lʺ+\?>MlICǫ7\4dD"fbbi|5@}'.;;Z} rXEJԺڞi,~S$ +_d̊`WEo22Voʊ@P5PˈXf$ α2D0n>0 ^0nxw3DDw.ݔSx2nޓ#6ɿԽt(endstream endobj -671 0 obj +765 0 obj 1534 endobj -672 0 obj<>>>>>endobj -673 0 obj<>stream +766 0 obj<>>>>>endobj +767 0 obj<>stream xW]OJ}WVM|&+(Л[jmoۛ :qJ7̙sΌ  hLIqp6??W>MѐF1 є?я{# h橻OYTICTkJ.J(SzKb)2woqا8!dgdʂQxZVUJz|38>{x$! 0Ou|mwʌH ǥ@Nd$,Im2$.ĝ(bAJ%h)-ɹ FNҫF*K7Fz#qRi2,^|^8YU!KkŠB+8}2C*I*mS fd!>hѡΞOoDTwCNJKFD(F>bnnzB"˥c>q>CT=Y"hoh$qv و1EX(mWtbi7֭74ѤK󫏞Hs(gCeBL["&@nE+ZG%J G"`blh}2+E^9Y`vgЪ J%,Dv@$I* Yu‘ڦ>!bT(${f̉pPNWP[_.UDFrH[\&2S 72+| O`lqe.{oH)8M&ڶUSHRDCusA=ٵwşB\),Wt#nq5)dQ'`*!' dT B\tƬco @@ -1410,11 +1558,11 @@ Y P5hxq&Z"q aFV;~=u#4.fxgn.݆. }:W{bMTIvzg_C >>>/Annots 198 0 R>>endobj -676 0 obj<>stream +769 0 obj<>>>/Annots 198 0 R>>endobj +770 0 obj<>stream xXMs6WMJǢ-+8uJ3T߷IALi5.޾}#c)/^.nWhHe4)$mxݒFSZmpp>EsZ!u4hKGDIKB0Ib&4yU#r'I)rQ*IDZ+#Td.u]̓[lez- `C&ј&XTֹ"$( m"*+mRf(+ o1"TdwR̀FNjQ̇#|4ͣE h%"uvbB0 s$p>cuj9P&y4 Vg',\ :YE 0X'؊-հukxjYP>OCy>'2tX)#>0p sT8^(~abΊRYŠ}gkڣ_hbm2Ȗna>=XD(9Kx2,,a 21zdIS}:yeKxG7AO\UfemuX1vg5 ƢQlIV2*w\G5`6ڔ)m鴡qBP>>>/Annots 207 0 R>>endobj -679 0 obj<>stream +772 0 obj<>>>/Annots 207 0 R>>endobj +773 0 obj<>stream xXr}W*$H%勔J^Ve ȱ.f Zɿt HHI%2%ӧ菋KJ닛4:mtM˫e4+& cZglhyuIT,Li ?&y.5G;ܩN*y)e&f0 _&|FIJ]~frtw|*ܐCSϖ XI8K.߼.^Y̕D]R6Jx}zR&W\sd\DsZ.+6_F|kZ\JL]tߦJOF'IX~+hW}H/[}M1,:Ut ](Kh_8+ ]U&s+E 3o?n)7>}0ҥ%UmIiϣ0 &ĸWFQ @@ -1440,11 +1588,11 @@ _ KF2}2څpXQ4iRH}_qFQ|́#DxgMg{ 3VgA>tNb#|XU=FE0| o:p:>(LJ' W߿r?089q 2" 6r>>>/Annots 224 0 R>>endobj -682 0 obj<>stream +775 0 obj<>>>/Annots 224 0 R>>endobj +776 0 obj<>stream xXMo6WLE"-G/E7۠Ţ/Dj$QKRqroRWnE!gyO|R! # (O.g'>!͖`4YBݠ,nME=ңhfR&dC(}G R!Q$t=%Rٵw3J}/u@XD·f`v4ؼF! mM+UX2 @@ -1457,22 +1605,22 @@ $ W%uGHl#]>)L)ZEK7?X+H )IwpO"݈=xa ByC+xsU,sG.^矕h4^[?`'U9{QS+0-yJ&tpM^W*mک˚4nբ^ )_F¦UY*D1sX?b^x^Dc%d;.8<\!=gX^dѫL)jghbžPǼfZwȭ]Swhb*⴨$1 S"qshߠW™$2໅n[Ui hGp<` ݚ^^^u&qq֒C,o#7>Gw1,^_Cendstream endobj -683 0 obj +777 0 obj 1869 endobj -684 0 obj<>>>/Annots 229 0 R>>endobj -685 0 obj<>stream +778 0 obj<>>>/Annots 229 0 R>>endobj +779 0 obj<>stream xX]sۺ}>YH$ȹ/woLHbA+iɬ̝LٳhFSbNTGG'h6ew/.,iMSZ+Uu@q"T'mFTm&9iLIʕðfhJi6bU=m/BMZ*Xk|M3r;_d)\7Vnc^nrƭ' И_dg|=QwEml _Q\ηGG|5Qd"níD+uY֖SrÞQdFN!`@MgwU1hJÆMJ?Waz QUy{jƇ'vj:6&#QϣB>K"z{vŞ)ֺx$&o_HuτeZ=`lAjL#zz01 tDYd+Spm{HvЪ}u-iWZFrނ <˃3Ԙka O6L&4׾Lwt|}\>5%OA&XtgnQșfg/R\F@VRkɌ'FL#j5F+R9A~}վž&0U" ub٤_zI&p,D0 [x]djm[;Čcm"锝|Ml]u urqŒ~"Z/p4OƷ @*?ۅ]le#]ՂV9zc %{ FʋZ1%&PbLұǿ-0TNS-q|f@esc{ա:%< 7x3ܥ*vQJX:x6X E`jZbdXht_T!̔6El㥿@ /IxXalQETNNPG)D,I Op2"+o=؍EbPg.댮Q!}w@auɟyiOfᮏ !༇v>tu" Թͻ+ ;^?tL`qd!8i-<['B?>endstream endobj -686 0 obj +780 0 obj 2245 endobj -687 0 obj<>>>>>endobj -688 0 obj<>stream +781 0 obj<>>>>>endobj +782 0 obj<>stream xW]oH}ﯸ+mӤ!iJ(. }f13=RMƞ{܏oC:ϐ#:PZ/^^i8e锖'ǴL7ړӅ :`)5ySzP;[QãuTLϛ O^*!Zr7um]R1 '^93uתʨQln @@ -1487,11 +1635,11 @@ M \^H8joha]FvFr]nSw#˚H+y>c'20"*mW:ʖގ&Sil]u[pċ<$S*P\C) `tun€ LٵT-䝃Oի68+al C%G%+.LoLm[dE gp[<ݍ0Ϥ(=9Vœ\e`1,-{As@\ΈPpV- #Lcd1۳V{UVt:XE{-^ʺ" bs<=AUTnil5 |XqT(+<QPtn7E#&8ͅ.}3HuNA|~<wZRAg~iendstream endobj -689 0 obj +783 0 obj 1909 endobj -690 0 obj<>>>>>endobj -691 0 obj<>stream +784 0 obj<>>>>>endobj +785 0 obj<>stream xWo6!88N\`&i,nz(hH+Rq)ɶ}Eޏwt1vv ./iX F;)$|aw8ҧYL],r{4 ;dzowL' %tnȰ,P#INTkKk]"}/LX, %95Fg6 ` 9ЖlK6Ae Ma}d\Hi8 ]8 "[8:*L+ zE^WeE+Y |I[TsRga1եB|pƨc,A&r  #2$vU^2 LٵHZTBt3?rpi%hu")8Bߺ$2PLf Dbat7o=\©{"&^"x|]' -6YpGeb7KC.(׋QnKǧ,I]K_!з{px۩5ؠMZ|͓٣FzMى^BO5#=guqk 9"}UsNuүU}.VNrC.lxrÐ7ru;LU@\:nA)fn,B&a4f"LTQf5=\ cCTu8?i.v}5+#lתLV‡QC#Avi* C·69saZpץq!!DFsKԣH@0٫8k&Ofyц(TebYn3PIbɆ[rS1ʈ@WF2Vr<` <%]"#f;ND:hT|a'{%>t? G%K/߯>*R\sz+wcCbgKxڕ{|Wآ Mu5y"c?|,t qE?;7bx2 ~E {Ye \RNF:;pJ&f?fUZt&VR\Q@_<\y$Of;3WbkOﰄB @@ -1499,11 +1647,11 @@ x :zJcPegZ+ZEZT*AёblګV+TqI{Ǻu{W!->>>>>endobj -694 0 obj<>stream +787 0 obj<>>>>>endobj +788 0 obj<>stream xWO9_1’R?@9 T*gM\v6?ػfJY{~yfO=||@#J^2]ɘsK+)ɰz`}dp4><$=7^^ҳɧau}4rq1cZKZ/ʥ拴rNVrYz7svJjBS!!{t?M~e KSHR̤_K)7 ]B4TQ:O'lXn~fJ`97S h4؁@g{q26wL-J+8}D`z!!WVzkb]ژBN9A򀈡 l+ MQ38f S"O` @@ -1514,11 +1662,11 @@ u |ކ@c8dw ƶ΀[TZvi{[Ӄ2o 1zǷ}SЋ݇1rRkɰ玾q941WfKC51LCd>>>>>endobj -697 0 obj<>stream +790 0 obj<>>>>>endobj +791 0 obj<>stream xW]sF|ׯ *d}%%v:YRA*]⿿Y,HùKQt <:>z3?zNOi^+t2;99y~)/)ń>:[J{RNTVٚJS+͌KٖVI5)b脦fg|#6 " ǾUkʎjvdAK_?ZƇ -ZÅ@HξjY1*@{Mلwr6  t<|X<$"r C~݂Z)Z!uljGO2"}pДwӠwji:I|J;E7fm Ci7- -_H ~e۪V @@ -1527,11 +1675,11 @@ x +y^c.5: *_c`V%/P<[S?]rK7¥c($ߧtY5_?%e2E߁Z^CA\4m ubtcmB[Iؕ}b559Z簳_y˵2]tgN Q:C|N'׵-|]up"~~)]^̮OܲJ2IomB^AT$ O$ wg,['=^\v\7KbxnsD/8̻ѿ Kendstream endobj -698 0 obj +792 0 obj 1803 endobj -699 0 obj<>>>>>endobj -700 0 obj<>stream +793 0 obj<>>>>>endobj +794 0 obj<>stream xX]oH|h8Hopu3:C _uϐi%0 twuUu,h >+J듟'?_bA˜/]\2y2iN Min#֚4:uZӤ2ȕ eڥ\Hͫ^}j2\rDMd9o?ȍj[6RVk?,!>hr⥳K&W|cNHWNSMlR;U\wBATWIZ K!y(#'5HEBړ*0lG.-HḴͺgk$VlkV͞|n.]%PTj'il_2p `'eA'HDZ&7pN"䛂\gVr@q2-v%33vynP%)q&&UUfh^_<z_\~t{@7ԿIn2oe\u^\$sN o7]8b\X4Rq (1;=(9vnPeҐY 55fGit @@ -1545,11 +1693,11 @@ W FK*5wt+z@}IT2q-)a ozis;c3M5!O1a!F{le+(>-+'3`F&\Ĵaؕl|ZJ VR|ýo s_ @(Mm*``>>>>>endobj -703 0 obj<>stream +796 0 obj<>>>>>endobj +797 0 obj<>stream xW]O#G|W.$ƟHy\Bt}8BYJFI7$U̬7YZ>zW3[JiJ?7伩hmjrLU揅F/Qbb @@ -1562,11 +1710,11 @@ P  9"<:g s)e3&a>>>>>endobj -706 0 obj<>stream +799 0 obj<>>>>>endobj +800 0 obj<>stream xW]OH}Wܗ(+Q+"U'Slwf;&ZUhǽs?3:¿%`f32<98(EȭEIn-^TꭥyDɧMNa*FJ1JD˔%p!AU.TI%2ʨґ |zx~6.I 뗟Q%SAЍ.k]:sZnT"fLF4ݺ${䵮ޯ\~P(%gjI{XLE>1ݨ,(a ai8;&I:Z%kr/=\+^ 4lBM_i dUjLVS.GN!)ɥ0$BɷBӻlc,P_k\ZR/H2` S(B&F(D lR%*S\#F %j9.`Kn,ti'K, {F]8jȁ\?BU$iuH^/ϠiS;\TĨgb#v(qUVҫ+]Nb{cl ͒+֠H| @@ -1579,219 +1727,336 @@ $ YMS~B;>#V)|8g6:?Q$$endstream endobj -707 0 obj +801 0 obj 1722 endobj -708 0 obj<>>>>>endobj -709 0 obj<>stream +802 0 obj<>>>>>endobj +803 0 obj<>stream xmRn0gtHB7; CQ, ue1H{i<'+W)len+'u۠둋<ѩL.D;OnCQo$yx Cϫ S^B%CJ5#^tYu%+Xy͐d~g ;yvGBY*!t#@,fVz^endstream endobj -710 0 obj +804 0 obj 383 endobj -711 0 obj<>>>>>endobj -712 0 obj<>stream -xWMoFW zrP[dG{K8n =".%ŨM"͛ד\\V ZJR]\R,W7Nrvy'\Uv&ɌNuF7V>K9_\©|-OmpGn3tw~5-xv6ɛoj4ԵŊgFokge:|0I˚Q,k`+ƎdaR]#%% >U nv,aZLlm%s5,S|RĔ}Jҍ2==}wwckyTFMbiDjUzAZJ+l\Čw Hlq#!j ( [ 5h5!߁c(,])hL|靮̰Ҕ#B!95o? -.L\B{^kk(?rY)6[o[/u1'" #031F2"3CzlM a|Wj*7jŗP4o sM (" 2޿K1s`bt~Y,W 7nvWC_HIred ?7@SM1Y @f`M8ҹH{Isj`0=D6%!U1 ;ځ6tUo*F"4S) D -LHk =q`IlC:. >QRc6H O :}*#"F& 9So~-0x:HogWX`8@#OH߇7!PEv$@r`Q󠖤ee"e<9H2nY ><5k$&}r q41YNKF3n tƽuf.sOX9^L"hgVcG d?4<РPIw :*cՉB@:܋??(:.D -?>-c3qfq;)̦V+ sGCGzYv7Fc}lPዻefWfv&`_?uendstream -endobj -713 0 obj -1671 -endobj -714 0 obj<>>>>>endobj -715 0 obj<>stream -xWMs8Wtq3_n-, -ȶ%#}-K=Vį]isIIynw-V+ڥ%g'#%}~JJKJqv%Sʬi*"-JH8>Qk"ҢV*ߊ^ﾝ-bֈ ?Mi -D*QdJqSS -st-ɃT j>'4{N6zX^|Q:5-9BBLC /m00*:2Auz3񌔣X*1vZHrAx#Z&A؎kP506-!+Seer7$f{kk=GV QT [)%t v$6_r/ԉLަdyw>&^YsP) i_p𠒡p?z<Mt{rjVI&5Y@Pyj?2o -0%UUYТYDT"V;8 f."|IfŠ^LR̶+O򃆵 -؄7蘆Vi\g+ށ -!+}^ M@XTY ݫguO uqw| HNnmHf 4)p,֩6fTcۈrEp?~LvwŪǬT J -6 ܇Y5:Alɪ6!~Xק,("TR'>rbgxF+0 - Z0E?bˤ,60OOYC<`Rn$Qsќ ȵL9RN'K\mbUWXB<:MdmGG.$e{ -~EfI>uRXwNrwژ 8!-K~ye,hS)˘7HĤrxip~n*~9ӧh-o`Q+x“T -8HY3Xϐ~e&E2lZdVyh {)p$Sg9.Ww*hk6c#F#yo"W53w7>>>>>endobj -718 0 obj<>stream -xXMs6Wش%q캕2$]Md2QD`?߾}]όntyMy}qytfW, -...heW<'UkZhZw[|n^loopd?:}JbqJ'EVsFZnZ5;Ov*T͚]Rحgt66 /q6|C  -ەJy0:ݛK,4!k^uA5UYj^mr>#;[Om4LֽK V|M&-J!DPucseHH2FvCP:bԵ uJ1MGNIJm;eA -jZrXj|ӂs}ET߬Q_h~1V# Rmk<ָuvT]3v&hW*7"U{Nz]ڔ^ʥPh9ʱ/-cJ&eY;۵GÀ!TQvTpTlӲ/^"g_ Qb*mqMWˌ٦/k?Q_`DC$5Sr3 @kit;Z$BkˮeFϦ[ -yq)B/AeLdz.2kP[zi|fB|) VzN  -75v Pnz~DCAa^ c\:5\@GsgQ 9ۺe)Quaw8q:,ܡ;QZ MY&J~_mU@KV\mhn϶rv;"n.-8C27,$mE -GVPekwyx-kj0n[di3UֲC8@0kfI $,8kpJ2B:^gOI6!'yWSxï/KТ>E%IQK] 5`-ߨf-"5px0l2VTiGx'M(|-;<|9iܪfn؁JmU i{H9 j^h Y ([mZexưTsi\bIdͮo~w{~~9^k[g?jqusocMv/endstream -endobj -719 0 obj -1819 -endobj -720 0 obj<>>>/Annots 232 0 R>>endobj -721 0 obj<>stream -xWrG}+MJB @oV_br\viwمqR*_3}9}tވ,Ңrѻ|=ш+|3hp0is(w!PrcQl]N+k*eԾ0V~J*\V:7SpTliRUg)XbqhYt=хO[XƤʻ -MRwi M3 彁^mxYswjg.&nj!qGX@ذBS*#$U^X2`ĞX_uF[kB lmNBkRM+*%5K i")ehIUxT:ګC[y&13rp}6ݩsYɡ_S0Kj(:]20vFW퇯(y9m{".tHYB57XZǎʺΰZYqnXLcaa+*O[==TЛ6?:7T3Ph<{&W3CB%C,Zfr&g̎!鐽ca*EojӼS0剁 -jxoOU- ԼKE[QX ;i!j.ř*W ,48cCp< i*/jl|1֩wZc \j(E.RVJɶe*SA͊Ha" R ƒ+ˊ-Q(V^l?`s ,>pPN^8"Ɔ@

>>>/Annots 235 0 R>>endobj -724 0 obj<>stream -xXMs6WHD˒==t4i3n/$("JV ƹt2%xxvBu(++Y,dj-D|>M!Yg7҈[%ܺ-Kw;AmͶD$̉=F/|LPj-b]= JROa*1YTeʚFo;4;yZWūJaT A26G$L5bI*X[;]7SPCn >^Hc%F'do=ry?CGNSmײ@7hځneEݚڥv褫CBE$l[$J=$/j5*(@9y{|_?STKQ`z\>^H|qwXt㨷1vA|::~ ,LP dJKW Q `gAM 8N<{2z!lbhs߼{&Udr\=)ay߻c`sճI]7u*8vt4 \[bn`3[݀a.~q(B>uaD)LZ F *ᥢ$qWnZYAfTٌF@IX JкyBbF Uf9 ¨J;l0GtED>>>/Annots 248 0 R>>endobj -727 0 obj<>stream -xWnF}W (EA[ i"IZouQȕĄ\Ҏ~|rI!PDqw̜33E41Mgog&jEGÄQ< Tib턦9ݫћŴߴX`l. ]z 8 _zBdTS?{x^Fn ΀|TSĔ[511S ISkU~ D%{fYi6(7Y~E{RVZ平1(bz`xFxĜ>t9m([JW߽y'@Q*MЪb}Қ꽦Ba)tY:3%e[3 8:46[S۽Fbunu@okAL*6MMwJNZmrML)62mB -dBrg{emf>=E04E0L h6K4PNg7W/t=3#f -A#,䩛'aD2dC?>YBW4ok]m 5릩Ti*zݑE9WQ[dE-o,T0/b>g8A`Zv, ި,ޏz)JNF%HF=$ `#\g0\18n2LGjvᕾѕ*Uh0Di<&[a2\L!LEfU<@27h~ -{}Vڳ^?;?Z -/frzJ}kwt='?KIl3NMEaRX|Bm&(ڂp|?}aõ$QЂf,PN}|8G/O_aл.qHҥ30O9 Q~8~?{^uC#8&3є闇S瞔K_ .|M]r~G:2^Xn`Z[>҇F&l9Cהu 9KBeendstream -endobj -728 0 obj +805 0 obj<>>>/Annots 232 0 R>>endobj +806 0 obj<>stream +xWn8}W З˗.Pqn6[mhD IَA$s9sS?1M4$̗N?NlЧp]h:!4|a /?hЧ֯&SZ;$7[QV,zG&Awٞ"_ EetNz \\_zoG<4VVUIbo(ÍZ#)CU  +RCRIa%QE,*wW!9lUbIکjjSx' H1#N<P4ixhpOސJXPոpz~)W8>#$F4Ի))΢ADsÞz|1rG/ԅLr]%SV!⭄5LBҝ(P/}x[,3%r5asuup%|!S{[f"AΈ?s4zp +mzQZYF.9xfuDx4(TЃp˻սD^c1Ud !pnj,ym3̎s ls\V0?.g?^BjPh,4uy~ҏ9߈ĝz"2W'YP9|-vZTSuGK b晻ZIJN+Yt!;DШoSY}©nOv@D{R^&(0lK\Ո OG9a1spB< Dt땛Qh[)hngZ͉4#ӓ%KA]gkcɩ]M*Ы4  ^D,10<>>>>>endobj +809 0 obj<>stream +xWn8|W`6lv +,\My%f#H~!)[UvEĎs33v2!h6)dtQeH1~Lc%)p Q?pFZ>Ci^$g(fG}1գu))W:#,BiJv) +Y{z2h3>%Z!&ǫKA8 +j++rVDSp2w_1gRt9.ME>KB zreix'=iQJVjpmrN:am],߇L,Yi\QDHyeJs)}?NoY\Iİ&4#LJ=mL+6>_{;)pt= +k7הnM' ŶDG15 r2V2Q¢Ϥ+rD08z$# <"X^BC:L[i\ ㄾ<7N8iʳTw' Qyz-;mZ!&Fђ ʏ@Q:~+ ,f|H]b;4Swp(3gHAB/P]-b=#`H'89dl{Qw.!`k׿/ +@-"A|o |zl\|Lj@ֽt&5m!K@f>XPR#i!r3 ohM0O$5+1FL j֏n;8e,o~+P=F6v /ߒ + ¢NCA(*J&o`,?33|f4#(a=O*_1਴)3m:@bL;ٷ@14^{6lJR#M4\6 !1* t}r!]7]/&N&H} +d#Q{۔#9(k<uH/L +%F5zd.hvRLf2o qmO0Y2,^oN8|vypb%l2Z +<ľjؗ:.x{v@',2ak'Q)t0F qde)2#(EЗx=~_Dp|3q{c`uR"=ߝ +n +*X%^g\z'Y<+ 4i3C>,q9 |98Ɨ)K߳%xa(?(Ֆ8#>Nޞ\'WPTb$Z~qĦzt_kʥ#U&ymIp(ԁHlZ- xrv0L`/\gpJ +q8`v_/B@D'~Ï[9?y5! 9p5cߚ_y8?W;|s3l<8&7N=-I>W+hPwۘT4l(Nf9sp<1M5endstream +endobj +810 0 obj +1589 +endobj +811 0 obj<>>>>>endobj +812 0 obj<>stream +xTMo6WA:bS P3Eed `=#;Y#_9FOp19 Ǐ}ЍpL1v$Q);BtT1,"3* +}[á +}`wrZ':&fyk5Dnvܺ'o3=97%Y-6Ҕ!懬!lZ¨V +endstream +endobj +813 0 obj +812 +endobj +814 0 obj<>>>/Annots 245 0 R>>endobj +815 0 obj<>stream +xXMsWte*)7qڝtHPBL\F>Bd;1Ei1]'4bpKɌV9\]*Y4ti'Fg=7ڨjKϢ܈-f"ҝ_3$ ݥnTkSF ++#SuMl<.6>QZSkjmӇq*5-%LeҦFmSh0   wsQcD8Qw8f'ɖZX֣rUȈ[p0:ѸF-ǁvkh#J6ʐ3:Kuʺ*6yQ"ׁ UТz@JmImP.̙IaPj Bᔴc )c#sB9. +gg,vڈOiuhrE}H;TMa +Fڝ"Kx:/{X UOdsہ}eU6T2Ju9= f1KGM(xq;siWHᮤJqg%G7'TSOP\m(ֈ)`mU nmdIwY*eѳhulکt5 'G1qMB vpe)8K䮐If&Z~5):ƛ-Łj_I;Yy[0؀%j0 h=HgYNqZ{ӄ{e/V_N)-6zV"U>鶖?m =sDc7B,uEڢX<'ƙrˏ"|??Q-KE {5[S F&p `9Js1788W;n1C2o]?p28 ҏ$G)ge~h,=tГ7ӛ6`õ?w5icUVؘÃyr{leofw<~νAV9 YMftpK=NB0U?b&D舍nO%J9ϿL#MKpҝF1O >Bl!_kSE°j%ۀ +佰0j7b"{`-p,5 +΋%W͎)A -7.L,GN6;ZjחDA=nP=w +_Rh$OCT?Wd'ȫ.@w)^sJ~wTHH߅ނ}#]@k{210Đ(0]w 6HX2/g2 'ϐ1EnBȋɕAH}c-'i 4w`'V2Nb M}~$Lz +iL$f!%M zW8wDld]Guk@,J)EX+] tҘ7 !XdA +~{z4BR:?2]CЗ9S6. zT✀g\;~8P@b3xo35FJfeWq aD1# *ֵ6g3xW7"}z$mbzn21g.p?:_dq6 BePo^B噿`PUZ|y@7m4K5z:U6f:#)Aq'z'9^|uAC?=x b1/xuN݆;ᦫzn ~C˗9 {ՌHſ.endstream +endobj +816 0 obj +2086 +endobj +817 0 obj<>>>/Annots 254 0 R>>endobj +818 0 obj<>stream +xXasH_ѕJIH`Xg}g{}U 0jF&{=# Nv/ݯ{YH}4h08;uqyq&:k\)! 'c| Vnb {7C +CZh2Eiwbti2UvCQDN&[˜mB+ 2*+%}h~M)Q.wH$ҔF~Z|=S7wW̭JA}3\l$<RUn YMƖK]Yn孉Dn覉(ͽJ4kKET""#TE&Nr%R& EQ;|88 v^M)"7W ЖJ1˕%8Un;9NhU8<[CQAVI)&<&ˠ 9莑 nyFA{>h63F:OHYQ o*E)]n.9\NqzONTK\q!e+}O_΢0 +ty9DYd4O*+\^@@H^ZrsaxhWvIq Ҕl-~mP$ fxI^ ~n]J$,=0RD(NR9N_`R`JBr~.O]V=A ~0hP]n%\Ȓ%:\;Q2[i,>za~/dl1Tna*H 5MFKolt"Ӑy,q._b=HkbQsӪ)Zg +pN*'Jq/e!HƝ W$ ,D qcY9A(=f)ވ=R]14 8U0<&χ>n~+X8/HQX2!rqz_;׿O|pz?UK9쏹M8_q6;M?LM~NqG8Б INFL5E}˨oS :3suYԍDc\tܡ5P3CeTVPu{fc|l8:YQRb8C5_5;CxOK9DnFw$X`Alĝ#!~mө#e4Q8T:d (%6GOz9)គ O_lPh-mEcI`L .XU'l]ĕ2W)Rk#̢7rISsr@unq(mۇhOK9&U9 Zwb]`P5,|N#xsj9ҺhsI;*r}bMI9hčڝ)=H~yw_!->>>>>endobj +821 0 obj<>stream +xV]o8}W\R >3UyCĀg88Rf&_ߏsν{'B i4(<-:-:`>l1)^ p: +d$a;pO4nTCl. n1-h:SZ-n8&}Zm + t%hܖn3qeW.3^oNMc +*Zo8M M*"dO +VQ%Ĺpe):e*wjDaHS{/ov+3yDl{扼/ɡ ua 3K> +Q"ɲ!֪UrޟN7AL֣_1Xzf[A-K'H+GwohZF:T2.ZbȞZr#k%<vΨc5}62mj׹Lo-LXiQ11 +V95U6W"]lcfQ֨Trį*hymo]s_o|:ݻ|z/Fw:*xQjWcl^ӦCF{ endstream +endobj +822 0 obj +1030 +endobj +823 0 obj<>>>/Annots 269 0 R>>endobj +824 0 obj<>stream +xWMF+v+A[ć=v8^n!A@!31oZZq]2L3w@ѐF!Ż΋E3S:} 6SO#|M"?$#i@ +=fip/ `OOln +fzY|0Ao>{aNX/Tfdw+?Vҙ:!ͷTV:^S[4AXUȄ #zOUwbW~bUg"FacBU E™?:]Ē!LDPuDYay?GD=hX=JY0 odJ # ׋~o3 M7F{{?ͼu8a׾942[*7c)p髽pܨT"k%Ѓ,J˂xkd%<Jwh4Cr\aΡ_3Rdń7kEC/BM%ފl#-"M2qG;9.lWqvWz'2^jm1m6W'q>/\UebLȥ~BtDUhCX>+QЎĽǷy3:8מuȅ)W κx9`\ wqqbKGk'U^I&\ǀ@gW?@Vh4SB*x+`r׺iɌs˳J>>>/Annots 272 0 R>>endobj +827 0 obj<>stream +xW[s6~8>#ђ,Krfu[V_ % w٤&3(|?&4 -t;8q{j-tchJghFFRO&i`&ڦ}\6Ǵ">BZq 6E!2rrIV; +KH>řvH+(STYi.D>ɣ4CR՘F[MUINYWa68 +4FtziBȥ-E,AWYQκ/FW&C U|֒kn_CHyo?S_AXW%4l/g_ibuPJdU*|ooDoA>)]P2.ϚvcA Ia%Mit;~\F{N,4!ZjG=^. \غ].|܅GDPO>[ۑGL(`:gz'ީRcձ֕6Zք ni:1'hFƕQ;E:%hl@;iRy(m62N:d ۸q(]4B{z'ʀtڜ}o5k۠w=Jv'mxCTR8,UNQd ElΥX<@R 0FN@F ;x&Jגap#@PԒJ_]58.Im \0lt?f !'8T +eBp QW@CR j298rHBNW9ʢ-F䩔C)T<(O& i)==߬tr>:v owl²Å.2\u.sg5o,B]iMAS/l_?4 `k Kξ2fJ5fa%kk.(l) h1-uu?y^ +Q;It= O`k/1aOWV瓯(< +/ RAH%bbEhQke ޹x +n_>cYF2Vڿ%ew.Hf]wc1Èxi尶{aR~W|;l@^3Z +r ޙhVP4V9L88Wg534HNKoqϡ$Q}Gԉ!< 6ҿ޼EܣN|Q N0bTi@l/Tow9Nypۿe4etO}Pͯ+~C G",~قG'z>-0qendstream +endobj +828 0 obj +1781 +endobj +829 0 obj<>>>/Annots 275 0 R>>endobj +830 0 obj<>stream +xX]o}XH}@dK 4Mo"Ê\I\KFgvIJ4)n3sf§4?(]\=o2GzLrI+^gإ/ﱩO:iz:"D͋ŧ "Wٚ6"Q!sCs]fiLROda迿\Ȭ0 ZFzE1e!a7 +;y>ΟL! +3c4m1xUyPd1,ʈe"G. +;&T[ Ѹz^G^lRycVȵHJI@@3<qkkj#->;mDa?FrϧQJICFRP" tvNTl /w(bCBmv˨5zM)⧥WdZBN,>Qe.lJAl˂?5c[ +Q|H 7G6qv' +v]TQY)u5 +{sRy!r>I*>1J4t"S1> =ξ"ȾɥmR?>zwpevڅּ տp{IŶg$F).M*>\aJ5r? FIgYbf^K)m1ѯ;^ҩ ;y5hA{Ukx ?>|h ߺӅljp߰cY$PA@+j]"Hd1ot{"nnL4,oi:PaK~ij,SkEFht#Bſ~ƿSpvžt +Ee(1-Zq"w2hޘ.2zzt:WNmtVmq90=Rx[A*F,UnsW[9Iqʶh-0!z'1\C2 jCOgpXe؍j3N Km""юv + + {igΠoQɭ@5@{n }Wukq5⛡`l9]{4wD?iNc&]:@V@p1Xq_tֿCn\=٫74|ܾ`ON1,5Ca3wūhjN2hvh}?,endstream +endobj +831 0 obj +1836 +endobj +832 0 obj<>>>/Annots 278 0 R>>endobj +833 0 obj<>stream +xUY6~GeuX>&VEhDq%_a۵ |B!)x CT\F^;sC'%`&Q'Q:^/Ac(DZ DЫ^a~=J +"ʼwa@`D12Ub +A$zQB-%l+my:f)Onכg Im) ƂW=sFFj  B>UykVG)h#JڷРv +lo'G11(fj)وM58e WZ ۻZȺ.x^d.UfJ ӼO^(^<6G Y*o2aaĥrֳҝ{d>V+h㽒ma3B-:na1m#5u?C/'n} ~}j˭PSG% +jE16[-o,Oax۸@ ̵̑-R,s 1ch}^BCh'MTZ0!Or"?fJ݉^t /,e.eȭ"P26 r'#a!1 NK 0fæ%$gUd̈́Zn % EFq{䠟?-C]nb3A\}aXKevi3oIC[\]ktĮbwD1;BwcwZh!xc#==gY7<u.+c}ԟdž/T +:6F~X/NXendstream +endobj +834 0 obj +860 +endobj +835 0 obj<>>>>>endobj +836 0 obj<>stream +xWMoFW zrP[dGrzK08n =".%ŨM"͛ד\\V ZJR[\ܾť3YndO]|>OdF:eNk+M]~jɥ/aTT>-7vS _g xM&bCwZ5YqY4O?LR;f4ym.#/#iTI/+Od~c3j]7˪m;S;[jx\ KƔz&Tx)1eҩtc@LOpƝZUQ|k-Og7.X.P)SVx a8={ITQ3y(VmmLpi[h`ǽ*w&AViqŽM\ޯ%uB i +@ê4Ƚ'!>R%:7^*jfԨPr.D +8gy8kmBtUa@!$#<*3:C`չɋk(3&of k͡Wo^>M !0ftQȓuؑMMC@ҥujº0I +٢'B#NrЖ`(#eиRThfh@kBLСfM$EAWuZ΂z}}XIT"&$Q[zc$<5<5e!b;A$vBC @W5PԚvȐ1SծtL NfXSiHr g74 xRk&JrSRJyIqk5vv@ZA^Xc@7ҭ׺BCQ !&PB}rptqKHh7|dh$^v_&9_n0f1;,~ w7J;q?o/$[hTSM99@V:X/t-^D88 b) {hJmU |v >vd@r`U󠘤eu"w2fx$q7`s,&x#5N >Iႄ8 -%wڃOǺDR3¹'/F JKN`kbrŎ3:hFxa ` +r}PM*[FDD!ssxE^N"_NwFÚ1XٸLfSz9X ##=F,^`MS2~5ԧcz^"7,S^]3lk~խendstream +endobj +837 0 obj +1670 +endobj +838 0 obj<>>>>>endobj +839 0 obj<>stream +xWMsHWtT%_$hn-,1\ZX"͘Z3?IJ@Lw~uŜf5-).m.^6[|r}{CflFt+ E>|BE)a#9bQl#2\)OdGm,ZoŌ'9!m mu[\u"|2J:يuEuPis<圢%QטQ`/}Mf[{Q^\OW}&{mO8SCθ/3ҞM.HŒFEj~Q!u(ѻχ4< OiS ~vԠkⲴ?l2U+WIGc.Neک4nG{Skjg=GMz(pڱuڔ/ :-vWkx8UNTeclY%d]9י i_ppӡH?z&k`)>yG4k9`Az'hФ7 z?(h+oiyie>.s.W5}S/ZMNS?$e]!\p£!#a7uA´ngEOLxΨEly P 8=в@O2&q{bCEGb2J)N=jdSFL&Ac^a<\zJ`G& Tc%@:1DŽ>mb^lq_LRI&% %@~;Ij sDFHYV==q0m{T 2L /f/c6?}z|ν  9*"z :U6؝>>>>>endobj +842 0 obj<>stream +xXMs6Wش%439u+e["A1H0hU}%Jd~}'Ÿ NzFy}qqr&7(dv]eWWW&&fjMsުnZ|LՋ--G:zϩ*tNSXP >7TfK_INYkї@.&ٔu5.ن|IyZ[$a20P)FSP;DR±MT:[SQvov.35FSdc+jͧ0]mIT5v\V}!"Հ+CD5:kF2lqy3mS?iD8vNRJPnإ/s*TPKԚДR;E f|GY`IXٕSuة]܈TͲB9צdU.}DB9U} lS7)ٮD="K$9iAUMGŶ + =/u?y$ |pz*9$v7t̘mU F$;KR3)0xh-sg"1P|DuMGiZvl kȼZӱ-ׁ%{2mZsP[`ӌD#3*=uU-&8L +Nc+A†gtC~x/Ta*x3'eZ2;V; vjaXڵ1*H}c[8wd`YW`NhjSضxܹ.POiP +I1qCJf6FfTkAV̘1c ``e0p&0S}2(ۆuv5|ESa(gNnsayTqr1FXegD>LН(GVcwPW[W[mi݌K  [()[QCˊʑAKTaoY; )zc^ˢ(mLը,Q]~@͚;QXp+X !7tetL? nB,QP|/N _A.; +E/I}R3,\ZVJ YDk9hd +:x&Ozw1 #ձ_* QZx r|ӧqћžacG2UuV:o#利y"Td7t,1X .a˩Ӹ<ʚn ~~~9k[?kqs{u,N骛endstream +endobj +843 0 obj +1820 +endobj +844 0 obj<>>>/Annots 281 0 R>>endobj +845 0 obj<>stream +xWr6}W웕(ْMⶹ4Q&}L"! 6 ()Y߳ R4xrٳ'#gDӔW'/''4|ofS4L!ͳAa^==7TM ʜ+hi +M\WڗjڭUEBp*W5L*,ek=9+w_Ot>')8kМ 'Ki*<7vdo8h58t0pD?#UZs$H;w~_|`ʿwt\Er`@l s {tV{S/vSgŧ;@y]譲5Q\U52vgo6QaDbgJ"$̯Іq2l(e4D]ή'< ~ :l2W_'p(J.2^Kz?)\=8Y )oQi4mۋHpD0uU)7˥|/PdkZ++Mn72q^ iCJsװ 8<\*_S@nѽhDjC\앤{p,1ynF~ۥY9Wx\@KH)%.b(lٍz~)`{IJekduFlnA& J +'ЏZo@ʹyTv? //Klsme T%X +焱v?clPhŞ0wz`p/PkjA2[8dc>޾1@H UvZTQM|{1 # ,G=nKNMjin-eE'+&cb|4(:|``-׏ +ItmF<ztb~dLZ,@,5n@a m?8PS`!r -I)\ݎ=ssDl6 A:Kq?t2zҕ;@|^8j䓣,Xi}zs2Jg/t%Y2j~+sMSOwl}+/ͭ-=SC=a`%T:^20F6X퇯0X +y?u{".uȼY@7JWΰZٕqioXMcg!ڣ+$ejO[?=T>?8 P7XX3MQ h<}.חɈ! X˫-c9le3hԐ}|0i*@2Q <й27 jS"hs,؈v~qdM U]( +EA$BQ `8UX5  ^j;.4d ցN#HkNea0XfI̤8 +) E(k/ PX:MY88'/PZbbcIz q x=k^t+.2N=+pOS}L+a endstream +endobj +846 0 obj +1782 +endobj +847 0 obj<>>>/Annots 284 0 R>>endobj +848 0 obj<>stream +xXMs6WHH˒==t4i3n/$$"JV ƹt2%xxvY(s eRRP>Z^dL}sAij{'9#Rm$ +ehumތ$ʭ:WzbNOf'$ڲҳ.%}OCVٍ5V).p0i NT[- sb37rZQ1.tp~%Oa*S1Y25ʨ5 2wAivM]t*ƇfvS5ذ3ՈU&`9?ontLV.BW# źilcJxj#=ZeA>CE~Fn|]Knؠe+capD|v4zo(-:`k+Irc-^a2W5i%E]sT yI>^^H^8;^,d/8q]lP.ν3 |*cȃĒl793ؙ?{iS+SO߾̫^ !0hX1@Ŝ&7^F4=Ye;lGvJu"3 +n8DvulR@8>x}M(n[:ͦ30-,]`AzMHE췑S=?a75ź)"e m8ծ fLU^Fw3db=Q? y]*'88:"f tCp=q#v 1t0 -죗qq˕'w=rDtZ c & +"~Q6%nMN2s.PwEmر: g=wak33aqm w4$ Г1iGL䮞_š+* )1`OZ>k +鄫.DylpAX5nXr,q8Մ~S 'yy ^.GG6B˻f 0a!v2SkҘYL_(%Z)?;][pU3 +7ZK"t#¾;aU^$ ޝ<0.UۅGf~l͹Kb +E__Aendstream +endobj +849 0 obj +1989 +endobj +850 0 obj<>>>/Annots 297 0 R>>endobj +851 0 obj<>stream +xWnF}W (EA[ i"IZouQȕĄ\Ҏ~|rI!`H̙9s"_D˘ J7_g`Q18cZ`A-Nh:-MVbrZp TpPNeyBdTS?{x^Fn΀|TSĔ[܊8 B}ҔZ**d Q^ tRh<=&+oȦ}YJ[G7E2 +TZUlԱQ@WZST(vRR4.kUglKwsGSV5zk +}pέm-IЦTTNIISMI)٦RUm VHLh"\s//ZOa|zQ@ gYgF>}P{y#AN|ڱ3s~ZRv^Jp:T,o,2 ƬCebIsϞ5N D c;h(\4UC#GxW؊ioVÊD[;6EJyk@]1yW_;/il(O"onIYbqtv#N: "ͅ+`%5VW`;0| |KMf3Nme +1 vL#fП d#QxԶj6,umd]PwPH|8.\]e~۽JpFqGhX7KTPvg'WW/nuE3#f% [GXSP9ÈKɁREmE\Uy[umPCnSRE#.)sE\hk4V`ʆw4}Yև=0]K r\:粽lXr)ed LXڨ)B,m lMCO5 xi[tly$i&^]R%ʣqrXx)aQW&҈LEfi<@\7߾{[i/-9 +/f:|tch5XvΤC!")`omRe*RD;Msɽ_0~[wᑲ9yO2VcQ +f۶Qfe7tnkoK_lT7Yp~Ŕ{ ~zlr# trs7(SHzO_>?we^}/@}K$2Hޯ1ȟS^ ȸ١$H/ű85YV㘏e8od 5A͌U+GA @9_¿CCww.1#xJGU\'#S:BU?N?Ϛ%tExuȹG1'3є闏S枔KL |]]s~G$:2HD%|ێAkmyA=҇Fzl9CٔK&Тeendstream +endobj +852 0 obj 1521 endobj -729 0 obj<>>>/Annots 253 0 R>>endobj -730 0 obj<>stream -xVko6_qע[v C$Eŀ~%V"*I3sIv$@5`{9Qzd@ØbvԋS=/= M'xxhI L[/ގs;ǣh QGy@eNh@61R7ܣY"كuVγ2HmH`CY Dj_:8|26-E!yGQR 5}ڄ9,-23V ]44 -)+=d\JCɃ lJ~tMnw(˴b^ c)uB R=5Ru\+VZ P`_y^$Locv9pyo{N#xYX-Օ(8TJ*D42xEoڬ3 m-JԮl[d8DgAh(ZX`V> m -b@mלe t?9Con`񷝏6a]z\e U -J-S_DDLBd0`PgW|S[jܗB*hYξwѴ[;-E;X:WI]\GN?D@v2pEf BKC׵#k4A n^<88Dyfsendstream -endobj -731 0 obj -1277 -endobj -732 0 obj<>>>>>endobj -733 0 obj<>stream -xVmo6_qȌbɒ;.P Ŗ-چaY#6Tv0Gtܶzbڼ`ɢ̋[̤0J~Snyu6Xr.0~f>J9OV0S,6RRa#Ra*.3Ä9$  *R0  rsi2enf@ivO i"? @䒋{HdQ7@ wYb+1*)z\[{ -e2uƦ? -t&<6u&6|`%+|f=ј u\t/95s-igbf]yS}ɂ\řC.e f\{Ꙏq,|,lT*[`&mAv/Zij|KʷFuF*p#թw WB:hziV\pt1w6@XjuZrM؜t"=HcV c&jm+Ni} ~'aw1U " q/i2P;SIi2 8ы#.$Dq6s$QA*lTDd4{HU ^gAsPkz=x٬ %gѧ_iۡ汏q{olȾCˣCLUe!C>ᱛyvkiC}AZXI ܒxhVtivP=7ж>$H)t1M%w߼~bZL4t1_*-RQ%Aao3trG?Cٗax -Rd?VszeݵPEP,hPT -v~{%Bp,эCS)K)R>b'GV<~vfZ]v&ܡeerIռqRx5SQ#GL&Uet;$xIWuLDtp]MFx ~}+ķ?jDendstream -endobj -734 0 obj +853 0 obj<>>>/Annots 302 0 R>>endobj +854 0 obj<>stream +xVkoF_MXA$Jԃ ہ $NkA|9'6cRwdE6q@z iܧADq~~zr5= zx 'c< ZS֋#܎D0k #e} BGg4#ѧ4n{Mt%iH2RPdd2[Kن +)P:'Z +2+%ҘooN|M!gǓ>O9!'2clvH?1'le^fJZ\&xW.*le}O$!$c"b"x< iLF`Rs;RA 0S?z/ Q0҂ O/l&ܷ/(QH ׽n7} |l0WYЂbc\<ЦR"w_Gj]~4|R6-D.yGpm9FUB}jm9""5V ]DD +-KL.!AB~F֌lJ~tMnbug˼sg2&^8:Bi +JJ)Uag,U%4edj ļI:МθǼ=!\,:Q@wVhKUJ)D\NVKyL+YJd٦ +֢N*Iġp| +d'tϗlʰkK[kBqSTtF #ÎN]/c, +Dp"&!20K#[hܗ\*hYN_G}Ѓkh:zxk-| qStzGՃ-]u#xU'ES͋ʱ5!7q<88ne endstream +endobj +855 0 obj +1268 +endobj +856 0 obj<>>>>>endobj +857 0 obj<>stream +xVmo6_qHbɒ;)P Ŗ-چaY#6TFO9 Fuz!c:c <(Mϯ:EM3~9 Tee^b*Q2w;M2pSrIƊsK5kydUyb +_ ~pA Vp)`&>$!0cPi&s|,hsIA.8Xps6J۷{JH{%5!^`9%\C"W%j[IUIi^9amQB+֋7,+ЙV1`A<I].Dcfqѕ uOg& rlg*79s8g:u&aQJlxKڽha.)j_6Vkw 7:hiV\pt1s6@X$̊uMbr،t#=HcV c&9m#Ni} ~+a{2U " q/i4P?Wc抉Ii2sG9c6&Dq6s$QA*lTDd4{Hܖ ^gAsPkz lxڬs%g_i۩fq{l$ś/Ⱦ}ˣ}XUe!WS>zviC}A͇w{{-,$tnI<4,;x[h[Zc$&p}uǓounSz-&W^Q /~rS u ao1uln9#^ q!˰+~J2b_W32 Z(" x(f*wn[N}}l߉PŲ_k8qtTRɑU߅RI$wwYkrDŽmR;5_էo0{w{ryz7J~ ɤ*̘X?Oй? "@"]H4\WG^dD][jendstream +endobj +858 0 obj 1172 endobj -735 0 obj<>>>>>endobj -736 0 obj<>stream -xWko6_qؒďtm`caX蘵$w.Iɶgluד?ɐǔ'f'of'h:K.| 0ڧ^ d8;bg3!rjf 9F^Խ,P[,[Iz͞Oof^|2Y#~}WG6- -zvyY*)|gK^;l(j׋xT -h,X -A@95 h.6&" -ވ![W 'tA!`\*-!ч.\7"E<9kss\ReR!e"+Jhk-:Ux\$E֖k2^Gr(ޡXI"7\[pN/Bc-Hstw9@}9UlTdnbV˪ -`ډH+ `D`wVW&qa-$K_w=Jlh>ht1r!P{3Z?{X_.u'=O s.ݔ&I"y*lSDg8ʼ2*3|hlLb Υ̻#řǵ5VۣHĸ{=/j N5.ƙ(e-ye-uZ%싺p9 GmAXibd -M[A)NP -%w;3\D -rNw?4ù[&Z,sj-\aKE[dD;\6҂drGd@AKsZ*Bٮ;.,;B!gSzr C.<wO@dZ@VH)V]- GM3T&t iA)7T%[*mIvs'a$Z\fJ>gOu7U}i;%=g't -L9j5Kk̷fx ,Ǘh3ݫkhuINV9no0f{!~n|-rg~?7_Ncendstream -endobj -737 0 obj -1384 -endobj -738 0 obj<>>>>>endobj -739 0 obj<>stream -xX]o6}ϯIlg@vExDIl$R%;lq[q({8̗)MoJ)OެN~[Lv[˄ΗX.NYI9^l,9-10,Ʒ4*rA,Ohn7}Tt m}ƚFڪ;δQUEr$/%*ţ$3VT)+SoY9[Z(M-_VO&t6=G0l$*+EtR{2GS i)t!oKSBG^M%< *vσ.pVQZ -P$Ft;OUy^5CK#Lj V_9EQ:reOr&x]¾ռ;Bc1kޡWH{$j:ŘN &EkN)ݑ2ۉaQܷ̍P -g-!C`g`bDɖ -%oD ʓ3S.[kG/@KqY!]C蟯}' 6 -!229A-.Ȣ̴JxX7>!]P6ABNxG=;4=Pgi2F^%~Ds/],Xӎ5N ^#b8]vQpneɇMaRxH*~9x/eՉy[{sBT1P[708C< --jHߕn+n%)2ŗ-Jja o0!~ J!a1}H zsVX>%O[r8rzaFnҰaAကXE0!* CfvG@U_Kpx(q5$p ǛTcpGp(י.+099lag(WMP9l{ T 5:C-2cU!W# \9 s#M"s{5km"NJ\gA',Pj 'Sg -r46tR}$CbN5g֑N|Mm/20[(9n"x} !{p`ĽU!\~J"\v!)зU * =kF|ˀK6ľ?.Hcq'tHo]o޿|՛ޙQL!&f,:F ͧs8_%>endstream -endobj -740 0 obj +859 0 obj<>>>>>endobj +860 0 obj<>stream +xWko6_qؒďtm`caXX$:w.IɲgluIDCG4df;|h\l-iCxE45&Q0ۛG{)S@zH/hD5O!ueb2"9= Bvϗ^y/:꧛o.O?}zdҠg_VUY%jlIF4%o/+w[Z,"9Vy f@ރQ/Y9+s,)|:TM0;O ZF]29h1nSmJK*Wܫi{j*!Q$ݍm[)2W!)6*-ʾMͬT%$RQBة8ߺsWBXKM\2_`keJ^O][a*?`VW1ҩE"G{.cE88ezW'n3VXIH$u(0HZhP[<ҥGD[QXPd20=,*e2U-&>܀8"A<:swl2ͤBʄ/EV ?璉IOL7Xb-i!u1lNsB-{2P`gM%q)H(܁0g~n-ە#lJ*Jo6-WLN9j]@ ?p;Viy$,L|bШJ2,AxgGI1JhA3yT~Z~z%0*Mi?'aI{&ut x-`U[#Jw P}; Թyt y0Kaxյp{7ֵn;'ⷢ̿m~X\nD(5Dq'nIk&h-,*a^5`4u J7#-+07I:qBkKב{`Oq*;ӻ}j2s 6#7Lt'̪䃅Z{.]AHbrJ"K)Ay(-ͭ"c ܷg +Yb`gXDtmV=Ɂo a4Zl^8:t + Ӻwoѱthqo=C~BAHNJ:(RW1Kߜ;@,[ #Ѫ&Cj^Cs'=oҵJZ{Ύ%rhj5?Lkwzh2Q0r}+_ިa+wMt:I߀h;%_E+< }!{_Pc]뗓mqendstream +endobj +861 0 obj +1385 +endobj +862 0 obj<>>>>>endobj +863 0 obj<>stream +xX]o6}ϯIlg@vExDIl$R%;lq){8̗)M3Ō'oV'N&rI7[ÄΗ~\}:Jfd%xxBe K紘ϰð 74V9 ϗ Zea}Bttk,!'J#ohc54V)u*3!|)-Q)%)GLYzcq8Bija|29Ye#QY)椓ړ?ҞNHK -Mz yY7X3$Z=`_hr&!ZLд$SU4:n˟VMR}!ywbrS{C_H;4u1ǯsL}3S#e)o;4أ쩹o ۙ +5ZBκQlł퉒-<[Kp߈XV?'g\^QiYWqwC< +xK?_N2$r;mԣ#qCVedrZ0]Eiו<n|}Crl…hzv;hM{XdF⋄~F/]XԎEN ^#dx]vQne͇OaRxH*!9z&0eىy[{tB1[ 709ƛx[/(Ԑ+~%3jS/M[ ! +< C6Cw`c0]a/!<{A,{|Jyom,p +"nf7aaî<*79j"qiBT4Y[K.h]Kpxըq54p ǛTcpGp(י.K0"*$|ѯʀ.gQ)I->sy.l kZd(Ȫ%ɗ5B8'G&sAxG$R>j5ErRaMDꝔtOXԢ+NXж,hemhQG叇HIŜB k6&U=$7ToU: 'zH׌6»!m}\.vO|?py߻߼sC73i[BLYuӋ2- qL?endstream +endobj +864 0 obj 1577 endobj -741 0 obj<>>>>>endobj -742 0 obj<>stream -xmRn0+*94r -+C%aߥe EPe% -~J4+֐cvfPVh|RP((ʛ`|j߸BYU7mOyFBlz'܉p w֒ä@ḊUq 0*X*ٓ"𠭖z{ ы3+;b 8kE$Fmun&cs;yʎByD\Hp=vD?*ʋ%Ʀ5j}Hܬ1t ohĻ`Y0&~Icqf:QW:qx}ͬ<a`ɀ/VƑCl%M_Ψ ߥ*_\*kW/endstream -endobj -743 0 obj -398 -endobj -744 0 obj<>>>/Annots 262 0 R>>endobj -745 0 obj<>stream -xW]oF}ϯ%6J*.jvVel=奿mHPDbםs=h@}hj~t3? ? - F1IK^Al>͗|>}Bkwa`)T/"Pyg.e -_&`6>uMР#@J,yVWLuZ!oyzZmRz2rۤxqr<')%Mzcd'uA 5Ox7")Ve_"΃tWd>CͯyL/ >Se0 -X2c RWo m2ct)p<:Y0ŹPpF~+s)d(S~1Sg\!T%˺0h%)-R*ɴKqꬣ6Y;a?耨3Gߥ -vf2GFjnF"mΤf4Lf((61Y Sj<viGG DOF;Ds  pj:a}m#cUίHVTUԡg*i 3{ )qT{+` k,YiP` QhrP8r b!dYH)A ($ #œY9΃_{YIR&[}>̚XZ} ć}tٟn`@ҹ^mp0lƓXWF\5zr-pEU -^99b|9{?oI eEDĠ(`ɪ usٽIG?r!rl\yqm\VHA bQ̓ڋlVI /q,1ꥣ -7QҚ -Ld>Š.XP4?5־uZcd|EE* u kS!| -x֢>[ Oyԁm<{u;M0Zx`$ ok"\0uPB hk])XUbL,M۾;H3fWƘI%:U#~nc>]p6]=DM)vVx09{ K `mߝ={gIK */028-z]H:v:VI^(󇛨gbŹoXOQ 0I[.Fh&Cgs>̛oX/$E ")86 -@4J3c_{-O<M5Yy`]W>}/*| /endstream -endobj -746 0 obj -1596 -endobj -747 0 obj<>>>/Annots 265 0 R>>endobj -748 0 obj<>stream -xVao6_q'phq$H3$, 0eDUK{Qrb;!![ݻwMt4$\ŝ)E#3! 'h "q$R -XGj -4K_>i[|yCXAS)IGM3h,N - ڿQ5~1׶ԒiLod+@Z} O.l]%*r:Qai&$|epvEu)84pbNt|$&4ŀr5曡S%MdA4WQ| ɒU-KK˳~?5b '') -nW})>7Qv"bҤ[ic.S* {20#=z6lp$Ɠ4R(}%ƊeeFGFimY)V 2jT!V{J<"CLi% P>HoT( nL6S4gt2AGl_ע @`7PE@F`$4HX -2ʠ Fgڽ֕=J*[r4ypsʒLzh;[Ymb͝Ec^fQL/MpΓ *eX -J)1sJ/t! <7znBW fcY`ͭWyŃ{&`w) 4/zD2Mns" ^ :4G 7rY[f=|43l,Ls6:"WDgqnO"pbOv :gڒVlvنs ηH/y4.zB}[ or6}8`@['yP4 ()s`{qv>>>>>endobj +866 0 obj<>stream +xmRn0+*9z*+C%aeEd% +~J4+Րcvf~FY=IBȋ@+o2orи@蝍]_B{;1Zpt!vx*F%._%Rq:9{rZYob>>>/Annots 311 0 R>>endobj +869 0 obj<>stream +xW]oF}ϯ%6J*..Jg3㰼ܱ jSM${{9Gw@㈆GWQ?LhaVxhD4hHZ + bi S?7ZNl,<ч#^;k{C>r` ϖ7^k |J)%Z-UfaD_)Z+%GЋ#D<(O:%Dx#^qQtv lF O9vDA}Th̥$ɭ3K+i]S,R)wpڹ]&pS݃w@JX:L% r9Z]pqx&ca;%jvoE d{%+ +lqb! +M +P?W "5Q ?+4%!9xax{8K2ѹk?eulID_&>V/a3]8|!PEtW) ۿ$U*ĶWMި\ CQUWN;|}?f.eq}mFƥ@B@<1⫫:.Xjgk7Gtvopx W^vWw!RЂظr -1@{FK.Kz= (iMo{&2bg,(Ek:1a|[2>"W)]hh1fR |cgۘOܱ `guD?QeS +]šUfD޳G>RXw蛳Ӵx =c DFE2 QnW*ɫe~Ѽ6L,_W69p 1a4pKtm5dly A_$eF!&#Tif}}kgz)񐿦/+lʹOKFʦCOd> $endstream +endobj +870 0 obj +1597 +endobj +871 0 obj<>>>/Annots 314 0 R>>endobj +872 0 obj<>stream +xVao6_q'phKq$H3$, 0mDUK{Qrb;!![ݻwc:QwN!%s! (8tY)KOY#ijhT}cOr_VPTFґ|| 0dF¿EMxo9֔Yt7Il\k`2tޅTUeWNU=*,Me> Ү.'$.6TL?=ډĘFH (Q107 M2,Ql* U^J.i^ٜui}y鱗FtD$EaߍR|1f7JQQZt+m EjLea?1 3ңmxY +EoںXѴ̨( -+bA[*dފc/}UGd)b?G[SM +E ɦqt|r OhUxZCA ʣd)}U+3ZWFs/ȼvu|Ja\i*A?%>gpby&A,ΖkVEĤƄXsg<أY˿C|+JYzgR +d\ ]H9M^[a=$z6YXXskU<1k޴ ]!Imk="e 7PHm1^ :4Gśh,-Կ_ 6 6{ natȕ*sݸ{7f'z8'HՆ_[3U{ m `6b FYl9 zK[$ӭ?Ƿy{9<|$b^?0y-哂Ќ<(P,K̙Wݟ¬[fׁ b^hܪ"=VzVƳ{y}h |6 LOad|ڴ>()s`{qv>>>/Annots 272 0 R>>endobj -751 0 obj<>stream -xWQo6~8)P˶NuK[hm0/4E٬%R#)kТhmYGwwwg4)hd9m=P:u73&)~w -lۏ{Fє/Z/>Ï|x>KR~p;j5:tɆ)SUJe CjHv֔ʄyb5vE9Ol*`g6 SrΊ[',u1ap} 7N\I""C -̭0`9ȰSH"(N—qbh>dFW4RIt,S<ΟT|gV֌*Ỡf:w ypMF"Pi$nK3oOx9gtItӺ[=h u;$6]> *~Df;8IXW渋dۉ9)TrfM1}-Ȳj:2Ksg8PlY4.FUj|ZQ! `zSIST02*UٌA 4_,E /^ci28CӉ[qȭ5,bp~PWTY1]WϰiDQO@iLLbl?Ӌa*F:4vtByh>L9p"gz{FKl,Jvm`] ui ԹO+gѩbV@K\`B-Ql]L%B[,MnQ-_#1%8;Ĉ":`Jm1l>Vp_N-{g*0t셓Uw˘/!cR)Lj?endstream -endobj -752 0 obj -1479 -endobj -753 0 obj<>>>/Annots 275 0 R>>endobj -754 0 obj<>stream -xTMo@W>>>/Annots 321 0 R>>endobj +875 0 obj<>stream +xWQo6~8)P˖NuK[hm0/4E٬%R#)kТhmYGwwwgRZh~MMnh6u73&)~w +Q:OLJGUJ=݋r#IEfhJ/Z/ߞG}مxBLIWX-Sq=7].i q6X:gg|[Rȝ6і\mZǮzS,C<:Xwܺ5Qh`1_]%^lE(, }E3ĸ !P 74!C8zЇQuWi+{g}PŏўN6DauFmmuъR|B>uP@gd07lh8VLtVrs?a jPG=59h D͖mW6~DvPS\߷!( +p/W~B9vƒ`]_'4OooIlt|6ˡ@>Kr^?֭۟FVnW'g&Y@ӠjG$`3j$u%jHC[} Be-whvق,_(>wցEB NkT^)ƧLuߘ;@4UN +.R͸tyL8Rt*@jB +Ϻ5ƞQl)x\}:q+Z# Š,W )yE3n{ +I d8PFO$V30;9xkF~b/CoGQ*Ô'bNo>|7Mmۉ6a Q1@['@tLhPr+h.R%T"4=[Q3H(V -wnj?Źoi`BP-kQp}+ǚ[qUtq#ԿU;?9|i:2#r+.Wdafvc| +[1zVXI @&#hz܃S^hp^N}:1NfTzlV+1]z%9ESNOVn}lm. x.rwsN^8[u91bȺX.p<&r;3endstream +endobj +876 0 obj +1481 +endobj +877 0 obj<>>>/Annots 324 0 R>>endobj +878 0 obj<>stream +xTMo@W>>>/Annots 321 0 R>>endobj -757 0 obj<>stream +880 0 obj<>>>/Annots 370 0 R>>endobj +881 0 obj<>stream x͜[s+-p8%K6*_6+m945󢐔7shrʛrUF 4 gmm擦5ݣl&imfisyՌG1~rn;4a//@(մO4khB+|ٚN$'ŮY,GN~>$5 vM;&V;neL'hGY24 z ut`2sɫOKzUfb]?Z*^Z?\U>~61C1vDVTɊlO8h] b&mO)I>la4 n>>>/Annots 366 0 R>>endobj -760 0 obj<>stream +883 0 obj<>>>/Annots 415 0 R>>endobj +884 0 obj<>stream x͜oo[DZSEs(;u;n\(h؊JR3s4v,&@Qیo̻5G_=ٲۦ.Gm3Of<Vomd;w諳GRAk5?gq3,m3GS{n^ eųIӶњdb9<;i&>gGt}fumҎ`ųu:Q{>n"ve2-Lts?Xq- ѶihVևxwZ`'%\!ܜB2@ ]Mb h$|]ߕ8B< aElHn]Ȥp_86'W7E1e7ɓx ,~*Aa3%CmaR*g~]N!쭝2%(ln$c;QRX* @i=&JQփx/QE262!X#eQ#Ľ(U4c2fI)'#d_vAtߎV)\|='53qrجN^3vx\Zd!Wtdi&\ d<ؒ]r1a&.c/ o:T,N?WL/Is>FO 5^e נ)?1`JiJئ%0d_8Bn˒Aq3@^#}"FՖΤT~C6B#l$A ;k ;>ԥoa%ӟكֻY#\Ԙ8߼xߟ|o׼i%Z5cF@6kKpzbؘIdR/SzD?8d}"F_I@x?GFXIGaV丹NXOBd)'ffL!qIqBea⿒_>n0koK|׵?l7qGendstream endobj -761 0 obj +885 0 obj 5223 endobj -762 0 obj<>>>/Annots 396 0 R>>endobj -763 0 obj<>stream -x͛Ms6OWպK|abɿ'JR׻'IUMR~鿻M^*4 ]_&~CK &)3 lv>+c~o: jYma<}@HU38\uFm,-Hl(p"ucf!%u w06ZTj@hYcࡆ hi6 w0TQL3aW0)gR+6yGh]WO -5O0c0\*I̶a\ܫ(*xj,\-ErOJ&a7\W~ؒ.gd$cV<)>mܘMJQu&0dNDSK"'Sp p_wnDI#e[!^61zlk<aJ-cv+Bs,אeގd)lrpq®ByP4]yZpS((NZE`H %$t0a_Yyxj$!]Cx^Eˇ0|R.%?@^ݰnbK)LZT һn3!} Ϫ>FFm: aB:_ho4M,k<X-&-H) 2,7lBDӫl%".]) &tp'[AfeR]Eݛ5KbqY"X& *B~YooяGBҌ %N -,xscZ*N4MḃŽ^l[A㍜ &kodA[ MMy_e`5Ga!%T!j[8wI (ac,p't`;X!D@` T`gBǯ98M5W33%Xp  t+M$(/G!u\2Fs=8>.}`,:fo\CXtNUc^S`K?%Wg'+`) -x M X@=܈Q8}cGin-o>)Z:Y#L 6QSs>uT P[Ŭŭɋ(()MVsb:Ri4!LSQʚl\E!' &xLn=}s) -?#YPR%TSBy{te5bdRJ5SJ*X.z0s ܙ{Jk^O49"t8-T(7\Z K:HM"M]s-Ƒ9jUN``;90n!8|}ls 2 Ac&sK8_H"uj(- BiyDM%߈Kr -/b  -)Kī_}Aa 1TCEXht͙Ƙ!FoqyF TWE[DQ3Rs_-cPCS.F%~{ٱ2# JҎ9o/_+ET: hS5rRn -@@*fºF)C7&,CM\nтlhPM6I5DiA ֥!qpi>mH bXICh1MEDed>hZ—Q ġH $9 9!1s0B42dܞ"HKIaH(FH;aLjBJCzR89~|8 !ƌŠc,J%8UEO ,wq(R>,AQN!ѾR?e !D@p= ``UUS* F2Nu Lݸm+|osT0j.&N(hCJ p[12 YiR(?ä\av $RMt(1&cZ)vKiv>endobj -766 0 obj<>endobj -767 0 obj<>endobj -768 0 obj<>endobj -769 0 obj<>endobj -770 0 obj<>endobj -771 0 obj<>endobj -772 0 obj<>endobj -773 0 obj<>endobj -774 0 obj<>endobj -775 0 obj<>endobj -776 0 obj<>endobj -777 0 obj<>endobj -778 0 obj<>endobj -779 0 obj<>endobj -780 0 obj<>endobj -781 0 obj<>endobj -782 0 obj<>endobj -783 0 obj<>endobj -784 0 obj<>endobj -785 0 obj<>endobj -786 0 obj<>endobj -787 0 obj<>endobj -788 0 obj<>endobj -789 0 obj<>endobj -790 0 obj<>endobj -791 0 obj<>endobj -792 0 obj<>endobj -793 0 obj<>endobj -794 0 obj<>endobj -795 0 obj<>endobj -796 0 obj<>endobj -797 0 obj<>endobj -798 0 obj<>endobj -799 0 obj<>endobj -800 0 obj<>endobj -801 0 obj<>endobj -802 0 obj<>endobj -803 0 obj<>endobj -804 0 obj<>endobj -805 0 obj<>endobj -806 0 obj<>endobj -807 0 obj<>endobj -808 0 obj<>endobj -809 0 obj<>endobj -810 0 obj<>endobj -811 0 obj<>endobj -812 0 obj<>endobj -813 0 obj<>endobj -814 0 obj<>endobj -815 0 obj<>endobj -816 0 obj<>endobj -817 0 obj<>endobj -818 0 obj<>endobj -819 0 obj<>endobj -820 0 obj<>endobj -821 0 obj<>endobj -822 0 obj<>endobj -823 0 obj<>endobj -824 0 obj<>endobj -825 0 obj<>endobj -826 0 obj<>endobj -827 0 obj<>endobj -828 0 obj<>endobj -829 0 obj<>endobj -830 0 obj<>endobj -831 0 obj<>endobj -832 0 obj<>endobj -833 0 obj<>endobj -834 0 obj<>endobj -835 0 obj<>endobj -836 0 obj<>endobj -837 0 obj<>endobj -838 0 obj<>endobj -839 0 obj<>endobj -840 0 obj<>endobj -841 0 obj<>endobj -842 0 obj<>endobj -843 0 obj<>endobj -844 0 obj<>endobj -845 0 obj<>endobj -846 0 obj<>endobj -847 0 obj<>endobj -848 0 obj<>endobj -849 0 obj<>endobj -850 0 obj<>endobj -851 0 obj<>endobj -852 0 obj<>endobj -853 0 obj<>endobj -854 0 obj<>endobj -855 0 obj<>endobj -856 0 obj<>endobj -857 0 obj<>endobj -858 0 obj<>endobj -859 0 obj<>endobj -860 0 obj<>endobj -861 0 obj<>endobj -862 0 obj<>endobj -863 0 obj<>endobj -864 0 obj<>endobj -865 0 obj<>endobj -866 0 obj<>endobj -867 0 obj<>endobj -868 0 obj<>endobj -869 0 obj<>endobj -870 0 obj<>endobj -871 0 obj<>endobj -872 0 obj<>endobj -873 0 obj<>endobj -874 0 obj<>endobj -875 0 obj<>endobj -876 0 obj<>endobj -877 0 obj<>endobj -878 0 obj<>endobj -879 0 obj<>endobj -880 0 obj<>endobj -881 0 obj<>endobj -882 0 obj<>endobj -883 0 obj<>endobj -884 0 obj<>endobj -885 0 obj<>1<>4<>]>>>>endobj +886 0 obj<>>>/Annots 461 0 R>>endobj +887 0 obj<>stream +x͜_s[)Vgyyy/ɧ"ǭgصqBS[QHN} BNөe8?X'hl2jj۫'^,FgͨMGWףx]=Z ~wv7Wxj__FtߎB6KWp3z5|2t>>vyw#0mGijcC,ΒlvۖbCb;/:+N~'5 lnձةILmfV˝a;!XFh\nfj;LgmVp ~ScX +PWVpr_h;@\٧_7SWk{qc|nug}P7~bNԣ-FPq"ᛱ8N*J0_iHvc5XәoVaozwt#' dvNZr@XMaUߌ% .W9wb5534']EXf' 8!`$d҈+PnEy' 0 +Q i@軪BE](JjI\aBt8:D+TG6@.vO;炪>`EY4c-@ez&\}/Ih׿L=N +M3!/cY$+GӄT3H6olDK87 v(\o$|"8Ga΋mĩ/<c-`tlTB\1AA~LnH`{BqdAR8*xDeր0 ې*xa۬WK~*dHZx~' &s8ah8n-yIZZ>CJHZOvk*XjLL֬ێZ,]RaQ-5[%V,$bQN- o2gmC%qL I"]Tc=L|}Vo`1%^]xȣRxr%Ij J=q洿Gkbfj&+8%&@`z'%Ԍ=_I*@LUe,up"MYg&1Y$,I#ӫS&hg\rRepBJ<Dr95g\lQ7ݦ.bi!L:;G]Y#y+ +Mu V:l +v +0=ݰ3at -I`B9xC g14Μ.a ȜnnŠd hPӧaΊИ +ؾ=aT|v45.H Ř@6E8+}hPЌ;/b446GH/[V_/8+ !! %lͰŝ0Pd3U`;2"rCIDʙَLf,ECY3.fS`CJtC81$sYYVi>?6j>:Ǽ +Us*! RQ:|prۂݰZ/7e,,;KI`YN T:Tn֙$!:OsK +v#8uLXT~d-~]np7Q*x_Ȑ-H/<;l )őpCqJ|H:ҶE+xFރF|HPO`/󢱏;?a#)6<ႪvA*\=`{1B=bI,ƙYWm%&us;=N,g`eu &h4F}+~հ|rrԩ z*|?m{k &ScPn\[]kRy5=Vx"rnkh%Đg +ӏ/A2Ih?A@A,妤 +ia9*ˊ$bf"~lun`)C;>Ph`ZTvoe 4W -!t}M;[ap,I+Yg$tȲeݩA` 3q +W5F*\ A:]O/B`B`[t0>ٽҏߏ\R Wp@Prmz~X}>gXs"TͰӵA k͔R,b|Q:K <Snc,#&Ѕ+PU!~\nHc8mXYz,gMj3V:q֧+@.9@iυEGա7!녧&D9ž8K1o=qNr# @\<\.} +lC>5 h8lѓ/q h}|/%3sii5p}#(q +f8oG"|ZqW+Am`[WT$,0Շ-'ᝥMx=bX#eHlSxz쳰_$%|ϸkqnvTw댆!oC8 +B|#_B-[~w%v*\ ڰ)N&\4 KŸ'JݱL+"I5+\ Qc1JW!o7u;ڮSpq747:jrWf! +΄Ԋz>Żla~3Y:jI&><.eO_|xAMp  /aa>,­#Tz1zpk +#߯rv>̑wUџfz{pDendstream +endobj +888 0 obj +5057 +endobj +889 0 obj<>>>/Annots 468 0 R>>endobj +890 0 obj<>stream +xŖMs0{,}X8@Lx9ݒN~>eiIJ}wW(Uk0Upu +ZBvʦBA 6ʶ{XՇ<7c> h@7 +=}@o +S T"u'<k Jhgq26G[6&c +l")ʈYTmv uk=߲ہah1y^#!$ !6j ̦Bba=B?cS!(M!n`Fg88ǝp$  V`dŕxO"]5V$ȑĿe]bE88D.Y Xgڦ.Ny(1Ry7OZc ~nom5zG{q$sf ! 7!8QjK2}L[Fؖ2jpTqu@*sU)*\`z*Jә,/VIRΈ=cxr0+;8agV\2c`L=vUH _^>+4w$6s& K2d@0P9owƀ2ddL3swjzr:61N͡(S\iDт/%TbIY~^~,v8Ì6fq?/_? [4Rendstream +endobj +891 0 obj +699 +endobj +892 0 obj<>endobj +893 0 obj<>endobj +894 0 obj<>endobj +895 0 obj<>endobj +896 0 obj<>endobj +897 0 obj<>endobj +898 0 obj<>endobj +899 0 obj<>endobj +900 0 obj<>endobj +901 0 obj<>endobj +902 0 obj<>endobj +903 0 obj<>endobj +904 0 obj<>endobj +905 0 obj<>endobj +906 0 obj<>endobj +907 0 obj<>endobj +908 0 obj<>endobj +909 0 obj<>endobj +910 0 obj<>endobj +911 0 obj<>endobj +912 0 obj<>endobj +913 0 obj<>endobj +914 0 obj<>endobj +915 0 obj<>endobj +916 0 obj<>endobj +917 0 obj<>endobj +918 0 obj<>endobj +919 0 obj<>endobj +920 0 obj<>endobj +921 0 obj<>endobj +922 0 obj<>endobj +923 0 obj<>endobj +924 0 obj<>endobj +925 0 obj<>endobj +926 0 obj<>endobj +927 0 obj<>endobj +928 0 obj<>endobj +929 0 obj<>endobj +930 0 obj<>endobj +931 0 obj<>endobj +932 0 obj<>endobj +933 0 obj<>endobj +934 0 obj<>endobj +935 0 obj<>endobj +936 0 obj<>endobj +937 0 obj<>endobj +938 0 obj<>endobj +939 0 obj<>endobj +940 0 obj<>endobj +941 0 obj<>endobj +942 0 obj<>endobj +943 0 obj<>endobj +944 0 obj<>endobj +945 0 obj<>endobj +946 0 obj<>endobj +947 0 obj<>endobj +948 0 obj<>endobj +949 0 obj<>endobj +950 0 obj<>endobj +951 0 obj<>endobj +952 0 obj<>endobj +953 0 obj<>endobj +954 0 obj<>endobj +955 0 obj<>endobj +956 0 obj<>endobj +957 0 obj<>endobj +958 0 obj<>endobj +959 0 obj<>endobj +960 0 obj<>endobj +961 0 obj<>endobj +962 0 obj<>endobj +963 0 obj<>endobj +964 0 obj<>endobj +965 0 obj<>endobj +966 0 obj<>endobj +967 0 obj<>endobj +968 0 obj<>endobj +969 0 obj<>endobj +970 0 obj<>endobj +971 0 obj<>endobj +972 0 obj<>endobj +973 0 obj<>endobj +974 0 obj<>endobj +975 0 obj<>endobj +976 0 obj<>endobj +977 0 obj<>endobj +978 0 obj<>endobj +979 0 obj<>endobj +980 0 obj<>endobj +981 0 obj<>endobj +982 0 obj<>endobj +983 0 obj<>endobj +984 0 obj<>endobj +985 0 obj<>endobj +986 0 obj<>endobj +987 0 obj<>endobj +988 0 obj<>endobj +989 0 obj<>endobj +990 0 obj<>endobj +991 0 obj<>endobj +992 0 obj<>endobj +993 0 obj<>endobj +994 0 obj<>endobj +995 0 obj<>endobj +996 0 obj<>endobj +997 0 obj<>endobj +998 0 obj<>endobj +999 0 obj<>endobj +1000 0 obj<>endobj +1001 0 obj<>endobj +1002 0 obj<>endobj +1003 0 obj<>endobj +1004 0 obj<>endobj +1005 0 obj<>endobj +1006 0 obj<>endobj +1007 0 obj<>endobj +1008 0 obj<>endobj +1009 0 obj<>endobj +1010 0 obj<>endobj +1011 0 obj<>endobj +1012 0 obj<>endobj +1013 0 obj<>endobj +1014 0 obj<>endobj +1015 0 obj<>endobj +1016 0 obj<>endobj +1017 0 obj<>endobj +1018 0 obj<>endobj +1019 0 obj<>endobj +1020 0 obj<>endobj +1021 0 obj<>endobj +1022 0 obj<>endobj +1023 0 obj<>endobj +1024 0 obj<>endobj +1025 0 obj<>endobj +1026 0 obj<>endobj +1027 0 obj<>endobj +1028 0 obj<>endobj +1029 0 obj<>endobj +1030 0 obj<>endobj +1031 0 obj<>endobj +1032 0 obj<>endobj +1033 0 obj<>endobj +1034 0 obj<>1<>5<>]>>>>endobj xref -0 886 +0 1035 0000000000 65535 f 0000000015 00000 n 0000000244 00000 n @@ -2233,299 +2546,247 @@ xref 0000016830 00000 n 0000016917 00000 n 0000016951 00000 n -0000017013 00000 n -0000017100 00000 n -0000017126 00000 n -0000017175 00000 n -0000017262 00000 n -0000017288 00000 n -0000017335 00000 n -0000017422 00000 n -0000017471 00000 n -0000017558 00000 n -0000017601 00000 n -0000017688 00000 n -0000017731 00000 n -0000017817 00000 n -0000017866 00000 n -0000017951 00000 n -0000018000 00000 n -0000018085 00000 n -0000018151 00000 n -0000018199 00000 n -0000018286 00000 n -0000018332 00000 n -0000018419 00000 n -0000018453 00000 n -0000018532 00000 n -0000018619 00000 n -0000018701 00000 n -0000018787 00000 n -0000018862 00000 n -0000018949 00000 n -0000019022 00000 n -0000019109 00000 n -0000019159 00000 n -0000019237 00000 n -0000019324 00000 n -0000019350 00000 n -0000019413 00000 n -0000019500 00000 n -0000019563 00000 n -0000019650 00000 n -0000019704 00000 n -0000019791 00000 n -0000019833 00000 n -0000019874 00000 n -0000019961 00000 n -0000019987 00000 n -0000020092 00000 n -0000020198 00000 n -0000020304 00000 n -0000020410 00000 n -0000020516 00000 n -0000020622 00000 n -0000020728 00000 n -0000020834 00000 n -0000020940 00000 n -0000021046 00000 n -0000021152 00000 n -0000021258 00000 n -0000021364 00000 n -0000021470 00000 n -0000021576 00000 n -0000021682 00000 n -0000021788 00000 n -0000021894 00000 n -0000022000 00000 n -0000022106 00000 n -0000022211 00000 n -0000022317 00000 n -0000022423 00000 n -0000022529 00000 n -0000022635 00000 n -0000022741 00000 n -0000022847 00000 n -0000022953 00000 n -0000023059 00000 n -0000023165 00000 n -0000023271 00000 n -0000023377 00000 n -0000023483 00000 n -0000023589 00000 n -0000023695 00000 n -0000023801 00000 n -0000023907 00000 n -0000024013 00000 n -0000024119 00000 n -0000024224 00000 n -0000024330 00000 n -0000024436 00000 n -0000024542 00000 n -0000024645 00000 n -0000024749 00000 n -0000025127 00000 n -0000025233 00000 n -0000025338 00000 n -0000025444 00000 n -0000025550 00000 n -0000025656 00000 n -0000025762 00000 n -0000025868 00000 n -0000025974 00000 n -0000026080 00000 n -0000026186 00000 n -0000026292 00000 n -0000026397 00000 n -0000026503 00000 n -0000026609 00000 n -0000026715 00000 n -0000026821 00000 n -0000026927 00000 n -0000027033 00000 n -0000027139 00000 n -0000027245 00000 n -0000027351 00000 n -0000027457 00000 n -0000027563 00000 n -0000027669 00000 n -0000027775 00000 n -0000027880 00000 n -0000027986 00000 n -0000028092 00000 n -0000028198 00000 n -0000028303 00000 n -0000028409 00000 n -0000028515 00000 n -0000028621 00000 n -0000028727 00000 n -0000028833 00000 n -0000028939 00000 n -0000029045 00000 n -0000029151 00000 n -0000029257 00000 n -0000029363 00000 n -0000029469 00000 n -0000029574 00000 n -0000029678 00000 n -0000029782 00000 n -0000030152 00000 n -0000030257 00000 n -0000030363 00000 n -0000030469 00000 n -0000030575 00000 n -0000030681 00000 n -0000030787 00000 n -0000030893 00000 n -0000030999 00000 n -0000031105 00000 n -0000031211 00000 n -0000031317 00000 n -0000031423 00000 n -0000031529 00000 n -0000031635 00000 n -0000031741 00000 n -0000031847 00000 n -0000031953 00000 n -0000032058 00000 n -0000032164 00000 n -0000032270 00000 n -0000032376 00000 n -0000032482 00000 n -0000032588 00000 n -0000032693 00000 n -0000032799 00000 n -0000032905 00000 n -0000033011 00000 n -0000033117 00000 n -0000033221 00000 n -0000033471 00000 n -0000033505 00000 n -0000033539 00000 n -0000035789 00000 n -0000035838 00000 n +0000017003 00000 n +0000017090 00000 n +0000017116 00000 n +0000017172 00000 n +0000017259 00000 n +0000017328 00000 n +0000017415 00000 n +0000017466 00000 n +0000017553 00000 n +0000017640 00000 n +0000017727 00000 n +0000017783 00000 n +0000017870 00000 n +0000017919 00000 n +0000018006 00000 n +0000018072 00000 n +0000018124 00000 n +0000018211 00000 n +0000018266 00000 n +0000018353 00000 n +0000018400 00000 n +0000018487 00000 n +0000018534 00000 n +0000018621 00000 n +0000018671 00000 n +0000018711 00000 n +0000018798 00000 n +0000018841 00000 n +0000018928 00000 n +0000018972 00000 n +0000019059 00000 n +0000019102 00000 n +0000019189 00000 n +0000019232 00000 n +0000019319 00000 n +0000019360 00000 n +0000019447 00000 n +0000019494 00000 n +0000019581 00000 n +0000019655 00000 n +0000019702 00000 n +0000019788 00000 n +0000019814 00000 n +0000019866 00000 n +0000019952 00000 n +0000019978 00000 n +0000020032 00000 n +0000020119 00000 n +0000020145 00000 n +0000020207 00000 n +0000020294 00000 n +0000020320 00000 n +0000020369 00000 n +0000020456 00000 n +0000020482 00000 n +0000020529 00000 n +0000020616 00000 n +0000020665 00000 n +0000020752 00000 n +0000020795 00000 n +0000020882 00000 n +0000020925 00000 n +0000021011 00000 n +0000021060 00000 n +0000021145 00000 n +0000021194 00000 n +0000021279 00000 n +0000021345 00000 n +0000021393 00000 n +0000021480 00000 n +0000021526 00000 n +0000021613 00000 n +0000021647 00000 n +0000021726 00000 n +0000021813 00000 n +0000021895 00000 n +0000021981 00000 n +0000022056 00000 n +0000022143 00000 n +0000022216 00000 n +0000022303 00000 n +0000022353 00000 n +0000022431 00000 n +0000022518 00000 n +0000022544 00000 n +0000022607 00000 n +0000022694 00000 n +0000022757 00000 n +0000022844 00000 n +0000022898 00000 n +0000022985 00000 n +0000023027 00000 n +0000023068 00000 n +0000023155 00000 n +0000023181 00000 n +0000023286 00000 n +0000023392 00000 n +0000023498 00000 n +0000023604 00000 n +0000023710 00000 n +0000023816 00000 n +0000023922 00000 n +0000024028 00000 n +0000024134 00000 n +0000024240 00000 n +0000024346 00000 n +0000024452 00000 n +0000024558 00000 n +0000024664 00000 n +0000024770 00000 n +0000024876 00000 n +0000024982 00000 n +0000025088 00000 n +0000025194 00000 n +0000025300 00000 n +0000025405 00000 n +0000025511 00000 n +0000025617 00000 n +0000025723 00000 n +0000025829 00000 n +0000025935 00000 n +0000026041 00000 n +0000026147 00000 n +0000026253 00000 n +0000026359 00000 n +0000026465 00000 n +0000026571 00000 n +0000026677 00000 n +0000026783 00000 n +0000026889 00000 n +0000026995 00000 n +0000027101 00000 n +0000027207 00000 n +0000027313 00000 n +0000027418 00000 n +0000027524 00000 n +0000027630 00000 n +0000027736 00000 n +0000027839 00000 n +0000027943 00000 n +0000028321 00000 n +0000028427 00000 n +0000028532 00000 n +0000028638 00000 n +0000028744 00000 n +0000028850 00000 n +0000028956 00000 n +0000029062 00000 n +0000029168 00000 n +0000029274 00000 n +0000029380 00000 n +0000029486 00000 n +0000029591 00000 n +0000029697 00000 n +0000029803 00000 n +0000029909 00000 n +0000030015 00000 n +0000030121 00000 n +0000030227 00000 n +0000030333 00000 n +0000030439 00000 n +0000030545 00000 n +0000030651 00000 n +0000030757 00000 n +0000030863 00000 n +0000030969 00000 n +0000031074 00000 n +0000031180 00000 n +0000031286 00000 n +0000031392 00000 n +0000031497 00000 n +0000031603 00000 n +0000031709 00000 n +0000031815 00000 n +0000031921 00000 n +0000032027 00000 n +0000032133 00000 n +0000032239 00000 n +0000032345 00000 n +0000032451 00000 n +0000032557 00000 n +0000032663 00000 n +0000032768 00000 n +0000032872 00000 n +0000032976 00000 n +0000033346 00000 n +0000033451 00000 n +0000033557 00000 n +0000033663 00000 n +0000033769 00000 n +0000033875 00000 n +0000033981 00000 n +0000034087 00000 n +0000034193 00000 n +0000034299 00000 n +0000034404 00000 n +0000034510 00000 n +0000034616 00000 n +0000034722 00000 n +0000034828 00000 n +0000034934 00000 n +0000035040 00000 n +0000035146 00000 n +0000035252 00000 n +0000035358 00000 n +0000035464 00000 n +0000035570 00000 n +0000035676 00000 n +0000035781 00000 n 0000035887 00000 n -0000035936 00000 n -0000035985 00000 n -0000036034 00000 n -0000036083 00000 n -0000036132 00000 n -0000036181 00000 n -0000036230 00000 n -0000036279 00000 n -0000036328 00000 n -0000036377 00000 n -0000036426 00000 n -0000036475 00000 n -0000036524 00000 n -0000036573 00000 n -0000036622 00000 n -0000036671 00000 n -0000036720 00000 n -0000036769 00000 n -0000036818 00000 n -0000036867 00000 n -0000036916 00000 n -0000036965 00000 n -0000037014 00000 n -0000037063 00000 n -0000037112 00000 n -0000037161 00000 n -0000037210 00000 n -0000037259 00000 n -0000037308 00000 n -0000037357 00000 n -0000037406 00000 n -0000037455 00000 n -0000037504 00000 n -0000037553 00000 n -0000037602 00000 n -0000037651 00000 n -0000037700 00000 n -0000037749 00000 n -0000037798 00000 n -0000037847 00000 n -0000037896 00000 n -0000037945 00000 n -0000037994 00000 n -0000038043 00000 n -0000038092 00000 n -0000038141 00000 n -0000038190 00000 n -0000038239 00000 n -0000038288 00000 n -0000038337 00000 n -0000038386 00000 n -0000038435 00000 n -0000038484 00000 n -0000038533 00000 n -0000038582 00000 n -0000038631 00000 n -0000038680 00000 n -0000038729 00000 n -0000038778 00000 n -0000038827 00000 n -0000038876 00000 n -0000038925 00000 n -0000038974 00000 n -0000039023 00000 n -0000039072 00000 n -0000039121 00000 n -0000039170 00000 n -0000039219 00000 n -0000039268 00000 n -0000039317 00000 n -0000039366 00000 n -0000039415 00000 n -0000039464 00000 n -0000039513 00000 n -0000039562 00000 n -0000039611 00000 n -0000039660 00000 n -0000039709 00000 n -0000039758 00000 n -0000039807 00000 n -0000039856 00000 n -0000039905 00000 n -0000039954 00000 n -0000040003 00000 n -0000040052 00000 n -0000040101 00000 n -0000040150 00000 n -0000040199 00000 n -0000040248 00000 n -0000040297 00000 n -0000040346 00000 n -0000040395 00000 n -0000040444 00000 n -0000040493 00000 n -0000040542 00000 n -0000040591 00000 n -0000040640 00000 n -0000040689 00000 n -0000040738 00000 n -0000040787 00000 n -0000040836 00000 n -0000040885 00000 n -0000040934 00000 n -0000040983 00000 n -0000041032 00000 n -0000041081 00000 n -0000041130 00000 n -0000041179 00000 n -0000041228 00000 n -0000041277 00000 n -0000041326 00000 n -0000041375 00000 n -0000041424 00000 n -0000041473 00000 n -0000041522 00000 n -0000041571 00000 n -0000041620 00000 n -0000041669 00000 n -0000041718 00000 n -0000041767 00000 n -0000041816 00000 n +0000035993 00000 n +0000036099 00000 n +0000036205 00000 n +0000036311 00000 n +0000036417 00000 n +0000036523 00000 n +0000036629 00000 n +0000036735 00000 n +0000036841 00000 n +0000036947 00000 n +0000037053 00000 n +0000037159 00000 n +0000037265 00000 n +0000037371 00000 n +0000037477 00000 n +0000037582 00000 n +0000037688 00000 n +0000037794 00000 n +0000037899 00000 n +0000038003 00000 n +0000038107 00000 n +0000038485 00000 n +0000038590 00000 n +0000038696 00000 n +0000038802 00000 n +0000038908 00000 n +0000039014 00000 n +0000039118 00000 n +0000039184 00000 n +0000039218 00000 n +0000039252 00000 n 0000041865 00000 n 0000041914 00000 n 0000041963 00000 n @@ -2542,354 +2803,555 @@ xref 0000042502 00000 n 0000042551 00000 n 0000042600 00000 n -0000043269 00000 n -0000043425 00000 n -0000043997 00000 n -0000044018 00000 n -0000044192 00000 n -0000045354 00000 n -0000045376 00000 n -0000045527 00000 n -0000047033 00000 n -0000047055 00000 n -0000047215 00000 n -0000048651 00000 n -0000048673 00000 n -0000048851 00000 n -0000050111 00000 n -0000050133 00000 n -0000050275 00000 n -0000051859 00000 n -0000051881 00000 n -0000052014 00000 n -0000053849 00000 n -0000053871 00000 n -0000054004 00000 n -0000054527 00000 n -0000054548 00000 n -0000054709 00000 n -0000055993 00000 n -0000056015 00000 n -0000056176 00000 n -0000057931 00000 n -0000057953 00000 n -0000058113 00000 n -0000059758 00000 n -0000059780 00000 n -0000059922 00000 n -0000061992 00000 n -0000062014 00000 n -0000062156 00000 n -0000063968 00000 n -0000063990 00000 n -0000064132 00000 n -0000065857 00000 n -0000065879 00000 n -0000066030 00000 n -0000067794 00000 n -0000067816 00000 n -0000067991 00000 n -0000070098 00000 n -0000070120 00000 n -0000070280 00000 n -0000071876 00000 n -0000071898 00000 n -0000072073 00000 n -0000073568 00000 n -0000073590 00000 n -0000073742 00000 n -0000074549 00000 n -0000074570 00000 n -0000074721 00000 n -0000076359 00000 n -0000076381 00000 n -0000076546 00000 n -0000078318 00000 n -0000078340 00000 n -0000078505 00000 n -0000079398 00000 n -0000079419 00000 n -0000079593 00000 n -0000081198 00000 n -0000081220 00000 n -0000081363 00000 n -0000082121 00000 n -0000082142 00000 n -0000082325 00000 n -0000084193 00000 n -0000084215 00000 n -0000084384 00000 n -0000086238 00000 n -0000086260 00000 n -0000086420 00000 n -0000088104 00000 n -0000088126 00000 n -0000088299 00000 n -0000090028 00000 n -0000090050 00000 n -0000090201 00000 n -0000091125 00000 n -0000091146 00000 n -0000091330 00000 n -0000093155 00000 n -0000093177 00000 n -0000093351 00000 n -0000095524 00000 n -0000095546 00000 n -0000095739 00000 n -0000097613 00000 n -0000097635 00000 n -0000097819 00000 n -0000099729 00000 n -0000099751 00000 n -0000099927 00000 n -0000101728 00000 n -0000101750 00000 n -0000101920 00000 n -0000103518 00000 n -0000103540 00000 n -0000103725 00000 n -0000105201 00000 n -0000105223 00000 n -0000105416 00000 n -0000106987 00000 n -0000107009 00000 n -0000107184 00000 n -0000108964 00000 n -0000108986 00000 n -0000109142 00000 n -0000110703 00000 n -0000110725 00000 n -0000110910 00000 n -0000112762 00000 n -0000112784 00000 n -0000112950 00000 n -0000114597 00000 n -0000114619 00000 n -0000114804 00000 n -0000116753 00000 n -0000116775 00000 n -0000116959 00000 n -0000118686 00000 n -0000118708 00000 n -0000118878 00000 n -0000120483 00000 n -0000120505 00000 n -0000120674 00000 n -0000122547 00000 n -0000122569 00000 n -0000122754 00000 n -0000124618 00000 n -0000124640 00000 n -0000124816 00000 n -0000126906 00000 n -0000126928 00000 n -0000127103 00000 n -0000129043 00000 n -0000129065 00000 n -0000129241 00000 n -0000131557 00000 n -0000131579 00000 n -0000131731 00000 n -0000133711 00000 n -0000133733 00000 n -0000133893 00000 n -0000135760 00000 n -0000135782 00000 n -0000135933 00000 n -0000137685 00000 n -0000137707 00000 n -0000137839 00000 n -0000139713 00000 n -0000139735 00000 n -0000139877 00000 n -0000141948 00000 n -0000141970 00000 n -0000142121 00000 n -0000143915 00000 n -0000143937 00000 n -0000144069 00000 n -0000145862 00000 n -0000145884 00000 n -0000146007 00000 n -0000146461 00000 n -0000146482 00000 n -0000146634 00000 n -0000148376 00000 n -0000148398 00000 n -0000148540 00000 n -0000150301 00000 n -0000150323 00000 n -0000150474 00000 n -0000152364 00000 n -0000152386 00000 n -0000152543 00000 n -0000154393 00000 n -0000154415 00000 n -0000154609 00000 n -0000156668 00000 n -0000156690 00000 n -0000156865 00000 n -0000158457 00000 n -0000158479 00000 n -0000158663 00000 n -0000160011 00000 n -0000160033 00000 n -0000160193 00000 n -0000161436 00000 n -0000161458 00000 n -0000161609 00000 n -0000163064 00000 n -0000163086 00000 n -0000163247 00000 n -0000164895 00000 n -0000164917 00000 n -0000165050 00000 n -0000165519 00000 n -0000165540 00000 n -0000165707 00000 n -0000167374 00000 n -0000167396 00000 n -0000167553 00000 n -0000168741 00000 n -0000168763 00000 n -0000168920 00000 n -0000170470 00000 n -0000170492 00000 n -0000170676 00000 n -0000171481 00000 n -0000171502 00000 n -0000171659 00000 n -0000177082 00000 n -0000177104 00000 n -0000177261 00000 n -0000182555 00000 n -0000182577 00000 n -0000182734 00000 n -0000185955 00000 n -0000185977 00000 n -0000186033 00000 n -0000186138 00000 n -0000186316 00000 n -0000186435 00000 n -0000186570 00000 n -0000186706 00000 n -0000186854 00000 n -0000187004 00000 n -0000187144 00000 n -0000187285 00000 n -0000187438 00000 n -0000187600 00000 n -0000187749 00000 n -0000187937 00000 n -0000188070 00000 n -0000188198 00000 n -0000188316 00000 n -0000188452 00000 n -0000188594 00000 n -0000188710 00000 n -0000188836 00000 n -0000188952 00000 n -0000189143 00000 n -0000189242 00000 n -0000189390 00000 n -0000189508 00000 n -0000189632 00000 n -0000189754 00000 n -0000189880 00000 n -0000190038 00000 n -0000190168 00000 n -0000190292 00000 n -0000190410 00000 n -0000190528 00000 n -0000190647 00000 n -0000190837 00000 n -0000191023 00000 n -0000191176 00000 n -0000191339 00000 n -0000191490 00000 n -0000191594 00000 n -0000191811 00000 n -0000191917 00000 n -0000192049 00000 n -0000192171 00000 n -0000192376 00000 n -0000192481 00000 n -0000192581 00000 n -0000192785 00000 n -0000192946 00000 n -0000193094 00000 n -0000193222 00000 n -0000193365 00000 n -0000193489 00000 n -0000193618 00000 n -0000193763 00000 n -0000193928 00000 n -0000194080 00000 n -0000194260 00000 n -0000194365 00000 n -0000194484 00000 n -0000194609 00000 n -0000194754 00000 n -0000194896 00000 n -0000195046 00000 n -0000195177 00000 n -0000195303 00000 n -0000195428 00000 n -0000195568 00000 n -0000195695 00000 n -0000195826 00000 n -0000195957 00000 n -0000196135 00000 n -0000196263 00000 n -0000196399 00000 n -0000196534 00000 n -0000196740 00000 n -0000196853 00000 n -0000196969 00000 n -0000197114 00000 n -0000197285 00000 n -0000197434 00000 n -0000197589 00000 n -0000197729 00000 n -0000197861 00000 n -0000197995 00000 n -0000198127 00000 n -0000198265 00000 n -0000198415 00000 n -0000198583 00000 n -0000198730 00000 n -0000198935 00000 n -0000199036 00000 n -0000199154 00000 n -0000199281 00000 n -0000199400 00000 n -0000199523 00000 n -0000199663 00000 n -0000199790 00000 n -0000199930 00000 n -0000200066 00000 n -0000200188 00000 n -0000200324 00000 n -0000200444 00000 n -0000200564 00000 n -0000200690 00000 n -0000200807 00000 n -0000200910 00000 n -0000201075 00000 n -0000201173 00000 n -0000201358 00000 n -0000201548 00000 n -0000201731 00000 n -0000201890 00000 n -0000202077 00000 n -0000202183 00000 n -0000202313 00000 n -0000202439 00000 n -0000202549 00000 n -0000202642 00000 n +0000042649 00000 n +0000042698 00000 n +0000042747 00000 n +0000042796 00000 n +0000042845 00000 n +0000042894 00000 n +0000042943 00000 n +0000042992 00000 n +0000043041 00000 n +0000043090 00000 n +0000043139 00000 n +0000043188 00000 n +0000043237 00000 n +0000043286 00000 n +0000043335 00000 n +0000043384 00000 n +0000043433 00000 n +0000043482 00000 n +0000043531 00000 n +0000043580 00000 n +0000043629 00000 n +0000043678 00000 n +0000043727 00000 n +0000043776 00000 n +0000043825 00000 n +0000043874 00000 n +0000043923 00000 n +0000043972 00000 n +0000044021 00000 n +0000044070 00000 n +0000044119 00000 n +0000044168 00000 n +0000044217 00000 n +0000044266 00000 n +0000044315 00000 n +0000044364 00000 n +0000044413 00000 n +0000044462 00000 n +0000044511 00000 n +0000044560 00000 n +0000044609 00000 n +0000044658 00000 n +0000044707 00000 n +0000044756 00000 n +0000044805 00000 n +0000044854 00000 n +0000044903 00000 n +0000044952 00000 n +0000045001 00000 n +0000045050 00000 n +0000045099 00000 n +0000045148 00000 n +0000045197 00000 n +0000045246 00000 n +0000045295 00000 n +0000045344 00000 n +0000045393 00000 n +0000045442 00000 n +0000045491 00000 n +0000045540 00000 n +0000045589 00000 n +0000045638 00000 n +0000045687 00000 n +0000045736 00000 n +0000045785 00000 n +0000045834 00000 n +0000045883 00000 n +0000045932 00000 n +0000045981 00000 n +0000046030 00000 n +0000046079 00000 n +0000046128 00000 n +0000046177 00000 n +0000046226 00000 n +0000046275 00000 n +0000046324 00000 n +0000046373 00000 n +0000046422 00000 n +0000046471 00000 n +0000046520 00000 n +0000046569 00000 n +0000046618 00000 n +0000046667 00000 n +0000046716 00000 n +0000046765 00000 n +0000046814 00000 n +0000046863 00000 n +0000046912 00000 n +0000046961 00000 n +0000047010 00000 n +0000047059 00000 n +0000047108 00000 n +0000047157 00000 n +0000047206 00000 n +0000047255 00000 n +0000047304 00000 n +0000047353 00000 n +0000047402 00000 n +0000047451 00000 n +0000047500 00000 n +0000047549 00000 n +0000047598 00000 n +0000047647 00000 n +0000047696 00000 n +0000047745 00000 n +0000047794 00000 n +0000047843 00000 n +0000047892 00000 n +0000047941 00000 n +0000047990 00000 n +0000048039 00000 n +0000048088 00000 n +0000048137 00000 n +0000048186 00000 n +0000048235 00000 n +0000048284 00000 n +0000048333 00000 n +0000048382 00000 n +0000048431 00000 n +0000048480 00000 n +0000048529 00000 n +0000048578 00000 n +0000048627 00000 n +0000048676 00000 n +0000048725 00000 n +0000048774 00000 n +0000048823 00000 n +0000048872 00000 n +0000048921 00000 n +0000048970 00000 n +0000049019 00000 n +0000049068 00000 n +0000049117 00000 n +0000049166 00000 n +0000049215 00000 n +0000049264 00000 n +0000049313 00000 n +0000049362 00000 n +0000049411 00000 n +0000049460 00000 n +0000049509 00000 n +0000049558 00000 n +0000049607 00000 n +0000049656 00000 n +0000049705 00000 n +0000049754 00000 n +0000050511 00000 n +0000050667 00000 n +0000051239 00000 n +0000051260 00000 n +0000051434 00000 n +0000052596 00000 n +0000052618 00000 n +0000052769 00000 n +0000054275 00000 n +0000054297 00000 n +0000054457 00000 n +0000055893 00000 n +0000055915 00000 n +0000056093 00000 n +0000057353 00000 n +0000057375 00000 n +0000057517 00000 n +0000059101 00000 n +0000059123 00000 n +0000059256 00000 n +0000061091 00000 n +0000061113 00000 n +0000061246 00000 n +0000061769 00000 n +0000061790 00000 n +0000061951 00000 n +0000063235 00000 n +0000063257 00000 n +0000063418 00000 n +0000065173 00000 n +0000065195 00000 n +0000065355 00000 n +0000067000 00000 n +0000067022 00000 n +0000067164 00000 n +0000069234 00000 n +0000069256 00000 n +0000069398 00000 n +0000071210 00000 n +0000071232 00000 n +0000071374 00000 n +0000073099 00000 n +0000073121 00000 n +0000073272 00000 n +0000075036 00000 n +0000075058 00000 n +0000075233 00000 n +0000077340 00000 n +0000077362 00000 n +0000077522 00000 n +0000079118 00000 n +0000079140 00000 n +0000079315 00000 n +0000080810 00000 n +0000080832 00000 n +0000080984 00000 n +0000081791 00000 n +0000081812 00000 n +0000081963 00000 n +0000083601 00000 n +0000083623 00000 n +0000083788 00000 n +0000085560 00000 n +0000085582 00000 n +0000085747 00000 n +0000086640 00000 n +0000086661 00000 n +0000086835 00000 n +0000088440 00000 n +0000088462 00000 n +0000088605 00000 n +0000089363 00000 n +0000089384 00000 n +0000089567 00000 n +0000091435 00000 n +0000091457 00000 n +0000091626 00000 n +0000093480 00000 n +0000093502 00000 n +0000093662 00000 n +0000095346 00000 n +0000095368 00000 n +0000095541 00000 n +0000097270 00000 n +0000097292 00000 n +0000097443 00000 n +0000098367 00000 n +0000098388 00000 n +0000098572 00000 n +0000100397 00000 n +0000100419 00000 n +0000100593 00000 n +0000102766 00000 n +0000102788 00000 n +0000102981 00000 n +0000104855 00000 n +0000104877 00000 n +0000105061 00000 n +0000106971 00000 n +0000106993 00000 n +0000107169 00000 n +0000108970 00000 n +0000108992 00000 n +0000109162 00000 n +0000110760 00000 n +0000110782 00000 n +0000110967 00000 n +0000112443 00000 n +0000112465 00000 n +0000112658 00000 n +0000114229 00000 n +0000114251 00000 n +0000114426 00000 n +0000116206 00000 n +0000116228 00000 n +0000116384 00000 n +0000117945 00000 n +0000117967 00000 n +0000118152 00000 n +0000120004 00000 n +0000120026 00000 n +0000120192 00000 n +0000121839 00000 n +0000121861 00000 n +0000122046 00000 n +0000123995 00000 n +0000124017 00000 n +0000124201 00000 n +0000125928 00000 n +0000125950 00000 n +0000126120 00000 n +0000127725 00000 n +0000127747 00000 n +0000127916 00000 n +0000129789 00000 n +0000129811 00000 n +0000129996 00000 n +0000131860 00000 n +0000131882 00000 n +0000132058 00000 n +0000134148 00000 n +0000134170 00000 n +0000134345 00000 n +0000136285 00000 n +0000136307 00000 n +0000136483 00000 n +0000138799 00000 n +0000138821 00000 n +0000138973 00000 n +0000140953 00000 n +0000140975 00000 n +0000141135 00000 n +0000143002 00000 n +0000143024 00000 n +0000143175 00000 n +0000144927 00000 n +0000144949 00000 n +0000145081 00000 n +0000146955 00000 n +0000146977 00000 n +0000147119 00000 n +0000149190 00000 n +0000149212 00000 n +0000149363 00000 n +0000151157 00000 n +0000151179 00000 n +0000151311 00000 n +0000153104 00000 n +0000153126 00000 n +0000153249 00000 n +0000153703 00000 n +0000153724 00000 n +0000153881 00000 n +0000155494 00000 n +0000155516 00000 n +0000155668 00000 n +0000157328 00000 n +0000157350 00000 n +0000157492 00000 n +0000158375 00000 n +0000158396 00000 n +0000158581 00000 n +0000160738 00000 n +0000160760 00000 n +0000160936 00000 n +0000163121 00000 n +0000163143 00000 n +0000163294 00000 n +0000164395 00000 n +0000164417 00000 n +0000164593 00000 n +0000166093 00000 n +0000166115 00000 n +0000166300 00000 n +0000168152 00000 n +0000168174 00000 n +0000168359 00000 n +0000170266 00000 n +0000170288 00000 n +0000170445 00000 n +0000171376 00000 n +0000171397 00000 n +0000171549 00000 n +0000173290 00000 n +0000173312 00000 n +0000173454 00000 n +0000175216 00000 n +0000175238 00000 n +0000175389 00000 n +0000177280 00000 n +0000177302 00000 n +0000177459 00000 n +0000179312 00000 n +0000179334 00000 n +0000179528 00000 n +0000181588 00000 n +0000181610 00000 n +0000181785 00000 n +0000183377 00000 n +0000183399 00000 n +0000183583 00000 n +0000184922 00000 n +0000184944 00000 n +0000185104 00000 n +0000186347 00000 n +0000186369 00000 n +0000186520 00000 n +0000187976 00000 n +0000187998 00000 n +0000188159 00000 n +0000189807 00000 n +0000189829 00000 n +0000189962 00000 n +0000190432 00000 n +0000190453 00000 n +0000190620 00000 n +0000192288 00000 n +0000192310 00000 n +0000192467 00000 n +0000193655 00000 n +0000193677 00000 n +0000193834 00000 n +0000195386 00000 n +0000195408 00000 n +0000195592 00000 n +0000196397 00000 n +0000196418 00000 n +0000196575 00000 n +0000201998 00000 n +0000202020 00000 n +0000202177 00000 n +0000207471 00000 n +0000207493 00000 n +0000207650 00000 n +0000212778 00000 n +0000212800 00000 n +0000212957 00000 n +0000213727 00000 n +0000213748 00000 n +0000213805 00000 n +0000213910 00000 n +0000214088 00000 n +0000214207 00000 n +0000214342 00000 n +0000214478 00000 n +0000214626 00000 n +0000214776 00000 n +0000214916 00000 n +0000215057 00000 n +0000215210 00000 n +0000215372 00000 n +0000215521 00000 n +0000215709 00000 n +0000215842 00000 n +0000215970 00000 n +0000216088 00000 n +0000216224 00000 n +0000216366 00000 n +0000216482 00000 n +0000216608 00000 n +0000216724 00000 n +0000216915 00000 n +0000217014 00000 n +0000217162 00000 n +0000217280 00000 n +0000217404 00000 n +0000217526 00000 n +0000217652 00000 n +0000217810 00000 n +0000217940 00000 n +0000218064 00000 n +0000218182 00000 n +0000218300 00000 n +0000218419 00000 n +0000218609 00000 n +0000218795 00000 n +0000218948 00000 n +0000219111 00000 n +0000219262 00000 n +0000219366 00000 n +0000219583 00000 n +0000219689 00000 n +0000219821 00000 n +0000219943 00000 n +0000220148 00000 n +0000220253 00000 n +0000220353 00000 n +0000220557 00000 n +0000220718 00000 n +0000220866 00000 n +0000220994 00000 n +0000221137 00000 n +0000221261 00000 n +0000221390 00000 n +0000221535 00000 n +0000221700 00000 n +0000221852 00000 n +0000222032 00000 n +0000222137 00000 n +0000222256 00000 n +0000222381 00000 n +0000222526 00000 n +0000222668 00000 n +0000222818 00000 n +0000222949 00000 n +0000223075 00000 n +0000223200 00000 n +0000223340 00000 n +0000223467 00000 n +0000223598 00000 n +0000223729 00000 n +0000223907 00000 n +0000224035 00000 n +0000224171 00000 n +0000224306 00000 n +0000224512 00000 n +0000224625 00000 n +0000224741 00000 n +0000224886 00000 n +0000225057 00000 n +0000225206 00000 n +0000225361 00000 n +0000225501 00000 n +0000225633 00000 n +0000225767 00000 n +0000225899 00000 n +0000226037 00000 n +0000226187 00000 n +0000226355 00000 n +0000226502 00000 n +0000226689 00000 n +0000226802 00000 n +0000226918 00000 n +0000227074 00000 n +0000227232 00000 n +0000227363 00000 n +0000227509 00000 n +0000227643 00000 n +0000227776 00000 n +0000227997 00000 n +0000228098 00000 n +0000228217 00000 n +0000228346 00000 n +0000228505 00000 n +0000228639 00000 n +0000228770 00000 n +0000228897 00000 n +0000229036 00000 n +0000229171 00000 n +0000229323 00000 n +0000229472 00000 n +0000229577 00000 n +0000229787 00000 n +0000229892 00000 n +0000230015 00000 n +0000230147 00000 n +0000230271 00000 n +0000230399 00000 n +0000230544 00000 n +0000230676 00000 n +0000230821 00000 n +0000230962 00000 n +0000231089 00000 n +0000231230 00000 n +0000231355 00000 n +0000231480 00000 n +0000231611 00000 n +0000231733 00000 n +0000231840 00000 n +0000232010 00000 n +0000232111 00000 n +0000232300 00000 n +0000232494 00000 n +0000232681 00000 n +0000232843 00000 n +0000233035 00000 n +0000233144 00000 n +0000233278 00000 n +0000233408 00000 n +0000233521 00000 n +0000233616 00000 n trailer -<]>> +<]>> startxref -202856 +233831 %%EOF diff --git a/docs/docbook/Makefile.in b/docs/docbook/Makefile.in index ef261b3bad..0a21b73f6f 100644 --- a/docs/docbook/Makefile.in +++ b/docs/docbook/Makefile.in @@ -60,7 +60,8 @@ HOWTOSRC=projdoc/DOMAIN_MEMBER.sgml projdoc/NT_Security.sgml \ projdoc/UNIX_INSTALL.sgml projdoc/winbind.sgml projdoc/OS2-Client-HOWTO.sgml \ projdoc/Samba-PDC-HOWTO.sgml projdoc/ENCRYPTION.sgml \ projdoc/CVS-Access.sgml projdoc/Integrating-with-Windows.sgml \ - projdoc/PAM-Authentication-And-Samba.sgml projdoc/Samba-LDAP-HOWTO.sgml + projdoc/PAM-Authentication-And-Samba.sgml projdoc/Samba-LDAP-HOWTO.sgml \ + projdoc/Samba-BDC-HOWTO.sgml diff --git a/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml b/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml new file mode 100644 index 0000000000..0dae399654 --- /dev/null +++ b/docs/docbook/projdoc/Samba-BDC-HOWTO.sgml @@ -0,0 +1,233 @@ + + + + + + VolkerLendecke + + Samba Team +

Volker.Lendecke@SerNet.DE
+ + + (26 Apr 2001) + + + +How to a Purely Samba Controlled Domain + + + +Prerequisite Reading + + +Before you continue reading in this chapter, please make sure +that you are comfortable with configuring a Samba PDC +as described in the Samba-PDC-HOWTO. + + + + + + + +Background + + +What is a Domain Controller? It is a machine that is able to answer +logon requests from workstations in a Windows NT Domain. Whenever a +user logs into a Windows NT Workstation, the workstation connects to a +Domain Controller and asks him whether the username and password the +user typed in is correct. The Domain Controller replies with a lot of +information about the user, for example the place where the users +profile is stored, the users full name of the user. All this +information is stored in the NT user database, the so-called SAM. + + + +There are two kinds of Domain Controller in a NT 4 compatible Domain: +A Primary Domain Controller (PDC) and one or more Backup Domain +Controllers (BDC). The PDC contains the master copy of the +SAM. Whenever the SAM has to change, for example when a user changes +his password, this change has to be done on the PDC. A Backup Domain +Controller is a machine that maintains a read-only copy of the +SAM. This way it is able to reply to logon requests and authenticate +users in case the PDC is not available. During this time no changes to +the SAM are possible. Whenever changes to the SAM are done on the PDC, +all BDC receive the changes from the PDC. + + + +Since version 2.2 Samba officially supports domain logons for all +current Windows Clients, including Windows 2000 and XP. This text +assumes the domain to be named SAMBA. To be able to act as a PDC, some +parameters in the [global]-section of the smb.conf have to be set: + + + +workgroup = SAMBA +domain master = yes +domain logons = yes + + + +Several other things like a [homes] and a [netlogon] share also may be +set along with settings for the profile path, the users home drive and +others. This will not be covered in this document. + + + + + + +What qualifies a Domain Controller on the network? + + +Every machine that is a Domain Controller for the domain SAMBA has to +register the NetBIOS group name SAMBA#1c with the WINS server and/or +by broadcast on the local network. The PDC also registers the unique +NetBIOS name SAMBA#1b with the WINS server. The name type #1b is +normally reserved for the domain master browser, a role that has +nothing to do with anything related to authentication, but the +Microsoft Domain implementation requires the domain master browser to +be on the same machine as the PDC. + + + + +How does a Workstation find its domain controller? + + +A NT workstation in the domain SAMBA that wants a local user to be +authenticated has to find the domain controller for SAMBA. It does +this by doing a NetBIOS name query for the group name SAMBA#1c. It +assumes that each of the machines it gets back from the queries is a +domain controller and can answer logon requests. To not open security +holes both the workstation and the selected (TODO: How is the DC +chosen) domain controller authenticate each other. After that the +workstation sends the user's credentials (his name and password) to +the domain controller, asking for approval. + + + + + + +When is the PDC needed? + + +Whenever a user wants to change his password, this has to be done on +the PDC. To find the PDC, the workstation does a NetBIOS name query +for SAMBA#1b, assuming this machine maintains the master copy of the +SAM. The workstation contacts the PDC, both mutually authenticate and +the password change is done. + + + + + + + + +Can Samba be a Backup Domain Controller? + + +With version 2.2, no. The native NT SAM replication protocols have +not yet been fully implemented. The Samba Team is working on +understanding and implementing the protocols, but this work has not +been finished for version 2.2. + + + +Can I get the benefits of a BDC with Samba? Yes. The main reason for +implementing a BDC is availability. If the PDC is a Samba machine, +a second Samba machine can be set up to +service logon requests whenever the PDC is down. + + + + + + +How do I set up a Samba BDC? + + +Several things have to be done: + + + + + +The file private/MACHINE.SID identifies the domain. When a samba +server is first started, it is created on the fly and must never be +changed again. This file has to be the same on the PDC and the BDC, +so the MACHINE.SID has to be copied from the PDC to the BDC. + + + +The Unix user database has to be synchronized from the PDC to the +BDC. This means that both the /etc/passwd and /etc/group have to be +replicated from the PDC to the BDC. This can be done manually +whenever changes are made, or the PDC is set up as a NIS master +server and the BDC as a NIS slave server. To set up the BDC as a +mere NIS client would not be enough, as the BDC would not be able to +access its user database in case of a PDC failure. + + + +The Samba password database in the file private/smbpasswd has to be +replicated from the PDC to the BDC. This is a bit tricky, see the +next section. + + + +Any netlogon share has to be replicated from the PDC to the +BDC. This can be done manually whenever login scripts are changed, +or it can be done automatically together with the smbpasswd +synchronization. + + + + + +Finally, the BDC has to be found by the workstations. This can be done +by setting + + + +workgroup = samba +domain master = no +domain logons = yes + + + +in the [global]-section of the smb.conf of the BDC. This makes the BDC +only register the name SAMBA#1c with the WINS server. This is no +problem as the name SAMBA#1c is a NetBIOS group name that is meant to +be registered by more than one machine. The parameter 'domain master = +no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS +name is reserved for the Primary Domain Controller. + + + +How do I replicate the smbpasswd file? + + +Replication of the smbpasswd file is sensitive. It has to be done +whenever changes to the SAM are made. Every user's password change is +done in the smbpasswd file and has to be replicated to the BDC. So +replicating the smbpasswd file very often is necessary. + + + +As the smbpasswd file contains plain text password equivalents, it +must not be sent unencrypted over the wire. The best way to set up +smbpasswd replication from the PDC to the BDC is to use the utility +rsync. rsync can use ssh as a transport. ssh itself can be set up to +accept *only* rsync transfer without requiring the user to type a +password. + + + + + + \ No newline at end of file diff --git a/docs/docbook/projdoc/samba-doc.sgml b/docs/docbook/projdoc/samba-doc.sgml index f1211c0ac6..e2fc5a1eb1 100644 --- a/docs/docbook/projdoc/samba-doc.sgml +++ b/docs/docbook/projdoc/samba-doc.sgml @@ -8,9 +8,11 @@ + + ]> @@ -56,6 +58,8 @@ Cheers, jerry &PRINTER-DRIVER2; &DOMAIN-MEMBER; &Samba-PDC-HOWTO; +&Samba-BDC-HOWTO; +&Samba-LDAP; &WINBIND; &OS2-Client; &CVS-Access; diff --git a/docs/docbook/projdoc/winbind.sgml b/docs/docbook/projdoc/winbind.sgml index eaa14bf0c2..fc8d8d52a1 100644 --- a/docs/docbook/projdoc/winbind.sgml +++ b/docs/docbook/projdoc/winbind.sgml @@ -557,7 +557,7 @@ a domain user who has administrative privileges in the domain. -root# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U Administrator +root# /usr/local/samba/bin/net rpc join -s PDC -U Administrator diff --git a/docs/htmldocs/Samba-BDC-HOWTO.html b/docs/htmldocs/Samba-BDC-HOWTO.html new file mode 100644 index 0000000000..0847335fe6 --- /dev/null +++ b/docs/htmldocs/Samba-BDC-HOWTO.html @@ -0,0 +1,245 @@ +How to a Purely Samba Controlled Domain

Prerequisite Reading

Before you continue reading in this chapter, please make sure +that you are comfortable with configuring a Samba PDC +as described in the Samba-PDC-HOWTO.

Background

What is a Domain Controller? It is a machine that is able to answer +logon requests from workstations in a Windows NT Domain. Whenever a +user logs into a Windows NT Workstation, the workstation connects to a +Domain Controller and asks him whether the username and password the +user typed in is correct. The Domain Controller replies with a lot of +information about the user, for example the place where the users +profile is stored, the users full name of the user. All this +information is stored in the NT user database, the so-called SAM.

There are two kinds of Domain Controller in a NT 4 compatible Domain: +A Primary Domain Controller (PDC) and one or more Backup Domain +Controllers (BDC). The PDC contains the master copy of the +SAM. Whenever the SAM has to change, for example when a user changes +his password, this change has to be done on the PDC. A Backup Domain +Controller is a machine that maintains a read-only copy of the +SAM. This way it is able to reply to logon requests and authenticate +users in case the PDC is not available. During this time no changes to +the SAM are possible. Whenever changes to the SAM are done on the PDC, +all BDC receive the changes from the PDC.

Since version 2.2 Samba officially supports domain logons for all +current Windows Clients, including Windows 2000 and XP. This text +assumes the domain to be named SAMBA. To be able to act as a PDC, some +parameters in the [global]-section of the smb.conf have to be set:

workgroup = SAMBA
+domain master = yes
+domain logons = yes

Several other things like a [homes] and a [netlogon] share also may be +set along with settings for the profile path, the users home drive and +others. This will not be covered in this document.

What qualifies a Domain Controller on the network?

Every machine that is a Domain Controller for the domain SAMBA has to +register the NetBIOS group name SAMBA#1c with the WINS server and/or +by broadcast on the local network. The PDC also registers the unique +NetBIOS name SAMBA#1b with the WINS server. The name type #1b is +normally reserved for the domain master browser, a role that has +nothing to do with anything related to authentication, but the +Microsoft Domain implementation requires the domain master browser to +be on the same machine as the PDC.

How does a Workstation find its domain controller?

A NT workstation in the domain SAMBA that wants a local user to be +authenticated has to find the domain controller for SAMBA. It does +this by doing a NetBIOS name query for the group name SAMBA#1c. It +assumes that each of the machines it gets back from the queries is a +domain controller and can answer logon requests. To not open security +holes both the workstation and the selected (TODO: How is the DC +chosen) domain controller authenticate each other. After that the +workstation sends the user's credentials (his name and password) to +the domain controller, asking for approval.

When is the PDC needed?

Whenever a user wants to change his password, this has to be done on +the PDC. To find the PDC, the workstation does a NetBIOS name query +for SAMBA#1b, assuming this machine maintains the master copy of the +SAM. The workstation contacts the PDC, both mutually authenticate and +the password change is done.

Can Samba be a Backup Domain Controller?

With version 2.2, no. The native NT SAM replication protocols have +not yet been fully implemented. The Samba Team is working on +understanding and implementing the protocols, but this work has not +been finished for version 2.2.

Can I get the benefits of a BDC with Samba? Yes. The main reason for +implementing a BDC is availability. If the PDC is a Samba machine, +a second Samba machine can be set up to +service logon requests whenever the PDC is down.

How do I set up a Samba BDC?

Several things have to be done:

  • The file private/MACHINE.SID identifies the domain. When a samba +server is first started, it is created on the fly and must never be +changed again. This file has to be the same on the PDC and the BDC, +so the MACHINE.SID has to be copied from the PDC to the BDC.

  • The Unix user database has to be synchronized from the PDC to the +BDC. This means that both the /etc/passwd and /etc/group have to be +replicated from the PDC to the BDC. This can be done manually +whenever changes are made, or the PDC is set up as a NIS master +server and the BDC as a NIS slave server. To set up the BDC as a +mere NIS client would not be enough, as the BDC would not be able to +access its user database in case of a PDC failure.

  • The Samba password database in the file private/smbpasswd has to be +replicated from the PDC to the BDC. This is a bit tricky, see the +next section.

  • Any netlogon share has to be replicated from the PDC to the +BDC. This can be done manually whenever login scripts are changed, +or it can be done automatically together with the smbpasswd +synchronization.

Finally, the BDC has to be found by the workstations. This can be done +by setting

workgroup = samba
+domain master = no
+domain logons = yes

in the [global]-section of the smb.conf of the BDC. This makes the BDC +only register the name SAMBA#1c with the WINS server. This is no +problem as the name SAMBA#1c is a NetBIOS group name that is meant to +be registered by more than one machine. The parameter 'domain master = +no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS +name is reserved for the Primary Domain Controller.

How do I replicate the smbpasswd file?

Replication of the smbpasswd file is sensitive. It has to be done +whenever changes to the SAM are made. Every user's password change is +done in the smbpasswd file and has to be replicated to the BDC. So +replicating the smbpasswd file very often is necessary.

As the smbpasswd file contains plain text password equivalents, it +must not be sent unencrypted over the wire. The best way to set up +smbpasswd replication from the PDC to the BDC is to use the utility +rsync. rsync can use ssh as a transport. ssh itself can be set up to +accept *only* rsync transfer without requiring the user to type a +password.

\ No newline at end of file diff --git a/docs/htmldocs/Samba-HOWTO-Collection.html b/docs/htmldocs/Samba-HOWTO-Collection.html index 5429e4da05..50d9dea7e3 100644 --- a/docs/htmldocs/Samba-HOWTO-Collection.html +++ b/docs/htmldocs/Samba-HOWTO-Collection.html @@ -668,101 +668,231 @@ HREF="#AEN1602" >
9. Unified Logons between Windows NT and UNIX using WinbindHow to a Purely Samba Controlled Domain
9.1. AbstractPrerequisite Reading
9.2. Background
9.3. What qualifies a Domain Controller on the network?
9.3.1. How does a Workstation find its domain controller?
9.3.2. When is the PDC needed?
9.4. Can Samba be a Backup Domain Controller?
9.5. How do I set up a Samba BDC?
9.5.1. How do I replicate the smbpasswd file?
10. Storing Samba's User/Machine Account information in an LDAP Directory
10.1. Purpose
10.2. Introduction
9.3. 10.3. Supported LDAP Servers
10.4. Schema and Relationship to the RFC 2307 posixAccount
10.5. Configuring Samba with LDAP
10.5.1. OpenLDAP configuration
10.5.2. Configuring Samba
10.6. Accounts and Groups management
10.7. Security and sambaAccount
10.8. LDAP specials attributes for sambaAccounts
10.9. Example LDIF Entries for a sambaAccount
10.10. Comments
11. Unified Logons between Windows NT and UNIX using Winbind
11.1. Abstract
11.2. Introduction
11.3. What Winbind Provides
9.3.1. 11.3.1. Target Uses
9.4. 11.4. How Winbind Works
9.4.1. 11.4.1. Microsoft Remote Procedure Calls
9.4.2. 11.4.2. Name Service Switch
9.4.3. 11.4.3. Pluggable Authentication Modules
9.4.4. 11.4.4. User and Group ID Allocation
9.4.5. 11.4.5. Result Caching
9.5. 11.5. Installation and Configuration
9.5.1. 11.5.1. Introduction
9.5.2. 11.5.2. Requirements
9.5.3. 11.5.3. Testing Things Out
9.5.3.1. 11.5.3.1. Configure and compile SAMBA
9.5.3.2. 11.5.3.2. Configure nsswitch.conf
9.5.3.3. 11.5.3.3. Configure smb.conf
9.5.3.4. 11.5.3.4. Join the SAMBA server to the PDC domain
9.5.3.5. 11.5.3.5. Start up the winbindd daemon and test it!
9.5.3.6. 11.5.3.6. Fix the /etc/rc.d/init.d/smb startup files
9.5.3.7. 11.5.3.7. Configure Winbind and PAM
9.6. 11.6. Limitations
9.7. 11.7. Conclusion
10. 12. OS2 Client HOWTO
10.1. 12.1. FAQs
10.1.1. 12.1.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?
10.1.2. 12.1.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?
10.1.3. 12.1.3. Are there any other issues when OS/2 (any version) is used as a client?
10.1.4. 12.1.4. How do I get printer driver download working for OS/2 clients?
11. 13. HOWTO Access Samba source code via CVS
11.1. 13.1. Introduction
11.2. 13.2. CVS Access to samba.org
11.2.1. 13.2.1. Access via CVSweb
11.2.2. 13.2.2. Access via cvs
Index

Chapter 9. Unified Logons between Windows NT and UNIX using WinbindChapter 9. How to a Purely Samba Controlled Domain

9.1. Abstract9.1. Prerequisite Reading

Integration of UNIX and Microsoft Windows NT through - a unified logon has been considered a "holy grail" in heterogeneous - computing environments for a long time. We present - winbind, a component of the Samba suite - of programs as a solution to the unified logon problem. Winbind - uses a UNIX implementation - of Microsoft RPC calls, Pluggable Authentication Modules, and the Name - Service Switch to allow Windows NT domain users to appear and operate - as UNIX users on a UNIX machine. This paper describes the winbind - system, explaining the functionality it provides, how it is configured, - and how it works internally.

Before you continue reading in this chapter, please make sure +that you are comfortable with configuring a Samba PDC +as described in the Samba-PDC-HOWTO.

9.2. Introduction9.2. Background

It is well known that UNIX and Microsoft Windows NT have - different models for representing user and group information and - use different technologies for implementing them. This fact has - made it difficult to integrate the two systems in a satisfactory - manner.

One common solution in use today has been to create - identically named user accounts on both the UNIX and Windows systems - and use the Samba suite of programs to provide file and print services - between the two. This solution is far from perfect however, as - adding and deleting users on both sets of machines becomes a chore - and two sets of passwords are required both of which - can lead to synchronization problems between the UNIX and Windows - systems and confusion for users.

We divide the unified logon problem for UNIX machines into - three smaller problems:

What is a Domain Controller? It is a machine that is able to answer +logon requests from workstations in a Windows NT Domain. Whenever a +user logs into a Windows NT Workstation, the workstation connects to a +Domain Controller and asks him whether the username and password the +user typed in is correct. The Domain Controller replies with a lot of +information about the user, for example the place where the users +profile is stored, the users full name of the user. All this +information is stored in the NT user database, the so-called SAM.

There are two kinds of Domain Controller in a NT 4 compatible Domain: +A Primary Domain Controller (PDC) and one or more Backup Domain +Controllers (BDC). The PDC contains the master copy of the +SAM. Whenever the SAM has to change, for example when a user changes +his password, this change has to be done on the PDC. A Backup Domain +Controller is a machine that maintains a read-only copy of the +SAM. This way it is able to reply to logon requests and authenticate +users in case the PDC is not available. During this time no changes to +the SAM are possible. Whenever changes to the SAM are done on the PDC, +all BDC receive the changes from the PDC.

Since version 2.2 Samba officially supports domain logons for all +current Windows Clients, including Windows 2000 and XP. This text +assumes the domain to be named SAMBA. To be able to act as a PDC, some +parameters in the [global]-section of the smb.conf have to be set:

workgroup = SAMBA
+domain master = yes
+domain logons = yes

  • Obtaining Windows NT user and group information -

  • Authenticating Windows NT users -

  • Password changing for Windows NT users -

Ideally, a prospective solution to the unified logon problem - would satisfy all the above components without duplication of - information on the UNIX machines and without creating additional - tasks for the system administrator when maintaining users and - groups on either system. The winbind system provides a simple - and elegant solution to all three components of the unified logon - problem.

Several other things like a [homes] and a [netlogon] share also may be +set along with settings for the profile path, the users home drive and +others. This will not be covered in this document.

9.3. What Winbind Provides9.3. What qualifies a Domain Controller on the network?

Winbind unifies UNIX and Windows NT account management by - allowing a UNIX box to become a full member of a NT domain. Once - this is done the UNIX box will see NT users and groups as if - they were native UNIX users and groups, allowing the NT domain - to be used in much the same manner that NIS+ is used within - UNIX-only environments.

The end result is that whenever any - program on the UNIX machine asks the operating system to lookup - a user or group name, the query will be resolved by asking the - NT domain controller for the specified domain to do the lookup. - Because Winbind hooks into the operating system at a low level - (via the NSS name resolution modules in the C library) this - redirection to the NT domain controller is completely - transparent.

Users on the UNIX machine can then use NT user and group - names as they would use "native" UNIX names. They can chown files - so that they are owned by NT domain users or even login to the - UNIX machine and run a UNIX X-Window session as a domain user.

The only obvious indication that Winbind is being used is - that user and group names take the form DOMAIN\user and - DOMAIN\group. This is necessary as it allows Winbind to determine - that redirection to a domain controller is wanted for a particular - lookup and which trusted domain is being referenced.

Additionally, Winbind provides an authentication service - that hooks into the Pluggable Authentication Modules (PAM) system - to provide authentication via a NT domain to any PAM enabled - applications. This capability solves the problem of synchronizing - passwords between systems since all passwords are stored in a single - location (on the domain controller).

Every machine that is a Domain Controller for the domain SAMBA has to +register the NetBIOS group name SAMBA#1c with the WINS server and/or +by broadcast on the local network. The PDC also registers the unique +NetBIOS name SAMBA#1b with the WINS server. The name type #1b is +normally reserved for the domain master browser, a role that has +nothing to do with anything related to authentication, but the +Microsoft Domain implementation requires the domain master browser to +be on the same machine as the PDC.

9.3.1. Target Uses9.3.1. How does a Workstation find its domain controller?

Winbind is targeted at organizations that have an - existing NT based domain infrastructure into which they wish - to put UNIX workstations or servers. Winbind will allow these - organizations to deploy UNIX workstations without having to - maintain a separate account infrastructure. This greatly - simplifies the administrative overhead of deploying UNIX - workstations into a NT based organization.

A NT workstation in the domain SAMBA that wants a local user to be +authenticated has to find the domain controller for SAMBA. It does +this by doing a NetBIOS name query for the group name SAMBA#1c. It +assumes that each of the machines it gets back from the queries is a +domain controller and can answer logon requests. To not open security +holes both the workstation and the selected (TODO: How is the DC +chosen) domain controller authenticate each other. After that the +workstation sends the user's credentials (his name and password) to +the domain controller, asking for approval.

9.3.2. When is the PDC needed?

Another interesting way in which we expect Winbind to - be used is as a central part of UNIX based appliances. Appliances - that provide file and print services to Microsoft based networks - will be able to use Winbind to provide seamless integration of - the appliance into the domain.

Whenever a user wants to change his password, this has to be done on +the PDC. To find the PDC, the workstation does a NetBIOS name query +for SAMBA#1b, assuming this machine maintains the master copy of the +SAM. The workstation contacts the PDC, both mutually authenticate and +the password change is done.

9.4. How Winbind Works9.4. Can Samba be a Backup Domain Controller?

The winbind system is designed around a client/server - architecture. A long running winbindd daemon - listens on a UNIX domain socket waiting for requests - to arrive. These requests are generated by the NSS and PAM - clients and processed sequentially.

With version 2.2, no. The native NT SAM replication protocols have +not yet been fully implemented. The Samba Team is working on +understanding and implementing the protocols, but this work has not +been finished for version 2.2.

The technologies used to implement winbind are described - in detail below.

Can I get the benefits of a BDC with Samba? Yes. The main reason for +implementing a BDC is availability. If the PDC is a Samba machine, +a second Samba machine can be set up to +service logon requests whenever the PDC is down.

9.4.1. Microsoft Remote Procedure Calls

9.5. How do I set up a Samba BDC?

Over the last two years, efforts have been underway - by various Samba Team members to decode various aspects of - the Microsoft Remote Procedure Call (MSRPC) system. This - system is used for most network related operations between - Windows NT machines including remote management, user authentication - and print spooling. Although initially this work was done - to aid the implementation of Primary Domain Controller (PDC) - functionality in Samba, it has also yielded a body of code which - can be used for other purposes.

Several things have to be done:

Winbind uses various MSRPC calls to enumerate domain users - and groups and to obtain detailed information about individual - users or groups. Other MSRPC calls can be used to authenticate - NT domain users and to change user passwords. By directly querying - a Windows PDC for user and group information, winbind maps the - NT account information onto UNIX user and group names.

  • The file private/MACHINE.SID identifies the domain. When a samba +server is first started, it is created on the fly and must never be +changed again. This file has to be the same on the PDC and the BDC, +so the MACHINE.SID has to be copied from the PDC to the BDC.

  • The Unix user database has to be synchronized from the PDC to the +BDC. This means that both the /etc/passwd and /etc/group have to be +replicated from the PDC to the BDC. This can be done manually +whenever changes are made, or the PDC is set up as a NIS master +server and the BDC as a NIS slave server. To set up the BDC as a +mere NIS client would not be enough, as the BDC would not be able to +access its user database in case of a PDC failure.

  • The Samba password database in the file private/smbpasswd has to be +replicated from the PDC to the BDC. This is a bit tricky, see the +next section.

  • Any netlogon share has to be replicated from the PDC to the +BDC. This can be done manually whenever login scripts are changed, +or it can be done automatically together with the smbpasswd +synchronization.

Finally, the BDC has to be found by the workstations. This can be done +by setting

workgroup = samba
+domain master = no
+domain logons = yes

in the [global]-section of the smb.conf of the BDC. This makes the BDC +only register the name SAMBA#1c with the WINS server. This is no +problem as the name SAMBA#1c is a NetBIOS group name that is meant to +be registered by more than one machine. The parameter 'domain master = +no' forces the BDC not to register SAMBA#1b which as a unique NetBIOS +name is reserved for the Primary Domain Controller.

9.5.1. How do I replicate the smbpasswd file?

Replication of the smbpasswd file is sensitive. It has to be done +whenever changes to the SAM are made. Every user's password change is +done in the smbpasswd file and has to be replicated to the BDC. So +replicating the smbpasswd file very often is necessary.

As the smbpasswd file contains plain text password equivalents, it +must not be sent unencrypted over the wire. The best way to set up +smbpasswd replication from the PDC to the BDC is to use the utility +rsync. rsync can use ssh as a transport. ssh itself can be set up to +accept *only* rsync transfer without requiring the user to type a +password.

Chapter 10. Storing Samba's User/Machine Account information in an LDAP Directory

10.1. Purpose

This document describes how to use an LDAP directory for storing Samba user +account information traditionally stored in the smbpasswd(5) file. It is +assumed that the reader already has a basic understanding of LDAP concepts +and has a working directory server already installed. For more information +on LDAP architectures and Directories, please refer to the following sites.

Note that O'Reilly Publishing is working on +a guide to LDAP for System Administrators which has a planned release date of +early summer, 2002.

Two additional Samba resources which may prove to be helpful are

  • The Samba-PDC-LDAP-HOWTO + maintained by Ignacio Coupeau.

  • The NT migration scripts from IDEALX that are + geared to manage users and group in such a Samba-LDAP Domain Controller configuration. +

10.2. Introduction

Traditionally, when configuring "encrypt +passwords = yes" in Samba's smb.conf file, user account +information such as username, LM/NT password hashes, password change times, and account +flags have been stored in the smbpasswd(5) file. There are several +disadvantages to this approach for sites with very large numbers of users (counted +in the thousands).

  • The first is that all lookups must be performed sequentially. Given that +there are approximately two lookups per domain logon (one for a normal +session connection such as when mapping a network drive or printer), this +is a performance bottleneck for lareg sites. What is needed is an indexed approach +such as is used in databases.

  • The second problem is that administrators who desired to replicate a +smbpasswd file to more than one Samba server were left to use external +tools such as rsync(1) and ssh(1) +and wrote custom, in-house scripts.

  • And finally, the amount of information which is stored in an +smbpasswd entry leaves no room for additional attributes such as +a home directory, password expiration time, or even a Relative +Identified (RID).

As a result of these defeciencies, a more robust means of storing user attributes +used by smbd was developed. The API which defines access to user accounts +is commonly referred to as the samdb interface (previously this was called the passdb +API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support +for a samdb backend (e.g. --with-ldapsam or +--with-tdbsam) requires compile time support.

When compiling Samba to include the --with-ldapsam autoconf +option, smbd (and associated tools) will store and lookup user accounts in +an LDAP directory. In reality, this is very easy to understand. If you are +comfortable with using an smbpasswd file, simply replace "smbpasswd" with +"LDAP directory" in all the documentation.

There are a few points to stress about what the --with-ldapsam +does not provide. The LDAP support referred to in the this documentation does not +include:

  • A means of retrieving user account information from + an Windows 2000 Active Directory server.

  • A means of replacing /etc/passwd.

The second item can be accomplished by using LDAP NSS and PAM modules. LGPL +versions of these libraries can be obtained from PADL Software +(http://www.padl.com/). However, +the details of configuring these packages are beyond the scope of this document.

10.3. Supported LDAP Servers

The LDAP samdb code in 2.2.3 has been developed and tested using the OpenLDAP +2.0 server and client libraries. The same code should be able to work with +Netscape's Directory Server and client SDK. However, due to lack of testing +so far, there are bound to be compile errors and bugs. These should not be +hard to fix. If you are so inclined, please be sure to forward all patches to +samba-patches@samba.org and +jerry@samba.org.

10.4. Schema and Relationship to the RFC 2307 posixAccount

Samba 2.2.3 includes the necessary schema file for OpenLDAP 2.0 in +examples/LDAP/samba.schema. (Note that this schema +file has been modified since the experimental support initially included +in 2.2.2). The sambaAccount objectclass is given here:

objectclass ( 1.3.1.5.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
+     DESC 'Samba Account'
+     MUST ( uid $ rid )
+     MAY  ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
+            logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
+            displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
+            description $ userWorkstations $ primaryGroupID $ domain ))

The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are +owned by the Samba Team and as such is legal to be openly published. +If you translate the schema to be used with Netscape DS, please +submit the modified schema file as a patch to jerry@samba.org

Just as the smbpasswd file is mean to store information which supplements a +user's /etc/passwd entry, so is the sambaAccount object +meant to supplement the UNIX user account information. A sambaAccount is a +STRUCTURAL objectclass so it can be stored individually +in the directory. However, there are several fields (e.g. uid) which overlap +with the posixAccount objectclass outlined in RFC2307. This is by design.

In order to store all user account information (UNIX and Samba) in the directory, +it is necessary to use the sambaAccount and posixAccount objectclasses in +combination. However, smbd will still obtain the user's UNIX account +information via the standard C library calls (e.g. getpwnam(), et. al.). +This means that the Samba server must also have the LDAP NSS library installed +and functioning correctly. This division of information makes it possible to +store all Samba account information in LDAP, but still maintain UNIX account +information in NIS while the network is transitioning to a full LDAP infrastructure.

10.5. Configuring Samba with LDAP

10.5.1. OpenLDAP configuration

To include support for the sambaAccount object in an OpenLDAP directory +server, first copy the samba.schema file to slapd's configuration directory.

root# cp samba.schema /etc/openldap/schema/

Next, include the samba.schema file in slapd.conf. +The sambaAccount object contains two attributes which depend upon other schema +files. The 'uid' attribute is defined in cosine.schema and +the 'displayName' attribute is defined in the inetorgperson.schema +file. Bother of these must be included before the samba.schema file.

## /etc/openldap/slapd.conf
+
+## schema files (core.schema is required by default)
+include	           /etc/openldap/schema/core.schema
+
+## needed for sambaAccount
+include            /etc/openldap/schema/cosine.schema
+include            /etc/openldap/schema/inetorgperson.schema
+include            /etc/openldap/schema/samba.schema
+
+## uncomment this line if you want to support the RFC2307 (NIS) schema
+## include         /etc/openldap/schema/nis.schema
+
+....

It is recommended that you maintain some indices on some of the most usefull attributes, +like in the following example, to speed up searches made on sambaAccount objectclasses +(and possibly posixAccount and posixGroup as well).

# Indices to maintain
+## required by OpenLDAP 2.0
+index objectclass   eq
+
+## support pb_getsampwnam()
+index uid           pres,eq
+## support pdb_getsambapwrid()
+index rid           eq
+
+## uncomment these if you are storing posixAccount and
+## posixGroup entries in the directory as well
+##index uidNumber     eq
+##index gidNumber     eq
+##index cn            eq
+##index memberUid     eq

10.5.2. Configuring Samba

The following parameters are available in smb.conf only with --with-ldapsam +was included with compiling Samba.

These are described in the smb.conf(5) man +page and so will not be repeated here. However, a sample smb.conf file for +use with an LDAP directory could appear as

## /usr/local/samba/lib/smb.conf
+[global]
+     security = user
+     encrypt passwords = yes
+
+     netbios name = TASHTEGO
+     workgroup = NARNIA
+
+     # ldap related parameters
+
+     # define the DN to use when binding to the directory servers
+     # The password for this DN is not stored in smb.conf.  Rather it
+     # must be set by using 'smbpasswd -w secretpw' to store the
+     # passphrase in the secrets.tdb file.  If the "ldap admin dn" values
+     # changes, this password will need to be reset.
+     ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org"
+
+     #  specify the LDAP server's hostname (defaults to locahost)
+     ldap server = ahab.samba.org
+
+     # Define the SSL option when connecting to the directory
+     # ('off', 'start tls', or 'on' (default))
+     ldap ssl = start tls
+
+     # define the port to use in the LDAP session (defaults to 636 when
+     # "ldap ssl = on")
+     ldap port = 389
+
+     # specify the base DN to use when searching the directory
+     ldap suffix = "ou=people,dc=samba,dc=org"
+
+     # generally the default ldap search filter is ok
+     # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"

10.6. Accounts and Groups management

As users accounts are managed thru the sambaAccount objectclass, you should +modify you existing administration tools to deal with sambaAccount attributes.

Machines accounts are managed with the sambaAccount objectclass, just +like users accounts. However, it's up to you to stored thoses accounts +in a different tree of you LDAP namespace: you should use +"ou=Groups,dc=plainjoe,dc=org" to store groups and +"ou=People,dc=plainjoe,dc=org" to store users. Just configure your +NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration +file).

In Samba release 2.2.3, the group management system is based on posix +groups. This meand that Samba make usage of the posixGroup objectclass. +For now, there is no NT-like group system management (global and local +groups).

10.7. Security and sambaAccount

There are two important points to remember when discussing the security +of sambaAccount entries in the directory.

  • Never retrieve the lmPassword or + ntPassword attribute values over an unencrypted LDAP session.

  • Never allow non-admin users to + view the lmPassword or ntPassword attribute values.

These password hashes are clear text equivalents and can be used to impersonate +the user without deriving the original clear text strings. For more information +on the details of LM/NT password hashes, refer to the ENCRYPTION chapter of the Samba-HOWTO-Collection.

To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults +to require an encrypted session (ldap ssl = on) using +the default port of 636 +when contacting the directory server. When using an OpenLDAP 2.0 server, it +is possible to use the use the StartTLS LDAP extended operation in the place of +LDAPS. In either case, you are strongly discouraged to disable this security +(ldap ssl = off).

Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS +extended operation. However, the OpenLDAP library still provides support for +the older method of securing communication between clients and servers.

The second security precaution is to prevent non-administrative users from +harvesting password hashes from the directory. This can be done using the +following ACL in slapd.conf:

## allow the "ldap admin dn" access, but deny everyone else
+access to attrs=lmPassword,ntPassword
+     by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write
+     by * none

10.8. LDAP specials attributes for sambaAccounts

The sambaAccount objectclass is composed of the following attributes:

  • lmPassword: the LANMAN password 16-byte hash stored as a character + representation of a hexidecimal string.

  • ntPassword: the NT password hash 16-byte stored as a character + representation of a hexidecimal string.

  • pwdLastSet: The integer time in seconds since 1970 when the + lmPassword and ntPassword attributes were last set. +

  • acctFlags: string of 11 characters surrounded by square brackets [] + representing account flags such as U (user), W(workstation), X(no password expiration), and + D(disabled).

  • logonTime: Integer value currently unused

  • logoffTime: Integer value currently unused

  • kickoffTime: Integer value currently unused

  • pwdCanChange: Integer value currently unused

  • pwdMustChange: Integer value currently unused

  • homeDrive: specifies the drive letter to which to map the + UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + where X is the letter of the drive to map. Refer to the "logon drive" parameter in the + smb.conf(5) man page for more information.

  • scriptPath: The scriptPath property specifies the path of + the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path + is relative to the netlogon share. Refer to the "logon script" parameter in the + smb.conf(5) man page for more information.

  • profilePath: specifies a path to the user's profile. + This value can be a null string, a local absolute path, or a UNC path. Refer to the + "logon path" parameter in the smb.conf(5) man page for more information.

  • smbHome: The homeDirectory property specifies the path of + the home directory for the user. The string can be null. If homeDrive is set and specifies + a drive letter, homeDirectory should be a UNC path. The path must be a network + UNC path of the form \\server\share\directory. This value can be a null string. + Refer to the "logon home" parameter in the smb.conf(5) man page for more information. +

  • userWorkstation: character string value currently unused. +

  • rid: the integer representation of the user's relative identifier + (RID).

  • primaryGroupID: the relative identifier (RID) of the primary group + of the user.

The majority of these parameters are only used when Samba is acting as a PDC of +a domain (refer to the Samba-PDC-HOWTO for details on +how to configure Samba as a Primary Domain Controller). The following four attributes +are only stored with the sambaAccount entry if the values are non-default values:

  • smbHome

  • scriptPath

  • logonPath

  • homeDrive

These attributes are only stored with the sambaAccount entry if +the values are non-default values. For example, assume TASHTEGO has now been +configured as a PDC and that logon home = \\%L\%u was defined in +its smb.conf file. When a user named "becky" logons to the domain, +the logon home string is expanded to \\TASHTEGO\becky. +If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", +this value is used. However, if this attribute does not exist, then the value +of the logon home parameter is used in its place. Samba +will only write the attribute value to the directory entry is the value is +something other than the default (e.g. \\MOBY\becky).

10.9. Example LDIF Entries for a sambaAccount

The following is a working LDIF with the inclusion of the posixAccount objectclass:

dn: uid=guest2, ou=people,dc=plainjoe,dc=org
+ntPassword: 878D8014606CDA29677A44EFA1353FC7
+pwdMustChange: 2147483647
+primaryGroupID: 1201
+lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+pwdLastSet: 1010179124
+logonTime: 0
+objectClass: sambaAccount
+uid: guest2
+kickoffTime: 2147483647
+acctFlags: [UX         ]
+logoffTime: 2147483647
+rid: 19006
+pwdCanChange: 0

The following is an LDIF entry for using both the sambaAccount and +posixAccount objectclasses:

dn: uid=gcarter, ou=people,dc=plainjoe,dc=org
+logonTime: 0
+displayName: Gerald Carter
+lmPassword: 552902031BEDE9EFAAD3B435B51404EE
+primaryGroupID: 1201
+objectClass: posixAccount
+objectClass: sambaAccount
+acctFlags: [UX         ]
+userPassword: {crypt}BpM2ej8Rkzogo
+uid: gcarter
+uidNumber: 9000
+cn: Gerald Carter
+loginShell: /bin/bash
+logoffTime: 2147483647
+gidNumber: 100
+kickoffTime: 2147483647
+pwdLastSet: 1010179230
+rid: 19000
+homeDirectory: /home/tashtego/gcarter
+pwdCanChange: 0
+pwdMustChange: 2147483647
+ntPassword: 878D8014606CDA29677A44EFA1353FC7

10.10. Comments

Please mail all comments regarding this HOWTO to jerry@samba.org. This documents was +last updated to reflect the Samba 2.2.3 release.

Chapter 11. Unified Logons between Windows NT and UNIX using Winbind

11.1. Abstract

Integration of UNIX and Microsoft Windows NT through + a unified logon has been considered a "holy grail" in heterogeneous + computing environments for a long time. We present + winbind, a component of the Samba suite + of programs as a solution to the unified logon problem. Winbind + uses a UNIX implementation + of Microsoft RPC calls, Pluggable Authentication Modules, and the Name + Service Switch to allow Windows NT domain users to appear and operate + as UNIX users on a UNIX machine. This paper describes the winbind + system, explaining the functionality it provides, how it is configured, + and how it works internally.

11.2. Introduction

It is well known that UNIX and Microsoft Windows NT have + different models for representing user and group information and + use different technologies for implementing them. This fact has + made it difficult to integrate the two systems in a satisfactory + manner.

One common solution in use today has been to create + identically named user accounts on both the UNIX and Windows systems + and use the Samba suite of programs to provide file and print services + between the two. This solution is far from perfect however, as + adding and deleting users on both sets of machines becomes a chore + and two sets of passwords are required both of which + can lead to synchronization problems between the UNIX and Windows + systems and confusion for users.

We divide the unified logon problem for UNIX machines into + three smaller problems:

  • Obtaining Windows NT user and group information +

  • Authenticating Windows NT users +

  • Password changing for Windows NT users +

Ideally, a prospective solution to the unified logon problem + would satisfy all the above components without duplication of + information on the UNIX machines and without creating additional + tasks for the system administrator when maintaining users and + groups on either system. The winbind system provides a simple + and elegant solution to all three components of the unified logon + problem.

11.3. What Winbind Provides

Winbind unifies UNIX and Windows NT account management by + allowing a UNIX box to become a full member of a NT domain. Once + this is done the UNIX box will see NT users and groups as if + they were native UNIX users and groups, allowing the NT domain + to be used in much the same manner that NIS+ is used within + UNIX-only environments.

The end result is that whenever any + program on the UNIX machine asks the operating system to lookup + a user or group name, the query will be resolved by asking the + NT domain controller for the specified domain to do the lookup. + Because Winbind hooks into the operating system at a low level + (via the NSS name resolution modules in the C library) this + redirection to the NT domain controller is completely + transparent.

Users on the UNIX machine can then use NT user and group + names as they would use "native" UNIX names. They can chown files + so that they are owned by NT domain users or even login to the + UNIX machine and run a UNIX X-Window session as a domain user.

The only obvious indication that Winbind is being used is + that user and group names take the form DOMAIN\user and + DOMAIN\group. This is necessary as it allows Winbind to determine + that redirection to a domain controller is wanted for a particular + lookup and which trusted domain is being referenced.

Additionally, Winbind provides an authentication service + that hooks into the Pluggable Authentication Modules (PAM) system + to provide authentication via a NT domain to any PAM enabled + applications. This capability solves the problem of synchronizing + passwords between systems since all passwords are stored in a single + location (on the domain controller).

11.3.1. Target Uses

Winbind is targeted at organizations that have an + existing NT based domain infrastructure into which they wish + to put UNIX workstations or servers. Winbind will allow these + organizations to deploy UNIX workstations without having to + maintain a separate account infrastructure. This greatly + simplifies the administrative overhead of deploying UNIX + workstations into a NT based organization.

Another interesting way in which we expect Winbind to + be used is as a central part of UNIX based appliances. Appliances + that provide file and print services to Microsoft based networks + will be able to use Winbind to provide seamless integration of + the appliance into the domain.

11.4. How Winbind Works

The winbind system is designed around a client/server + architecture. A long running winbindd daemon + listens on a UNIX domain socket waiting for requests + to arrive. These requests are generated by the NSS and PAM + clients and processed sequentially.

The technologies used to implement winbind are described + in detail below.

11.4.1. Microsoft Remote Procedure Calls

Over the last two years, efforts have been underway + by various Samba Team members to decode various aspects of + the Microsoft Remote Procedure Call (MSRPC) system. This + system is used for most network related operations between + Windows NT machines including remote management, user authentication + and print spooling. Although initially this work was done + to aid the implementation of Primary Domain Controller (PDC) + functionality in Samba, it has also yielded a body of code which + can be used for other purposes.

Winbind uses various MSRPC calls to enumerate domain users + and groups and to obtain detailed information about individual + users or groups. Other MSRPC calls can be used to authenticate + NT domain users and to change user passwords. By directly querying + a Windows PDC for user and group information, winbind maps the + NT account information onto UNIX user and group names.

9.4.2. Name Service Switch11.4.2. Name Service Switch

The Name Service Switch, or NSS, is a feature that is @@ -8110,8 +9413,8 @@ CLASS="SECT2" >

9.4.3. Pluggable Authentication Modules11.4.3. Pluggable Authentication Modules

Pluggable Authentication Modules, also known as PAM, @@ -8159,8 +9462,8 @@ CLASS="SECT2" >

9.4.4. User and Group ID Allocation11.4.4. User and Group ID Allocation

When a user or group is created under Windows NT @@ -8185,8 +9488,8 @@ CLASS="SECT2" >

9.4.5. Result Caching11.4.5. Result Caching

An active system can generate a lot of user and group @@ -8208,8 +9511,8 @@ CLASS="SECT1" >

9.5. Installation and Configuration11.5. Installation and Configuration

Many thanks to John Trostel

9.5.1. Introduction11.5.1. Introduction

This HOWTO describes the procedures used to get winbind up and @@ -8278,8 +9581,8 @@ CLASS="SECT2" >

9.5.2. Requirements11.5.2. Requirements

If you have a samba configuration file that you are currently @@ -8336,8 +9639,8 @@ CLASS="SECT2" >

9.5.3. Testing Things Out11.5.3. Testing Things Out

Before starting, it is probably best to kill off all the SAMBA @@ -8381,8 +9684,8 @@ CLASS="SECT3" >

9.5.3.1. Configure and compile SAMBA11.5.3.1. Configure and compile SAMBA

The configuration and compilation of SAMBA is pretty straightforward. @@ -8456,8 +9759,8 @@ CLASS="SECT3" >

9.5.3.2. Configure 11.5.3.2. Configure nsswitch.conf and the @@ -8546,8 +9849,8 @@ CLASS="SECT3" >

9.5.3.3. Configure smb.conf11.5.3.3. Configure smb.conf

Several parameters are needed in the smb.conf file to control @@ -8630,8 +9933,8 @@ CLASS="SECT3" >

9.5.3.4. Join the SAMBA server to the PDC domain11.5.3.4. Join the SAMBA server to the PDC domain

Enter the following command to make the SAMBA server join the @@ -8654,7 +9957,7 @@ CLASS="PROMPT" >root# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U Administrator/usr/local/samba/bin/net rpc join -s PDC -U Administrator

The proper response to the command should be: "Joined the domain @@ -8676,8 +9979,8 @@ CLASS="SECT3" >

9.5.3.5. Start up the winbindd daemon and test it!11.5.3.5. Start up the winbindd daemon and test it!

Eventually, you will want to modify your smb startup script to @@ -8817,8 +10120,8 @@ CLASS="SECT3" >

9.5.3.6. Fix the 11.5.3.6. Fix the /etc/rc.d/init.d/smb startup files

9.5.3.7. Configure Winbind and PAM11.5.3.7. Configure Winbind and PAM

If you have made it this far, you know that winbindd and samba are working @@ -9169,8 +10472,8 @@ CLASS="SECT1" >

9.6. Limitations11.6. Limitations

Winbind has a number of limitations in its current @@ -9210,8 +10513,8 @@ CLASS="SECT1" >

9.7. Conclusion11.7. Conclusion

The winbind system, through the use of the Name Service @@ -9227,23 +10530,23 @@ CLASS="CHAPTER" >

Chapter 10. OS2 Client HOWTOChapter 12. OS2 Client HOWTO

10.1. FAQs12.1. FAQs

10.1.1. How can I configure OS/2 Warp Connect or +NAME="AEN2258" +>12.1.1. How can I configure OS/2 Warp Connect or OS/2 Warp 4 as a client for Samba?

10.1.2. How can I configure OS/2 Warp 3 (not Connect), +NAME="AEN2273" +>12.1.2. How can I configure OS/2 Warp 3 (not Connect), OS/2 1.2, 1.3 or 2.x for Samba?

10.1.3. Are there any other issues when OS/2 (any version) +NAME="AEN2282" +>12.1.3. Are there any other issues when OS/2 (any version) is used as a client?

10.1.4. How do I get printer driver download working +NAME="AEN2286" +>12.1.4. How do I get printer driver download working for OS/2 clients?

Chapter 11. HOWTO Access Samba source code via CVSChapter 13. HOWTO Access Samba source code via CVS

11.1. Introduction13.1. Introduction

Samba is developed in an open environment. Developers use CVS @@ -9454,8 +10757,8 @@ CLASS="SECT1" >

11.2. CVS Access to samba.org13.2. CVS Access to samba.org

The machine samba.org runs a publicly accessible CVS @@ -9467,8 +10770,8 @@ CLASS="SECT2" >

11.2.1. Access via CVSweb13.2.1. Access via CVSweb

You can access the source code via your @@ -9488,8 +10791,8 @@ CLASS="SECT2" >

11.2.2. Access via cvs13.2.2. Access via cvs

You can also access the source code via a @@ -9594,7 +10897,7 @@ CLASS="COMMAND" >

Index

This document describes how to use an LDAP directory for storing Samba user -account information normally stored in the smbpasswd(5) file. It is +account information traditionally stored in the smbpasswd(5) file. It is assumed that the reader already has a basic understanding of LDAP concepts and has a working directory server already installed. For more information on LDAP architectures and Directories, please refer to the following sites.

It may also be helpful to supplement the reading of the HOWTO with -the Two additional Samba resources which may prove to be helpful are

  • The Samba-PDC-LDAP-HOWTO -maintained by Ignacio Coupeau.

  • The NT migration scripts from IDEALX that are + geared to manage users and group in such a Samba-LDAP Domain Controller configuration. +

Introduction

  • The first is that all lookups must be performed sequentially. Given that there are approximately two lookups per domain logon (one for a normal session connection such as when mapping a network drive or printer), this -is non-optimal. What is needed is an indexed approach such as is used in -databases.

  • The second problem is that administrators who desired to replicate a smbpasswd file to more than one Samba server were left to use external @@ -116,15 +139,19 @@ CLASS="COMMAND" >ssh(1) and wrote custom, in-house scripts.

  • And finally, the amount of information which is stored in an smbpasswd entry leaves no room for additional attributes such as a home directory, password expiration time, or even a Relative Identified (RID).

As a result of these defeciencies, a more robust means of storing user attributes used by smbd was developed. The API which defines access to user accounts -is referred to as the samdb interface (previously this was called the passdb +is commonly referred to as the samdb interface (previously this was called the passdb API, and is still so named in the CVS trees). In Samba 2.2.3, enabling support for a samdb backend (e.g.

Supported LDAP Servers

Schema and Relationship to the RFC 2307 posixAccount

The samba.schema file has been formatted for OpenLDAP 2.0. The OID's are @@ -264,6 +291,23 @@ This means that the Samba server must also have the LDAP NSS library installed and functioning correctly. This division of information makes it possible to store all Samba account information in LDAP, but still maintain UNIX account information in NIS while the network is transitioning to a full LDAP infrastructure.

Configuring Samba with LDAP

OpenLDAP configuration

To include support for the sambaAccount object in an OpenLDAP directory server, first copy the samba.schema file to slapd's configuration directory.

It is recommended that you maintain some indices on some of the most usefull attributes, +like in the following example, to speed up searches made on sambaAccount objectclasses +(and possibly posixAccount and posixGroup as well).

# Indices to maintain
+## required by OpenLDAP 2.0
+index objectclass   eq
+
+## support pb_getsampwnam()
+index uid           pres,eq
+## support pdb_getsambapwrid()
+index rid           eq
+
+## uncomment these if you are storing posixAccount and
+## posixGroup entries in the directory as well
+##index uidNumber     eq
+##index gidNumber     eq
+##index cn            eq
+##index memberUid     eq

smb.conf LDAP parameters

Configuring Samba

The following parameters are available in smb.conf only with ' to store the # passphrase in the secrets.tdb file. If the "ldap admin dn" values # changes, this password will need to be reset. - ldap admin dn = "cn=Manager,dc=samba,dc=org" + ldap admin dn = "cn=Samba Manager,ou=people,dc=samba,dc=org" # specify the LDAP server's hostname (defaults to locahost) ldap server = ahab.samba.org @@ -434,12 +501,38 @@ CLASS="REPLACEABLE" # ldap filter = "(&(uid=%u)(objectclass=sambaAccount))"

Accounts and Groups management

As users accounts are managed thru the sambaAccount objectclass, you should +modify you existing administration tools to deal with sambaAccount attributes.

Machines accounts are managed with the sambaAccount objectclass, just +like users accounts. However, it's up to you to stored thoses accounts +in a different tree of you LDAP namespace: you should use +"ou=Groups,dc=plainjoe,dc=org" to store groups and +"ou=People,dc=plainjoe,dc=org" to store users. Just configure your +NSS and PAM accordingly (usually, in the /etc/ldap.conf configuration +file).

In Samba release 2.2.3, the group management system is based on posix +groups. This meand that Samba make usage of the posixGroup objectclass. +For now, there is no NT-like group system management (global and local +groups).

Security and sambaAccount

These password hashes are clear text equivalents and can be used to impersonate -the user without deriving the original clear text strings.

ENCRYPTION chapter of the Samba-HOWTO-Collection.

To remedy the first security issue, the "ldap ssl" smb.conf parameter defaults to require an encrypted session (ldap ssl = off).

Note that the LDAPS protocol is deprecated in favor of the LDAPv3 StartTLS +extended operation. However, the OpenLDAP library still provides support for +the older method of securing communication between clients and servers.

The second security precaution is to prevent non-administrative users from harvesting password hashes from the directory. This can be done using the following ACL in 

## allow users to update their own password, but not to browse others
-access to attrs=userPassword,lmPassword,ntPassword
-     by self write
-     by * auth
## allow the "ldap admin dn" access, but deny everyone else +access to attrs=lmPassword,ntPassword + by dn="cn=Samba Admin,ou=people,dc=plainjoe,dc=org" write + by * none

You may of course, add in write access to administrative DN's as necessary.

LDAP specials attributes for sambaAccounts

There are currently four sambaAccount attributes which map directly onto -smb.conf parameters.

The sambaAccount objectclass is composed of the following attributes:

  • smbHome -> "logon home"

    lmPassword: the LANMAN password 16-byte hash stored as a character + representation of a hexidecimal string.

  • ntPassword: the NT password hash 16-byte stored as a character + representation of a hexidecimal string.

  • profilePath -> "logon path"

    pwdLastSet: The integer time in seconds since 1970 when the + lmPassword and ntPassword attributes were last set. +

  • homeDrive -> "logon drive"

    acctFlags: string of 11 characters surrounded by square brackets [] + representing account flags such as U (user), W(workstation), X(no password expiration), and + D(disabled).

  • scriptPath -> "logon script"

    logonTime: Integer value currently unused

  • logoffTime: Integer value currently unused

  • kickoffTime: Integer value currently unused

  • pwdCanChange: Integer value currently unused

  • pwdMustChange: Integer value currently unused

  • homeDrive: specifies the drive letter to which to map the + UNC path specified by homeDirectory. The drive letter must be specified in the form "X:" + where X is the letter of the drive to map. Refer to the "logon drive" parameter in the + smb.conf(5) man page for more information.

  • scriptPath: The scriptPath property specifies the path of + the user's logon script, .CMD, .EXE, or .BAT file. The string can be null. The path + is relative to the netlogon share. Refer to the "logon script" parameter in the + smb.conf(5) man page for more information.

  • profilePath: specifies a path to the user's profile. + This value can be a null string, a local absolute path, or a UNC path. Refer to the + "logon path" parameter in the smb.conf(5) man page for more information.

  • smbHome: The homeDirectory property specifies the path of + the home directory for the user. The string can be null. If homeDrive is set and specifies + a drive letter, homeDirectory should be a UNC path. The path must be a network + UNC path of the form \\server\share\directory. This value can be a null string. + Refer to the "logon home" parameter in the smb.conf(5) man page for more information. +

  • userWorkstation: character string value currently unused. +

  • rid: the integer representation of the user's relative identifier + (RID).

  • primaryGroupID: the relative identifier (RID) of the primary group + of the user.

First of all, these parameters are only used when Samba is acting as a -PDC or a domain (refer to the The majority of these parameters are only used when Samba is acting as a PDC of +a domain (refer to the Samba-PDC-HOWTO -for details on how to configure Samba as a Primary Domain Controller). -Furthermore, these attributes are only stored with the sambaAccount entry if +> for details on +how to configure Samba as a Primary Domain Controller). The following four attributes +are only stored with the sambaAccount entry if the values are non-default values:

  • smbHome

  • scriptPath

  • logonPath

  • homeDrive

These attributes are only stored with the sambaAccount entry if the values are non-default values. For example, assume TASHTEGO has now been configured as a PDC and that logon home string is expanded to \\TASHTEGO\becky.

If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", +> string is expanded to \\TASHTEGO\becky. +If the smbHome attribute exists in the entry "uid=becky,ou=people,dc=samba,dc=org", this value is used. However, if this attribute does not exist, then the value of the

Example LDIF Entries for a sambaAccount

Comments

root# /usr/local/samba/bin/smbpasswd -j DOMAIN -r PDC -U Administrator/usr/local/samba/bin/net rpc join -s PDC -U Administrator

The proper response to the command should be: "Joined the domain -- cgit