<div dir="ltr"><span style="color:rgb(66,66,66);font-family:monospace,monospace;font-size:16px;line-height:27.2000007629395px">This part of the email looks interesting:</span><div><font color="#424242" face="monospace, monospace"><span style="font-size:16px;line-height:27.2000007629395px"><br></span></font><div><span style="color:rgb(80,0,80);font-size:12.8000001907349px">But if you</span><br style="color:rgb(80,0,80);font-size:12.8000001907349px"><span style="color:rgb(80,0,80);font-size:12.8000001907349px">want them in conf t mode but restrict their commands at that level, you</span><br style="color:rgb(80,0,80);font-size:12.8000001907349px"><span style="color:rgb(80,0,80);font-size:12.8000001907349px">need to enable something like this:</span><br style="color:rgb(80,0,80);font-size:12.8000001907349px"><br style="color:rgb(80,0,80);font-size:12.8000001907349px"><span style="color:rgb(80,0,80);font-size:12.8000001907349px">aaa authorization config-commands default group myTacacsGroup local</span><br style="color:rgb(80,0,80);font-size:12.8000001907349px"></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Aug 6, 2015 at 10:10 AM, <span dir="ltr"><<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey Aaron,<br>
<br>
Sorry to keep bothering you - I am pulling my hair out trying to get this<br>
working!! I scrapped the mavvis version and installed the native version of<br>
tac_plus (tac_plus version F4.0.4.28) and authorization seems to fail for<br>
devices, here is my config. Do you see something amiss? I also tried<br>
getting 'do_auth' to work but that doesn't work either.<br>
<span class=""><br>
Arista1#sh run | i aaa<br>
aaa group server tacacs+ CiscoACS<br>
aaa authentication login default group CiscoACS local<br>
</span>aaa authorization exec default group CiscoACS none<br>
aaa authorization commands 0-14 default group CiscoACS local<br>
aaa authorization commands 15 default group CiscoACS none<br>
<span class="">aaa accounting exec default start-stop group CiscoACS<br>
aaa accounting commands all default start-stop group CiscoACS<br>
no aaa root<br>
</span>Arista1#<br>
<span class=""><br>
<br>
group = snm {<br>
default service = deny<br>
</span> default<br>
<span class=""> service = exec {<br>
priv-lvl = 15<br>
}<br>
</span> cmd = show {<br>
permit ip<br>
permit interface<br>
<div><div class="h5"> }<br>
cmd = configure {<br>
deny .*<br>
}<br>
cmd = clear {<br>
permit "counters"<br>
permit "qos stat"<br>
permit "mls qos int"<br>
}<br>
cmd = disable {<br>
permit .*<br>
}<br>
cmd = enable {<br>
permit .*<br>
}<br>
cmd = end {<br>
permit .*<br>
}<br>
cmd = exit {<br>
permit .*<br>
}<br>
cmd = logout {<br>
permit .*<br>
}<br>
cmd = ping {<br>
permit .*<br>
}<br>
cmd = set {<br>
permit "length 0"<br>
}<br>
cmd = show {<br>
deny "controllers vip"<br>
permit .*<br>
}<br>
cmd = skip-page-display {<br>
permit .*<br>
}<br>
cmd = terminal {<br>
permit "length 0"<br>
}<br>
cmd = write {<br>
permit "network"<br>
permit "terminal"<br>
permit "memory"<br>
}<br>
}<br>
<br>
<br>
<br>
user = testuser {<br>
</div></div> login = PAM<br>
member = snm<br>
}<br>
<br>
<br>
!!! router allows commands which should be denied !!<br>
<br>
<br>
Arista1 login: testuser<br>
Password:<br>
Last login: Thu Aug 6 16:12:19 on ttyS0<br>
Arista1>en<br>
Password:<br>
Arista1#configure terminal <-------- Should be denied<br>
Arista1(config)#interface ethernet 10 <----------- Should be denied<br>
Arista1(config-if-Et10)#shut <----------- Should be denied<br>
Arista1(config-if-Et10)#no shut <----------- Should be denied<br>
Arista1(config-if-Et10)#end<br>
Arista1#<br>
<br>
<br>
<br>
!!! SAME EXAMPLE WITH DO_AUTH<br>
<span class=""><br>
<br>
<br>
group = snm {<br>
default service = deny<br>
</span> default<br>
<span class=""> service = exec {<br>
priv-lvl = 15<br>
}<br>
</span> cmd = show {<br>
permit ip<br>
permit interface<br>
<div><div class="h5"> }<br>
cmd = configure {<br>
deny .*<br>
}<br>
cmd = clear {<br>
permit "counters"<br>
permit "qos stat"<br>
permit "mls qos int"<br>
}<br>
cmd = disable {<br>
permit .*<br>
}<br>
cmd = enable {<br>
permit .*<br>
}<br>
cmd = end {<br>
permit .*<br>
}<br>
cmd = exit {<br>
permit .*<br>
}<br>
cmd = logout {<br>
permit .*<br>
}<br>
cmd = ping {<br>
permit .*<br>
}<br>
cmd = set {<br>
permit "length 0"<br>
}<br>
cmd = show {<br>
deny "controllers vip"<br>
permit .*<br>
}<br>
cmd = skip-page-display {<br>
permit .*<br>
}<br>
cmd = terminal {<br>
permit "length 0"<br>
}<br>
cmd = write {<br>
permit "network"<br>
permit "terminal"<br>
permit "memory"<br>
}<br>
</div></div> after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.pyc<br>
-u $user -l /var/log/tacacs/do_auth_log.txt<br>
-f /usr/local/sbin/tacplus/do_auth.ini"<br>
}<br>
<br>
<br>
<br>
<br>
<br>
Arista1 login: testuser<br>
Password:<br>
Last login: Thu Aug 6 16:14:44 on ttyS0<br>
Arista1>en<br>
Password:<br>
Arista1#configure terminal <-------- Should be denied<br>
Arista1(config)#interface ethernet 10 <-------- Should be denied<br>
Arista1(config-if-Et10)#shut <-------- Should be denied<br>
Arista1(config-if-Et10)#no shut<br>
Arista1(config-if-Et10)#end<br>
Arista1#<br>
<br>
<br>
!! When i run the debug to do_auth it just hangs at prompt, meaning it does<br>
not run then hand back the prompt:<br>
<br>
tac01 tacplus $ sudo /usr/bin/python2 /usr/local/sbin/tacplus/do_auth.py -u<br>
$user -l /var/log/tacacs/do_auth_log.txt<br>
-f /usr/local/sbin/tacplus/do_auth.ini -D<br>
<br>
this is what i would expect:<br>
<br>
tac01 tacplus $ sudo /usr/bin/python2 /usr/local/sbin/tacplus/do_auth.py -u<br>
$user -l /var/log/tacacs/do_auth_log.txt<br>
-f /usr/local/sbin/tacplus/do_auth.ini -D<br>
tac01 tacplus $<br>
<br>
<br>
!! do_auth.ini<br>
<br>
tac01 tacplus $ cat do_auth.ini<br>
[users]<br>
kcruse =<br>
snm<br>
[snm]<br>
command_deny =<br>
configure .*<br>
terminal .*<br>
interface .*<br>
shutdown .*<br>
command_permit =<br>
show.*<br>
hcvmtac01 tacplus $<br>
<span class=""><br>
<br>
<br>
From: Aaron Wasserott <<a href="mailto:aaron.wasserott@viawest.com">aaron.wasserott@viawest.com</a>><br>
To: "Kevin.Cruse@Instinet.com" <Kevin.Cruse@Instinet.com>,<br>
</span>Cc: "<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a>" <<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a>><br>
Date: 07/22/2015 03:28 PM<br>
<span class="">Subject: RE: [tac_plus] Cisco Nexus Authorization problem<br>
<br>
<br>
<br>
</span><div><div class="h5">Kevin,<br>
<br>
I just tested this and it works for me. User can run show commands, but not<br>
enter conf t mode.<br>
<br>
Arista DCS-7050S-52-R running code 4.8.3. In production we run do_auth. It<br>
comes bundled with the latest version of tac_plus and makes tweaking<br>
authorization a lot easier. It’s more scalable, syntax is cleaner, and it<br>
has its own authorization logs which are easier to read.<br>
<br>
# tac_plus.conf<br>
<br>
group = tier1 {<br>
default service = permit<br>
login = PAM<br>
pap = PAM<br>
default command = deny<br>
cmd = show {permit .*}<br>
service = exec {<br>
priv-lvl = 15<br>
}<br>
service = raccess {<br>
priv-lvl = 0<br>
}<br>
}<br>
<br>
user = first.last {<br>
member = tier1<br>
}<br>
<br>
# switch AAA commands<br>
aaa group server tacacs+ TacGroup<br>
aaa authentication login default group TacGroup local<br>
aaa authorization exec default group TacGroup none<br>
aaa authorization commands 15 default group TacGroup none<br>
aaa accounting exec default start-stop group TacGroup<br>
aaa accounting commands 15 default start-stop group TacGroup<br>
no aaa root<br>
<br>
-Aaron<br>
<br>
From: Kevin.Cruse@Instinet.com [mailto:<a href="mailto:Kevin.Cruse@Instinet.com">Kevin.Cruse@Instinet.com</a>]<br>
Sent: Wednesday, July 22, 2015 12:44 PM<br>
To: Aaron Wasserott<br>
Cc: <a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
Subject: RE: [tac_plus] Cisco Nexus Authorization problem<br>
<br>
<br>
<br>
Aaron<br>
<br>
Do you have experience with Arista? It seems I am having similar problem<br>
with this device. Authentication works fine, but once i login and send<br>
enable password I can run any command i'd like. It's not restricting access<br>
to my preconfigured commands:<br>
<br>
<br>
Arista1#sh run | i aaa<br>
aaa group server tacacs+ CiscoACS<br>
aaa authentication login default group CiscoACS local<br>
aaa authorization exec default group CiscoACS local<br>
aaa authorization commands all default group CiscoACS local<br>
aaa accounting exec default start-stop group CiscoACS<br>
aaa accounting commands all default start-stop group CiscoACS<br>
no aaa root<br>
<br>
-----<br>
<br>
user = testuser {<br>
login = clear "test123"<br>
pap = clear "test123"<br>
member = snm<br>
}<br>
<br>
<br>
group = snm {<br>
default service = deny<br>
service = shell {<br>
set shell:roles="\"network-admin\""<br>
default command = deny<br>
default attribute = deny<br>
set priv-lvl = 15<br>
cmd = configure {deny .*}<br>
cmd = clear {<br>
permit "counters"<br>
permit "qos stat"<br>
permit "mls qos int"<br>
}<br>
cmd = disable {permit .*}<br>
cmd = enable {permit .*}<br>
cmd = end {permit .*}<br>
cmd = exit {permit .*}<br>
cmd = logout {permit .*}<br>
cmd = ping {permit .*}<br>
cmd = set {<br>
permit "length 0"<br>
}<br>
cmd = show {<br>
deny "controllers vip"<br>
permit .*<br>
}<br>
cmd = skip-page-display {permit .*}<br>
cmd = terminal {<br>
permit "length 0"<br>
}<br>
cmd = write {<br>
permit "network"<br>
permit "terminal"<br>
permit "memory"<br>
}<br>
}<br>
}<br>
<br>
----<br>
<br>
<br>
Arista1 login: testuser<br>
Password:<br>
Last login: Wed Jul 22 18:49:42 on ttyS0<br>
Arista1>en<br>
Password:<br>
Arista1#conf t <--- This command should be restricted<br>
Arista1(config)#interface eth 10 <--- This command should be restricted<br>
Arista1(config-if-Et10)#shut <--- This command should be restricted<br>
Arista1(config-if-Et10)#end<br>
Arista1#exit<br>
<br>
<br>
<br>
Inactive hide details for Aaron Wasserott ---07/16/2015 09:26:32 PM---Try<br>
</div></div>changing "service = shell" to "service = exec" and seAaron Wasserott<br>
<span class="">---07/16/2015 09:26:32 PM---Try changing "service = shell" to "service =<br>
exec" and see if that works. I have NX-OS working fine<br>
<br>
From: Aaron Wasserott <<a href="mailto:aaron.wasserott@viawest.com">aaron.wasserott@viawest.com</a>><br>
</span>To: "Kevin.Cruse@Instinet.com" <Kevin.Cruse@Instinet.com>, "<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a>" <<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a>>,<br>
<span class="">Date: 07/16/2015 09:26 PM<br>
Subject: RE: [tac_plus] Cisco Nexus Authorization problem<br>
<br>
<br>
<br>
<br>
</span><span class="">Try changing "service = shell" to "service = exec" and see if that works. I<br>
have NX-OS working fine using that. Also, I have never seen the shell<br>
service used in real-world examples for network devices. But reading the<br>
manpage it appears it should work to prevent them from entering<br>
configuration mode, as long as your AAA commands are set right.<br>
<br>
service=shell<br>
for exec startup, and also for command authorizations.<br>
Requires: aaa authorization exec tacacs+<br>
<br>
Whether authorization happens, and at which prompt level, depends on the<br>
aaa authorization settings. It's possible to only restrict exec level<br>
commands, and prevent them from entering the 'conf t' command. But if you<br>
want them in conf t mode but restrict their commands at that level, you<br>
need to enable something like this:<br>
<br>
aaa authorization config-commands default group myTacacsGroup local<br>
<br>
If changing the service doesn't work, include the AAA commands on your<br>
NX-OS switches.<br>
<br>
-----Original Message-----<br>
From: tac_plus [mailto:<a href="mailto:tac_plus-bounces@shrubbery.net">tac_plus-bounces@shrubbery.net</a>] On Behalf Of<br>
Kevin.Cruse@Instinet.com<br>
</span><span class="">Sent: Thursday, July 16, 2015 3:40 PM<br>
To: <a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
</span><div><div class="h5">Subject: [tac_plus] Cisco Nexus Authorization problem<br>
<br>
<br>
<br>
Hello<br>
<br>
I have configured TACPLUS to work with cisco nexus device. I am able to<br>
successfully authenticate, however, I am able to run all commands on<br>
router. It seems the router is not restricted to the commands specified in<br>
my group config. Has anyone gotten Cisco nexus to work properly with<br>
tacplus? I need to limit certain users and cannot get this working<br>
properly. Any help is greatly appreciated!!! Thanks.<br>
<br>
Group Config:<br>
<br>
group = snm {<br>
default service = deny<br>
service = shell {<br>
set shell:roles="\"network-admin\""<br>
default command = deny<br>
default attribute = deny<br>
set priv-lvl = 15<br>
cmd = configure {deny .*}<br>
cmd = clear {<br>
permit "counters"<br>
permit "qos stat"<br>
permit "mls qos int"<br>
}<br>
cmd = disable {permit .*}<br>
cmd = enable {permit .*}<br>
cmd = end {permit .*}<br>
cmd = exit {permit .*}<br>
cmd = logout {permit .*}<br>
cmd = ping {permit .*}<br>
cmd = set {<br>
permit "length 0"<br>
}<br>
cmd = show {<br>
deny "controllers vip"<br>
permit .*<br>
}<br>
cmd = skip-page-display {permit .*}<br>
cmd = terminal {<br>
permit "length 0"<br>
}<br>
cmd = write {<br>
permit "network"<br>
permit "terminal"<br>
permit "memory"<br>
}<br>
}<br>
}<br>
<br>
<br>
user = testuser {<br>
<br>
member = snm<br>
}<br>
<br>
<br>
Session output from router:<br>
<br>
telnet labrouter<br>
Trying labrouter...<br>
Connected to labrouter.<br>
Escape character is '^]'.<br>
User Access Verification<br>
login: testuser<br>
Password:<br>
Cisco Nexus Operating System (NX-OS) Software TAC support:<br>
<a href="http://www.cisco.com/tac" rel="noreferrer" target="_blank">http://www.cisco.com/tac</a> Copyright (c) 2002-2014, Cisco Systems, Inc. All<br>
rights reserved.<br>
The copyrights to certain works contained in this software are owned by<br>
other third parties and used and distributed under license. Certain<br>
components of this software are licensed under the GNU General Public<br>
License (GPL) version 2.0 or the GNU Lesser General Public License (LGPL)<br>
Version 2.1. A copy of each such license is available at<br>
<a href="http://www.opensource.org/licenses/gpl-2.0.php" rel="noreferrer" target="_blank">http://www.opensource.org/licenses/gpl-2.0.php</a> and<br>
<a href="http://www.opensource.org/licenses/lgpl-2.1.php" rel="noreferrer" target="_blank">http://www.opensource.org/licenses/lgpl-2.1.php</a><br>
LABROUTER# configure<br>
<------------------------------------------------------------ This should<br>
be denied Enter configuration commands, one per line. End with CNTL/Z.<br>
LABROUTER(config)# interface ethernet 1/1 configure<br>
<------------------------------------------------------------ This should<br>
be denied LABROUTER(config-if)# shut<br>
<------------------------------------------------------------ This should<br>
be denied LABROUTER(config-if)# no shut<br>
<------------------------------------------------------------ This should<br>
be denied LABROUTER(config-if)# end LABROUTER#<br>
<br>
=========================================================================================================<br>
<<<< Disclaimer >>>> This message is intended solely for use by the<br>
named addressee(s). If you receive this transmission in error, please<br>
immediately notify the sender and destroy this message in its entirety,<br>
whether in electronic or hard copy format. Any unauthorized use (and<br>
reliance thereon), copying, disclosure, retention, or distribution of this<br>
transmission or the material in this transmission is forbidden. We reserve<br>
the right to monitor and archive electronic communications. This material<br>
does not constitute an offer or solicitation with respect to the purchase<br>
or sale of any security. It should not be construed to contain any<br>
recommendation regarding any security or strategy. Any views expressed are<br>
those of the individual sender, except where the message states otherwise<br>
and the sender is authorized to state them to be the views of any such<br>
entity. This communication is provided on an “as is” basis. It contains<br>
material that is owned by Instinet Incorporated, its subsidiaries or its or<br>
their licensors, and may not, in whole or in part, be (i) copied,<br>
photocopied or duplicated in any form, by any means, or (ii) redistributed,<br>
posted, published, excerpted, or quoted without Instinet Incorporated's<br>
prior written consent. Please access the following link for important<br>
information and instructions:<br>
<a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" rel="noreferrer" target="_blank">http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</a><br>
Securities products and services are provided by locally registered<br>
brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty<br>
Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian<br>
Securities & Investments Commission; Instinet Canada Limited, member<br>
IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the<br>
Securities and Futures Commission of Hong Kong; Instinet Singapore Services<br>
Private Limited, regulated by the Monetary Authority of Singapore, trading<br>
member of The Singapore Exchange Securities Trading Private Limited and<br>
clearing member of The Central Depository (Pte) Limited; and Instinet, LLC,<br>
member SIPC.<br>
<br>
=========================================================================================================<br>
<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<br>
<a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20150716/5c309608/attachment.html" rel="noreferrer" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20150716/5c309608/attachment.html</a><br>
><br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
</div></div><div><div class="h5"><a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" rel="noreferrer" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
This message contains information that may be confidential, privileged or<br>
otherwise protected by law from disclosure. It is intended for the<br>
exclusive use of the addressee(s). Unless you are the addressee or<br>
authorized agent of the addressee, you may not review, copy, distribute or<br>
disclose to anyone the message or any information contained within. If you<br>
have received this message in error, please contact the sender by<br>
electronic reply and immediately delete all copies of the message.<br>
<br>
<br>
=========================================================================================================<br>
<br>
<br>
<br>
<<<< Disclaimer >>>><br>
<br>
<br>
This message is intended solely for use by the named addressee(s). If you<br>
receive this transmission in error, please immediately notify the sender<br>
and destroy this message in its entirety, whether in electronic or hard<br>
copy format. Any unauthorized use (and reliance thereon), copying,<br>
disclosure, retention, or distribution of this transmission or the material<br>
in this transmission is forbidden. We reserve the right to monitor and<br>
archive electronic communications. This material does not constitute an<br>
offer or solicitation with respect to the purchase or sale of any security.<br>
It should not be construed to contain any recommendation regarding any<br>
security or strategy. Any views expressed are those of the individual<br>
sender, except where the message states otherwise and the sender is<br>
authorized to state them to be the views of any such entity. This<br>
communication is provided on an “as is” basis. It contains material that is<br>
owned by Instinet Incorporated, its subsidiaries or its or their licensors,<br>
and may not, in whole or in part, be (i) copied, photocopied or duplicated<br>
in any form, by any means, or (ii) redistributed, posted, published,<br>
excerpted, or quoted without Instinet Incorporated's prior written consent.<br>
Please access the following link for important information and<br>
instructions:<br>
<a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" rel="noreferrer" target="_blank">http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</a><br>
<br>
<br>
</div></div><span class="">Securities products and services are provided by locally registered<br>
brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty<br>
Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian<br>
Securities & Investments Commission; Instinet Canada Limited, member<br>
IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the<br>
Securities and Futures Commission of Hong Kong; Instinet Singapore Services<br>
Private Limited, regulated by the Monetary Authority of Singapore, trading<br>
member of The Singapore Exchange Securities Trading Private Limited and<br>
clearing member of The Central Depository (Pte) Limited; and Instinet, LLC,<br>
member SIPC.<br>
<br>
<br>
<br>
<br>
=========================================================================================================<br>
<br>
<br>
<br>
This message contains information that may be confidential, privileged or<br>
otherwise protected by law from disclosure. It is intended for the<br>
exclusive use of the addressee(s). Unless you are the addressee or<br>
authorized agent of the addressee, you may not review, copy, distribute or<br>
disclose to anyone the message or any information contained within. If you<br>
have received this message in error, please contact the sender by<br>
electronic reply and immediately delete all copies of the message.<br>
<br>
<br>
<br>
</span><span class="">========================================================================================================= <<<< Disclaimer >>>> This message is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material in this transmission is forbidden. We reserve the right to monitor and archive electronic communications. This material does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This communication is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. Please access the following link for important information and instructions: <a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" rel="noreferrer" target="_blank">http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</a> Securities products and services are provided by locally registered brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian Securities & Investments Commission; Instinet Canada Limited, member IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the Securities and Futures Commission of Hong Kong; Instinet Singapore Services Private Limited, regulated by the Monetary Authority of Singapore, trading member of The Singapore Exchange Securities Trading Private Limited and clearing member of The Central Depository (Pte) Limited; and Instinet, LLC, member SIPC.<br>
<br>
=========================================================================================================<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</span>URL: <<a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20150806/4f638c2e/attachment.html" rel="noreferrer" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20150806/4f638c2e/attachment.html</a>><br>
<span class="">-------------- next part --------------<br>
A non-text attachment was scrubbed...<br>
</span>Name: graycol.gif<br>
<span class="">Type: image/gif<br>
Size: 105 bytes<br>
</span>Desc: not available<br>
URL: <<a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20150806/4f638c2e/attachment.gif" rel="noreferrer" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20150806/4f638c2e/attachment.gif</a>><br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" rel="noreferrer" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
</div></div></blockquote></div><br></div>
<br>
<br>E-Mail to and from me, in connection with the transaction <br>of public business, is subject to the Wyoming Public Records <br>Act and may be disclosed to third parties.<br>