From gww@sac.sfbay.sun.com Wed Sep 10 15:43:25 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8AMhPMd014804 for ; Wed, 10 Sep 2008 15:43:25 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m8AMhNRA053872; Wed, 10 Sep 2008 16:43:25 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K7000I0R4GBIC00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 10 Sep 2008 15:43:23 -0700 (PDT) Received: from dm-sfbay-02.sfbay.sun.com ([129.146.11.31]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K7000MCL4GBEU70@nwk-avmta-1.sfbay.Sun.COM>; Wed, 10 Sep 2008 15:43:23 -0700 (PDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m8AMhG0V009638; Wed, 10 Sep 2008 15:43:16 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8AMhEdu014799; Wed, 10 Sep 2008 15:43:14 -0700 (PDT) Received: (from gww@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m8AMhEFJ014795; Wed, 10 Sep 2008 15:43:14 -0700 (PDT) Date: Wed, 10 Sep 2008 15:43:14 -0700 (PDT) From: Gary Winiger Subject: PSARC/2008/572 Kerberos autologin for r-cmds To: psarc-ext@sun.com Cc: Glenn.Barry@sun.com, Peter.Shoults@sun.com, krb5-core@sun.com Message-id: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 3860 I'm sponsoring this Fast Track for Glenn Barry and the Kerberos project team. It extends the existing ability to autologin telnet(1) sessions to the Berkeley r-cmds. Interface stability levels that match those of the r-cmds options (presumed Commitmented) and krb5.conf(4) configuration variables (Uncommitted) are requested. A Patch release binding is requested. There is an intent to backport minimally to S10 and perhaps as far back as S8. The timer is set for 17 Sept, 2008. As there's no meeting 17 Sept, and there are consumers asking for these changes, the project team requests acknowledgement or discussion from members so the case can complete. Diff marked man pages are in the case directory. A telnet man page is also present for reference. Gary.. =============================================================================== ABSTRACT -------- This proposal extends the krb5.conf(4) autologin configuration variable from applicability only to telnet(1) to rsh(1), rcp(1), rdist(1), and rlogin(1) as well (collectively called the r-cmds). This will allow the system administrator to enable Kerberos-based Single Sign-On on a per-system basis for the r-cmds. This is useful for customers who are transitioning to Kerberos and have many scripts that use the r-cmds and want to enable Kerberos for these cmds without having to change their scripts. BACKGROUND ---------- Currently customers can enable telnet(1) to use Kerberos for Single Sign-On on a system-wide basis via krb5.conf(4): autologin = [true | false] Forces the application to attempt automatic login by presenting Kerberos credentials. This is only valid for the telnet application. The krb5.conf(4) autologin configuration variable is the equivalent of the telnet command line option -a. The telnet(1) -K command line option can override the krb5.conf(4) autologin configuration variable. A customer has noticed this and would like to extend it to the r-cmds. The customer also knows that ssh(1)/scp(1) is the current preferred remote shell/copy program and should be used if possible but they have many legacy scripts that use the r-cmds and need them to work seamlessly as they transition to Kerberos-based NFS. telnet(1) and the r-cmds all currently have the following configuration variables available in krb5.conf(4) (and have equivalent command line options): encrypt = [true | false] forward = [true | false] forwardable = [true | false] while only telnet(1) has the autologin variable available. PROPOSAL -------- - We propose to extend the krb5.conf(4) autologin from telnet(1) to the r-cmds. This will allow the system administrator to enable Kerberos for the r-cmds on a system-wide basis. For example, the krb5.conf(4) autologin variable for rsh(1) can be enabled like so: rsh = { autologin = true } This is the equivalent of the command line "rsh -a ...". The r-cmds will only examine the autologin variable if there is no preference for it given on the command line. And if autologin is not specified in krb5.conf(4), then it defaults to a value of `false'. - We propose to add a new command line option for rsh/rcp/rdist/rlogin of -K to force non-kerberos use and thus can override the krb5.conf(4) autologin variable. Currently -K has this same functionality in telnet(1). Note rlogin(1) already has the -a option which forces non-Kerberos use but we will also add the -K to make it consistent with the other r-cmds. NOTES ----- - These proposed features will need to be backported to Solaris 10 and Solaris 9 (and maybe Solaris 8). - Another way to do this would be to auto-detect Kerberos usage but it was rejected as too radical a change for these remote apps that have been in use for many years. From Darren.Moffat@sun.com Thu Sep 11 03:13:30 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8BADTw7003637 for ; Thu, 11 Sep 2008 03:13:29 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m8BADBP8013400; Thu, 11 Sep 2008 11:13:28 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K7100E0L0EFBG00@brm-avmta-1.central.sun.com>; Thu, 11 Sep 2008 04:13:27 -0600 (MDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K7100B5I0EEZV10@brm-avmta-1.central.sun.com>; Thu, 11 Sep 2008 04:13:27 -0600 (MDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m8BADQiO018207; Thu, 11 Sep 2008 10:13:26 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K7100M01002TN00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM); Thu, 11 Sep 2008 11:13:26 +0100 (BST) Received: from [129.156.173.199] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K710089L0EBHWC0@fe-emea-09.sun.com>; Thu, 11 Sep 2008 11:13:23 +0100 (BST) Date: Thu, 11 Sep 2008 11:13:23 +0100 From: Darren J Moffat Subject: Re: PSARC/2008/572 Kerberos autologin for r-cmds In-reply-to: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> Sender: Darren.Moffat@sun.com To: Gary Winiger Cc: psarc-ext@sun.com, Glenn.Barry@sun.com, Peter.Shoults@sun.com, krb5-core@sun.com Message-id: <48C8EF43.30807@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> User-Agent: Thunderbird 2.0.0.14 (X11/20080714) Status: RO Content-Length: 410 I reviewed this case and I'm happy with the changes it makes and the requested release binding. This case appears very close to self approved anyway in my opinion given the option already existed for telnet. Will this change also be made upstream in the MIT code base ? I'm just curious and the answer doesn't impact my opinion on the architecture of this case being a good thing. -- Darren J Moffat From carlsonj@phorcys.east.sun.com Thu Sep 11 04:50:11 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8BBoACj005938 for ; Thu, 11 Sep 2008 04:50:11 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m8BBo2Vn005643; Thu, 11 Sep 2008 19:50:05 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K71008194VG9100@nwk-avmta-2.sfbay.sun.com>; Thu, 11 Sep 2008 04:50:04 -0700 (PDT) Received: from phorcys.east.sun.com ([129.148.174.143]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K710078K4VEAH10@nwk-avmta-2.sfbay.sun.com>; Thu, 11 Sep 2008 04:50:03 -0700 (PDT) Received: from phorcys.east.sun.com (localhost [127.0.0.1]) by phorcys.east.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m8BBo1FJ004605; Thu, 11 Sep 2008 07:50:01 -0400 (EDT) Received: (from carlsonj@localhost) by phorcys.east.sun.com (8.14.3+Sun/8.14.3/Submit) id m8BBo1Kr004602; Thu, 11 Sep 2008 07:50:01 -0400 (EDT) Date: Thu, 11 Sep 2008 07:50:01 -0400 From: James Carlson Subject: Re: PSARC/2008/572 Kerberos autologin for r-cmds In-reply-to: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> To: Gary Winiger Cc: psarc-ext@sun.com, Glenn.Barry@sun.com, krb5-core@sun.com, Peter.Shoults@sun.com Message-id: <18633.1513.797356.402789@gargle.gargle.HOWL> MIME-version: 1.0 X-Mailer: VM 7.01 under Emacs 21.3.1 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> Status: RO Content-Length: 905 Gary Winiger writes: > - Another way to do this would be to auto-detect Kerberos usage but > it was rejected as too radical a change for these remote apps that > have been in use for many years. Can you expand on that? What harm happens if the command "just works" in the presence of Kerberos? Or, rather, why does the user need to configure the system manually in order to get it to do what it should have done in the first place? This doesn't look at all analogous to the telnet "-a" option to me. That one is quite different because transferring the user name is typically *not* part of the protocol -- where it *is* part of the expected protocol for the r-commands. -- James Carlson, Solaris Networking Sun Microsystems / 35 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 From Glenn.Barry@sun.com Thu Sep 11 13:09:53 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8BK9qUc027106 for ; Thu, 11 Sep 2008 13:09:53 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m8BK9nCD016995; Thu, 11 Sep 2008 21:09:50 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K7100205S0CQA00@nwk-avmta-2.sfbay.sun.com>; Thu, 11 Sep 2008 13:09:48 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K7100LNZS0CCPB0@nwk-avmta-2.sfbay.sun.com>; Thu, 11 Sep 2008 13:09:48 -0700 (PDT) Received: from [129.146.106.91] (zorak.SFBay.Sun.COM [129.146.106.91]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m8BK9lF3007912; Thu, 11 Sep 2008 13:09:48 -0700 (PDT) Date: Thu, 11 Sep 2008 13:09:47 -0700 From: Glenn Barry Subject: Re: PSARC/2008/572 Kerberos autologin for r-cmds In-reply-to: <48C8EF43.30807@Sun.COM> To: Darren J Moffat Cc: Gary Winiger , psarc-ext@sun.com, Peter.Shoults@sun.com, krb5-core@sun.com Message-id: <48C97B0B.6040803@sun.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> <48C8EF43.30807@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080519) Status: RO Content-Length: 507 Darren J Moffat wrote: > I reviewed this case and I'm happy with the changes it makes and the > requested release binding. This case appears very close to self > approved anyway in my opinion given the option already existed for > telnet. > > Will this change also be made upstream in the MIT code base ? I'm > just curious and the answer doesn't impact my opinion on the > architecture of this case being a good thing. > We've not offered it to MIT but it's a good idea so we'll offer it to them. From Glenn.Barry@sun.com Thu Sep 11 16:59:34 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8BNxXFc005297 for ; Thu, 11 Sep 2008 16:59:34 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m8BNxCqg020589; Fri, 12 Sep 2008 00:59:31 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K7200C052N5WN00@nwk-avmta-2.sfbay.sun.com>; Thu, 11 Sep 2008 16:59:29 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K72004EX2N45YF0@nwk-avmta-2.sfbay.sun.com>; Thu, 11 Sep 2008 16:59:28 -0700 (PDT) Received: from [129.146.106.91] (zorak.SFBay.Sun.COM [129.146.106.91]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id m8BNxSL6006268; Thu, 11 Sep 2008 16:59:28 -0700 (PDT) Date: Thu, 11 Sep 2008 16:59:28 -0700 From: Glenn Barry Subject: Re: PSARC/2008/572 Kerberos autologin for r-cmds In-reply-to: <18633.1513.797356.402789@gargle.gargle.HOWL> To: James Carlson Cc: Gary Winiger , psarc-ext@sun.com, krb5-core@sun.com, Peter.Shoults@sun.com Message-id: <48C9B0E0.9090704@sun.com> MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_HA88DBFmS2TTOmYzllW54Q)" X-PMX-Version: 5.4.1.325704 References: <200809102243.m8AMhEFJ014795@sac.sfbay.sun.com> <18633.1513.797356.402789@gargle.gargle.HOWL> User-Agent: Thunderbird 2.0.0.14 (X11/20080519) Status: RO Content-Length: 4334 This is a multi-part message in MIME format. --Boundary_(ID_HA88DBFmS2TTOmYzllW54Q) Content-type: text/plain; charset=ISO-8859-1; format=flowed Content-transfer-encoding: 7BIT James Carlson wrote: > Gary Winiger writes: > >> - Another way to do this would be to auto-detect Kerberos usage but >> it was rejected as too radical a change for these remote apps that >> have been in use for many years. >> > > Can you expand on that? > > What harm happens if the command "just works" in the presence of > Kerberos? Or, rather, why does the user need to configure the system > manually in order to get it to do what it should have done in the > first place? > Yea, agreed it should have done it in the first place. But now that this current behavior has been around for years (since s10 in Solaris, much longer in the MIT Kerb distro apps) we did not want to change the behavior now by default. A possible problem situation is that the default is changed and the kerb rcmd is attempted (if the user has a valid tgt) but the kerb rcmd smf svc is not enabled (for example rlogin&rsh have diff smf svcs for non-kerb and kerb) on the srvr and it either hangs (rsh now) or fails (rlogin now). We could try to rework these clnts to fail faster and fallback to non-kerb but that is beyond the scope of what we want to do here. So we'd rather the user enable this option only if needed (and if the kerb rcmd smf svcs have been enabled). > This doesn't look at all analogous to the telnet "-a" option to me. > That one is quite different because transferring the user name is > typically *not* part of the protocol -- where it *is* part of the > expected protocol for the r-commands. > > At the proto level agreed. But -a, despite the man page not making it clear, is the opt to enable a kerb telnet "autologin". thx, glenn --Boundary_(ID_HA88DBFmS2TTOmYzllW54Q) Content-type: text/html; charset=ISO-8859-1 Content-transfer-encoding: 7BIT James Carlson wrote: 
Gary Winiger writes:
  
 - Another way to do this would be to auto-detect Kerberos usage but
   it was rejected as too radical a change for these remote apps that
   have been in use for many years.
    

Can you expand on that?

What harm happens if the command "just works" in the presence of
Kerberos?  Or, rather, why does the user need to configure the system
manually in order to get it to do what it should have done in the
first place?

Yea, agreed it should have done it in the first place.  But now that this current behavior has been around for years (since s10 in Solaris, much longer in the MIT Kerb distro apps) we did not want to change the behavior now by default.   A possible problem situation is that the default is changed and the kerb rcmd is attempted (if the user has a valid tgt)   but the  kerb rcmd smf svc is not enabled  (for example rlogin&rsh have diff smf svcs for non-kerb and kerb) on the srvr  and  it either hangs (rsh now) or fails (rlogin now).   We could try to rework these clnts to fail faster and fallback to non-kerb but that is beyond the scope of what we want to do here.

So we'd rather the user enable this option only if needed (and if the kerb rcmd smf svcs  have been enabled).

This doesn't look at all analogous to the telnet "-a" option to me.
That one is quite different because transferring the user name is
typically *not* part of the protocol -- where it *is* part of the
expected protocol for the r-commands.

At the proto level agreed.   But -a, despite the man page  not making it clear, is the opt to  enable a kerb telnet "autologin".

thx,
glenn

--Boundary_(ID_HA88DBFmS2TTOmYzllW54Q)-- From gww@eng.sun.com Wed Sep 17 14:01:05 2008 Received: from newsunmail1brm.central.sun.com (newsunmail1brm.Central.Sun.COM [129.147.62.245]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m8HL15ft007025 for ; Wed, 17 Sep 2008 14:01:05 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by newsunmail1brm.central.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m8HL126r004898; Wed, 17 Sep 2008 15:01:04 -0600 (MDT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K7C00503YDRX600@nwk-avmta-1.sfbay.Sun.COM>; Wed, 17 Sep 2008 14:01:03 -0700 (PDT) Received: from dm-eng-02.sfbay.sun.com ([129.146.11.32]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K7C0056JYDRRM00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 17 Sep 2008 14:01:03 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by dm-eng-02.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m8HL12Kw028465; Wed, 17 Sep 2008 14:01:02 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id m8HKupCa021087; Wed, 17 Sep 2008 13:56:51 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id m8HKuo0F021086; Wed, 17 Sep 2008 13:56:50 -0700 (PDT) Date: Wed, 17 Sep 2008 13:56:50 -0700 (PDT) From: Gary Winiger Subject: Re: PSARC/2008/572 Kerberos autologin for r-cmds To: gww@sac.sfbay.sun.com, psarc-ext@sun.com Cc: Glenn.Barry@sun.com, Peter.Shoults@sun.com, krb5-core@sun.com Message-id: <200809172056.m8HKuo0F021086@marduk.eng.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 425 > The timer is set for 17 Sept, 2008. As there's no meeting 17 Sept, > and there are consumers asking for these changes, the project team > requests acknowledgement or discussion from members so the case can > complete. Having received positive acknowledgement and seeing no unresolved issues, I'm marking this case approved. The project team agrees that the changes will be offered to the kerberos community. Gary..