RE: Freeradius proxy to IAS w/SQL attributes?

Alan DeKok wrote: -Original Message- Rob Ansaldo wrote: The IAS server does not have these attributes, nor do we want to use the IAS server for them. Or... you could just use FreeRADIUS for everything. :) We can dream, right? :) Is what I am trying to do possible

Re: different acctuniqueids with common keys?

This is an issue for us as well. It seems in our case, the NAS retransmits the start packet 60 seconds later and this has an impact on the acctuniqueid as shown in the example below: Tue Aug 30 13:32:49 2011 Event-Timestamp = Aug 30 2011 13:32:48 EDT User-Name = u...@example.com

Re: Virtual Server

Thanks Phil. That worked great. On Mar 10, 2011 10:53 AM, Phil Mayers p.may...@imperial.ac.uk wrote: On 10/03/11 16:46, Rob Yamry wrote: Im running FreeRadius 2.1.8 to allow wireless access and that is working great. I now want to have the vpn auth against the freeradius server for access

Virtual Server

Im running FreeRadius 2.1.8 to allow wireless access and that is working great. I now want to have the vpn auth against the freeradius server for access, but checking for a different ldap attribute on the user. I read the virtual servers wiki and it says that all modules are global across virtual

Re: Problem with iPods/iTouches

is using MSCHAPv2 by default. Is that what you were looking for? Thanks for your help- Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Problem with iPods/iTouches

Hmm. Are you asking for a client cert with PEAP; your original trace has: [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending

Re: Problem with iPods/iTouches

I have a very vague recollection we faced something similar to this, and dealt with it by (massively) increasing the EAPOL timeout on our wireless controllers. IIRC the problem is that you have to hit accept fast enough that the original EAP conversation is still in-play. This is a

Re: Problem with iPods/iTouches

and the server cert on the device. Both install fine and say they are trusted. But when I try to connect to the wireless again it says the cert is not verified (just as in the original case) and the connection fails. Same goes for the production environment. This problem is very frustrating! -Rob - List

Stop after mac auth

99% of my config authenticates against ldap. There are certain situations (mainly authenticating our old phones) where I need to have mac auth as well. Both methods are authenticating fine. The problem is that I would like for freeradius to not search ldap when the if ((Service-Type ==

Re: Stop after mac auth

Perfect, thanks. if((Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)){ update control { Auth-Type := 'CSID' } } else{ ldap } - List info/subscribe/unsubscribe? See

Re: ERROR! Our request for peap was NAK'd with a request for peap

New firmware should have been out by now, try updating to latest version. Last I heard back in June was that it was being actively worked on and that a fix had been created. Im already running the latest firmware - v41.05. I guess Ill have to take a different approach to this to get it

Re: ERROR! Our request for peap was NAK'd with a request for peap

That's a little hard to believe. Most printers *don't* do EAP (i.e. 802.1X). Just use it like a printer, without doing 802.1X. Problem is, if the user can't figure how to turn off the 802.1X supplicant, it acts like an 802.1X-2004 supplicant and blocks inbound/outbound traffic if the

ERROR! Our request for peap was NAK'd with a request for peap

I have a HP JetDirect 690n print server that Im trying to authenticate via FreeRadius 2.1.8 for wireless clients to use. If I tell the 690 to use peap then I get the error ERROR! Our request for peap was NAK'd with a request for peap. If I tell it to use eap-tls I get the error ERROR! Our

Re: ERROR! Our request for peap was NAK'd with a request for peap

It pretends to implement EAP, but it does not. Disable EAP for the printer. There isnt an option to disable eap on the printer. The protocols I have the option for on the printer are leap, peap and eap-tls. peap and eap-tls give me the above error. leap just kinda stops (i should

Re: Attribute not passing to NAS?

Ive changed that setting previously and it does not work for a client connection. However, I didnt have the eapol_test util before. If I test it with the eapol_test utility now with ttls-eap-mschapv2.conf config file it works. It passes it on Filter-Id in the Access-Accept. If I use the

Re: Attribute not passing to NAS?

Just figured it out. In eap.conf under the peap section 'use_tunneled_reply = yes' needs to be set there as well. I only had it set under the ttls section before. I just tested a client and its working fine now. Thanks for all your help Mikkal! - List info/subscribe/unsubscribe? See

Re: Attribute not passing to NAS?

requests. Are you using EAP? Is anybody else following this that can/test verify that they get the same responses as I do. Thanks- Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Attribute not passing to NAS?

I have a Enterasys HiPath controller that Im trying to pass an attribute to throw the user into the correct policy upon authentication. I talked with their support and they say to set the Filter-Id attribute to the name of the policy set on the controller. I did, but it doenst seem to pass. In

Re: Attribute not passing to NAS?

unchecked Enable checked I have another policy named Faculty that is assigned the AuthFaculty topology (which sets the tagged vlan). How does this compare to your setup? Do I need the restrict policy set option checked and config'd? -Rob On Thu, Dec 2, 2010 at 11:38 AM, mikal m...@atceast.com wrote

Re: Attribute not passing to NAS?

-Id attribute is only sent on the first challenge response. Im not sure if this is normal or not as I dont have anything to compare to. Do you see something similar with your configuration? On Thu, Dec 2, 2010 at 1:01 PM, mikal m...@atceast.com wrote: Rob, You shouldn't need to check

MAC Auth first, then User?

We are experiencing an issue where certain policies need to push down to laptops before the user enters their credentials to authenticate to the wireless network. We only have Radius/802.1x enabled on the wireless right now. Is it possible to authenticate the device based on MAC address so the

Expanding Suffix or Realm attributes

in proxy.conf) in order to create a Stripped-User-Name and Realm run-time variable with every request? Regards, Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Expanding Suffix or Realm attributes

- Original Message - From: Rob Turner r...@crosscut.org To: freeradius-users@lists.freeradius.org Sent: Tuesday, June 29, 2010 9:55:57 PM Subject: Expanding Suffix or Realm attributes Problem: Cannot expand %{Realm} or %{Suffix} control attributes for use unless realm

How to differeniate types of users

for staff. As its setup now, anybody can connect to either one. How would I be able to differeniate the two users? I can use attributes and such, but how/where would that be defined? Thanks for your help! -Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: How to differeniate types of users

in docs and on search engines. Im a bit green to this stuff right now. Im using 1.1.7 as thats the one that was in the repo for SLES 10 SP3. Ill get on 2.x as thats seems to be the right move. Thanks- Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Multiple LDAP searches

this is probably something simple I'm missing but can't seem to see it atm. Thanks Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Invalid packet code 11 sent to authentication port from client error

either since I downloaded and installed 2.1.6 identical to my test machine and got the same errors. In any event I think I'm going to move DNS/DHCP to my test box and and then switch it to my production unit. Thanks for the help guys. Rob On Fri, Mar 19, 2010 at 1:56 PM, Alan DeKok al

Invalid packet code 11 sent to authentication port from client error

, and finally fails for the same user from a laptop connecting through the AP. Rob - FreeRADIUS Version 2.1.8, for host i686-suse-linux-gnu, built on Mar 10 2010 at 14:35:09 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors

RE: radsniff

-- Message: 5 Date: Fri, 22 Aug 2008 20:54:53 -0700 From: Lemaster, Rob [EMAIL PROTECTED] Subject: radsniff To: freeradius-users@lists.freeradius.org Message-ID: [EMAIL PROTECTED] Content-Type: text/plain; charset=iso-8859-1 I found some posts online in the Devel group about

radsniff

I found some posts online in the Devel group about 'radsniff'. This sounds like a great idea, but I can't find any more documentation on it in the user groups or in the man pages, other than some complaints about bugs. Is this ready to use yet? I'm not getting anything from it (I'm problably

Re: Multiple BaseDN's - How Do I Do This?

boxes, but I can't seem to figure out how to make the multiple ldap modules work. I found a few how-to's on the web, but they are for the 1.x version and they don't seem to work with the 2.x version. -Rob Phil Mayers [EMAIL PROTECTED] 5/9/2008 7:09 AM Rob VanDusen wrote: I'm very new to both

Re: Multiple BaseDN's - How Do I Do This?

. Thanks agin for all the help. -Rob Phil Mayers [EMAIL PROTECTED] 5/9/2008 8:51 AM } instantiate { redundant all_ldap { ldap_esb ldap_sps ...etc } } server { authorize { preprocess all_ldap } authenticate { # stuff here depends on auth method

Multiple BaseDN's - How Do I Do This?

tried doing multiple instances of the LDAP module - but that resulted in the server not authorizing anyone. How would I set this up so I can add the other O's as Base DN's? I'd really appreciate any instructions that a slightly dim bulb could follow. -Rob - List info/subscribe/unsubscribe? See

Re: Failed to open socket

Lemaster, Rob wrote: I recently upgraded to 2.0.4, and now I'm seeing the following error when I start FreeRADIUS: ... Sat May 3 20:21:39 2008 : Error: ERROR: Failed to open socket: Sat May 3 20:21:39 2008 : Error: /opt/freeradius-2.0.4/etc/raddb/radiusd.conf[210]: Error binding to port

Failed to open socket

I recently upgraded to 2.0.4, and now I'm seeing the following error when I start FreeRADIUS: radiusd -X: /opt/freeradius-2.0.4/etc/raddb/radiusd.conf[210]: Error binding to port for 0.0.0.0 port 1812 radius.log: Sat May 3 20:21:39 2008 : Error: ERROR: Failed to open socket: Sat May 3

Run as non-privileged user

FreeRADIUS 2.0.4 Some documentation I've read recommends running FreeRADIUS as user=radius group=radius. It said that you shouldn't use nobody because that is reserved for a special purpose (I think it was the Hassel book). Around line 116 of radiusd.conf, I found the option for user/group,

Re: Dead Proxy Detection?

if ALL the remote proxies for that realm are unavailable, until they become available again. Can this be done here? If so, can you give me a syntax example? I could not find that in default, example, or README. Thanks! Lemaster, Rob wrote: Can FreeRADIUS automatically set all subcribers

RADIUS Packet Debugging

Does FreeRADIUS have a functionality that allows the administrator to debug RADIUS requests and responses? Something that will show the request and response with attributes, etc.. Thanks! FreeRADIUS: The other white meat. - List info/subscribe/unsubscribe? See

Windows AD Integration

Can FreeRADIUS be integrated into Windows Active Directory for user credentials and privelige based on Active Directory group? What is the best way to integrate FreeRADIUS into Windows Active Directory? Thanks! FreeRADIUS: It's what's for dinner. - List info/subscribe/unsubscribe? See

Attribute Mangling

Does FR have the ability to modify attributes from proxy servers, eg; a) Apply only local attributes. b) Apply only attributes from remote proxy. c) Merge attributes with local preference. d) Merge attributes with remote preference. Where would I find more documentation on this? Thanks for your

Dead Proxy Detection?

Can FreeRADIUS detect and remove dead proxies from the round-robin rotation and then add them back after it detects that the proxy is alive again? Can FreeRADIUS automatically set all subcribers to authenticate all if all proxies are unavailable, and then authenticate normally automatically

Advanced Queuing?

Does FreeRADIUS have any advanced queuing abilities? If we restart a BRAS, it will try to authenticate between 30,000 to 60,000 users all at once. This can crash our RADIUS server. Does FreeRADIUS have any advanced queuing functionality that will enable it handle this sudden surge of traffic,

FreeRADIUS MIB

I've reviewed the SNMP MIB and I can't find traps for the following events: * Proxy Failure * Database Connection Broken * Restart/HUP Are these traps available? Thanks! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Calling-Station-Id problem

While I am using Calling-Station-Id freeradius does not authenicate user. Without calling-station-id (user Rob) works Ok. Can anybody point me where is the problem? Checkval exists in radiusd.conf. Freeradius 1.1.7 user file: Alan User-Password == 12345, Calling-Station-Id

WRT54 and freradius with client-station-id

Hi Can anybody force freeradius to work with Linksys WRT54G with combinantion of /user/password/macaddress? Combination user/password works OK but there is no Client-station-id in packet Access-request. Can anybody help? - List info/subscribe/unsubscribe? See

FR Unix pws

. - Lemaster, Rob wrote: I am using FreeRADIUS v1.0.5 in a non-production lab environment. Well... I suggest upgrading. What hashing algorithm is used to store passwords in passwd? $ man passwd i.e. whatever your system supports. Does FreeRADIUS have an option to read passwords in clear

checkval - Calling-Station-Id

Hi I use freeradius 1.1.7 (PLD Linux distribution). In default configuration freeradius work OK but I have problem checking Calling-Station-Id - for check mac adres client validation. My user file contains: Waldi User-Password == 12345, It's working. It also works when I add ip

FR Unix pws

I am using FreeRADIUS v1.0.5 in a non-production lab environment. I am using the group and passwd files for RADIUS authentication. I'm not using the standard ones, but copies that I have created just for FreeRADIUS and stored in another directory (so it doesn't interfere with regular systems

Users can't access the Web

I've installed FreeRadius-0.9.3 (the latest version my old RedHat Linux distribution will support). FreeRadius is working fine for logins but since installing it users can't access the Web. I'd appreciate any advice. Regards, Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org

Users can't access the Web

to be unrelated to the installation. I was misled because the problem manifested itself when I started the newly installed FreeRadius. Regards, Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Acct-Input-Gigawords in Exec-Program env

-Octets, we rely on the Acct-Input-Gigawords for the overflow. This is unfortunately not showing up in the list of env variables. Anyway to resolve this? Thanks -Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Problem with compile

, Rob Wright poncacity.net [EMAIL PROTECTED] /home/rwright/Downloads/freeradius-1.1.5/libtool --mode=link gcc -release 1.1.5 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/lib rlm_perl.lo rlm_perl.c /home/rwright/Downloads/freeradius-1.1.5/src/lib/lib

Re: Reversibly encrypted passwords in SQL

... authenticate{ Auth-Type PAP{ nthashpap } } Cheers Rob -- Rob Shepherd, PhD | Computer and Network Engineer | TechniumCAST rob gets mail at techniumcast.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

peap client constantly re-authenticating

. my OS X 802.1x client doesn't do this. Cheers for any pointers, Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: {POSSIBLE FRAUD ATTEMPT!} {Disarmed} Re: denying access to user from device

Lin Richardson wrote: Where is your files declaration in the authorize section? Yes of course. My authorize section missed out 'files' so raddb/users was never read. Thanks to Alan D. and Lin R. for pointing this out. Working great now... Thanks again. Rob -- Rob Shepherd | Computer

Re: denying access to user from device

[EMAIL PROTECTED] wrote: Rob Shepherd wrote: TYPO! DEFAULT HuntGroup-Name == ciscovpnc Autz-Type := ldap ...is how it looks in raddb/user. You need to put the Autz-Type on the first line as a check item. DEFAULT HuntGroup-Name == ciscovpnc, Autz-Type := ldap Thanks

Re: denying access to user from device

Rob Shepherd wrote: Dear freeradiuseers, I have my wireless network working great... PEAP supplicants are authenticated from either LDAP or MySQL and the appropriate Tunnel-Private-Group-ID is set to allocate the correct vlan. I also have a cisco VPN concentrator. I must only allow ldap

Re: Freeradius-Users Digest, Vol 17, Issue 47

as part of this. do I have only modify the table insert NT-PASSWORD instead PASSWORD? Yes. However `Password` is usually a check item, for comparing clear text passwords. The `NT-Password` needs to be a config item. radiusd will figure out what to do with it. Rob -- Rob Shepherd | Computer

Re: NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47

| --|---|--|| colin | NT_Password | := | abcdef1234567890abcdef1234567890 | I use Pear Crypt... ?php $cr = new Crypt_CHAP_MSv1(); $cr-password = $password; $NThash = bin2hex($cr-ntPasswordHash()); ? Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ

Re: FreeRADIUS install time errors on Solaris

Ronak Sutaria wrote: /nisusers/rsutaria/FreeRADIUS/freeradius-1.1.3/libtool: ranlib: command not found ranlib is in /usr/ccs/bin alongside (SUN)make, ar, ld and friends. add /usr/ccs/bin to the start of your PATH. Rob PS. Check the WIKI for building notes. -- Rob Shepherd | Computer

Re: 1.1.3 on Solaris 10 (sparc)

Rafiqul Ahsan wrote: Thanks to Lin, Mercel, and Rob for your input. I am not sure about Mercel's comment on value of AR, this has been set to false in the Makefile at libltdl/ directory (where it actually fails). The question is what value should it be ? Also, Rob - when I put the /usr/ccs

Re: 1.1.3 on Solaris 10 (sparc)

method. At present mine is an 'alternative', and I'm biased to state that it's the easiest method, of course. I've linked it as an alternative into the original document, hopefully it can still be of some help. Cheers Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57

Re: 1.1.3 on Solaris 10 (sparc)

, as mentioned in this thread. The preferable way of satisfying run time lib dependencies on solaris is by get -R/path/to/dep alongside the -L linker flags. Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ [EMAIL PROTECTED] | 01248 675024 | 07776 210516 - List info

Re: auth to LDAP via two mechanisms

Alan DeKok wrote: Rob Shepherd [EMAIL PROTECTED] wrote: I'll use PAP (ldap auth) Please don't. It makes everything harder. OK. LDAP is a database, not an authentication server. Have the server read the clear-text password from LDAP, and the server will figure out how

auth to LDAP via two mechanisms

and LM hashes already in the LDAP, I just need to extract them... Could I get a pointers on how I command the right auth type for the right device. And how I get the nt/lm hashes from ldap and do mschapv2.. Cheers Rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ

Re: mysql libraries are there BUT not found

Roger Thomas wrote: What I have done wrong? Please advise. -- Roger I just used --with-mysql-dir=/usr/local/mysql-5.0.21 and it worked. -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ [EMAIL PROTECTED] | 01248 675024 | 07776 210516 - List info/subscribe

migrate from Cisco ACS

response is present. In addition, I'd like to determine how I can restrict access to specific groups through specific devices. I'll be using both ldap and mysql for user info Thanks for any pointers rob -- Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ [EMAIL

1.1.2 compile issues on Solaris

Hi freeradius, 1.1.2 won't compile on Solaris/GCC I gather this is a known issue. something to do with closefrom return type. What does to community suggest I do? use CVS? downgrade? wait for 1.1.3? apply a patch? regards and thanks rob -- Rob Shepherd | Computer and Network Engineer

RE: Malfunctioning Nomadix

mentioned these RADIUS issues to them as well - hopefully they will be fixed soon! Which devices and firmware versions do you have this problem with? rob. -Original Message- From: Santiago Balaguer García [mailto:[EMAIL PROTECTED] Sent: 22 June 2006 12:48 To: freeradius-users

Nested groups in ldap

how to do this with freeradius+ldap, please let me know. Thanks, Rob Kobiske - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

RE: FreeBSD 6.0 and mysql

list, but the problem/solution should be the same): http://freebsd.kde.org/pipermail/kde-freebsd/2004-August/008692.html Maybe FreeRADIUS is linked against one library and MySQL is linked to another. Cheers, Rob. -Original Message- From: Alan Craig [mailto:[EMAIL PROTECTED] Sent: 24

FreeRADIUS on FreeBSD 6.0-RELEASE

@@ -35,7 +35,7 @@ #include fcntl.h #include unistd.h #include sys/socket.h -#if defined(__linux__) || defined(__APPLE__) +#if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) #include sys/un.h #endif Regards, Rob. - List info/subscribe/unsubscribe? See http

Re: FreeRADIUS on FreeBSD 6.0-RELEASE

D'oh - ignore me. Just spotted that it's currently in the FreeBSD PR queue waiting to be commited since it was submitted yesterday! Thanks all, Rob. -Original Message- From: Rob Parker Sent: 01 February 2006 17:31 To: 'freeradius-users@lists.freeradius.org' Subject: FreeRADIUS

NAS-identifier instead of IP-identifier

Server which then creates a secure session onto the internet(WPA etc) Is there a way of identifying the router to our FreeRadius server without having a static IP address on each Router? Cheers Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

FR caching problem

FreeRADIUS v.1.0.5 I am trying to enable caching on line 623 in radiusd.conf. When I turn on caching and reload, I get the following error: Info: Reloading configuration files. Info: Using deprecated naslist file. Support for this will go away soon. Info: HASH: Reinitializing hash structures

error 734

I have a client in India. They can get here thru one isp but thru the second one it times out with vpn error 734: the ppp link control protocol was terminated. On the second try it goes thru. This sounds like a delay problem on the second ISP's line. Anyone have a solution or timing

RE: Maximum number of threads

JT, could you tell us where this log is located, /?/?/llog-files Rob Hoppe MIS Solutions 770-945-5486 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jamal Taweel Sent: Sunday, March 27, 2005 2:02 AM To: freeradius-users@lists.freeradius.org Subject: Maximum

RE: RE: mysql ?

I've got it set to 0 on a radius server here, and the server sends the attributes in the order they appear in the reply table. Rob. -Original Message- From: Joel Eddy [mailto:[EMAIL PROTECTED] Sent: 26 January 2005 15:52 To: freeradius-users@lists.freeradius.org Subject: Re: RE: mysql

Proxy.conf help

in, then uncomment it SIGHUP, and log out... The accounting packets get to the 10.0.0.2 machine fine. It's the authhost = LOCAL I am not so sure about. I need to have the LOCAL machine do authentication... Am I missing something? -Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list

RE: Using freeradius server to over ride attributes based on realm

with to do this? TIA -Rob -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rob Hartzenberg (icabs) Sent: Saturday, August 14, 2004 6:57 PM To: [EMAIL PROTECTED] Subject: Using freeradius server to over ride attributes based on realm Hi

System load of Exec-Program-Wait ??

from doing this? We currently have 200+ users on the box and all seems well, but what happens when we get to 1000+ etc, will it still hold up? Is it a potential bottleneck, or is it clean enough? Any comments and ideas would be most welcome. Thanks -Rob My /etc/raddb/users file looks like

RE: System load of Exec-Program-Wait ??

with the system groups. Perhaps you could help out here with an example or two? -Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

(no subject)

default 5d21h: AAA/ACCT: user , acct type 3 (3805499774): Method=radius (radius) 5d21h: RADIUS: unsupported accounting type 3 for user NULL Has anyone ran into this? Any documentation? Thanks. Any help would be appreciated. Rob - List info/subscribe/unsubscribe? See http://www.freeradius.org/list