Email Notification - OpenVPN Client Connect (Common Name)

Armstrong · Mar 17, 2020, 12:28 AM

Hi all,

Wondering if anyone could assist me, I'm trying to set up email notifications for connections to my OpenVPN server but include the name of the user (Common Name variable).

So far, I have manged to get a notification that a connection was made, but I'm unsure of how to get this to include the name.

So far I have added line client-connect /root/notify.sh to the OpenVPN Custom Options area.

Notify.sh is as below:

#!/usr/local/bin/php -q
<?php

        require_once("/etc/inc/notices.inc");
        notify_all_remote("VPN Connected");
?>

I have seen several methods using bash, though I haven't tested this and wondered if it was possible to just expand on the above script.

Dusty.

Armstrong · Mar 17, 2020, 12:53 AM

OK so I see two things - it seems that OpenVPN "generates" these variables at the time of connection, and in PHP there's getenv.

Could I then change the script to something like this:

#!/usr/local/bin/php -q
<?php
        $name = getenv('common_name');
        require_once("/etc/inc/notices.inc");
        notify_all_remote strval($name);
?>

Gertjan · Mar 17, 2020, 7:30 AM

I'm using :

login-to-view

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED.";
	}
	notify_all_remote($local_connect_value);
?>

connect.sh and disconnect.sh are identical.

Armstrong · Mar 17, 2020, 11:03 AM

Hi Gertjan,

That's awesome, thank you. I assume I could feasibly just transplant this in to my notify/disconnect files without issue? I'm sure, I just ask as I work remotely and don't want to break my connection (again).

provels · Mar 17, 2020, 11:15 AM

@Armstrong It's probably me, but I just tried this and OpenVPN stopped and won't start. Like I said, probably me, but maybe not. I put the .sh lines in the Server Custom Options.

Armstrong · Mar 17, 2020, 11:20 AM

@provels Do you have access to the VPN config still? As in you're local to it, rather than doing remote working.

Out of interest, if you modify the notify script to be what mine originally was / is:

#!/usr/local/bin/php -q
<?php

        require_once("/etc/inc/notices.inc");
        notify_all_remote("VPN Connected");
?>

Just to narrow down whether it's your box or if there's something in the script.

You should also be able to see on your front page dashboard, an error notification. This should pop up if there were any syntax errors or something similar.

provels · Mar 17, 2020, 11:33 AM

@Armstrong I copied @Gertjan 's script to /root/notify.sh
and /root/disconnect.sh. Added his lines to server custom options. OVPN service stopped on Save and won't start. I'm at home with my FW.

No other errors on status page, like at top. No big deal for me, I just didn't want you to break your connection.
login-to-view

Armstrong · Mar 17, 2020, 11:42 AM

@provels Thanks for taking the hit to test!

I'll go up to the site physically later then and give it a try when there's no risk of me losing my connection.

Out of interest did you try just the basic notify script I had?

provels · Mar 17, 2020, 11:43 AM

@Armstrong Not yet, will advise.

Gertjan · Mar 17, 2020, 11:45 AM

@provels said in Email Notification - OpenVPN Client Connect (Common Name):

/root/notify.sh
and /root/disconnect.sh

Because these are script files, or plain text files that contain commands, the script files should be marked as "executable".

chmod +x /root/notify.sh
chmod +x /root/disconnect.sh

check :

[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: ls -al notify.sh
-rwxr-xr-x  2 root  wheel  504 Jun 26  2019 notify.sh
[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: ls -al disconnect.sh
-rwxr-xr-x  2 root  wheel  504 Jun 26  2019 disconnect.sh

Also, be sure for this (file encoding) :

[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: file notify.sh
notify.sh: PHP script, ASCII text executable

same thing for "disconnect.sh".

provels · Mar 17, 2020, 12:12 PM

@Gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

chmod +x /root/notify.sh
chmod +x /root/disconnect.sh

That was it. Student Driver here. Sorry. Works a treat! Thanks to both of you. Glad I read this post!
login-to-view

Armstrong · Mar 17, 2020, 12:13 PM

@Gertjan Ah yeah, I should've mentioned that it needs to be executable too.

I decided to go full on and just implement over the wire. Scripts work fine.

The only thing I would ask, is that the "disconnect" part doesn't seem to send the disconnect notification until I reconnect? I disconnect, no email, then when I re-connect after a short period I receive two notifications:

13:08:17 user_name: username vpn_client_ip: x.x.x.x on 18 March during : 120 seconds DISCONNECTED
13:08:17 user_name: username vpn_client_ip x.x.x.x 18 March

It doesn't really bother me, I only wanted to know the users, but just out of curiosity.

Thank you for your help!

provels · Mar 17, 2020, 12:30 PM

@Armstrong My disco msg lagged a little, but did come about a minute after. Your messages may have overlapped.

EDIT - 2 minutes

Armstrong · Mar 17, 2020, 12:31 PM

@provels Yup just tested that (with a little patience), it does indeed send through after about a minute. Must just take a bit for it to fully "close" the connection.

Armstrong · Mar 17, 2020, 1:51 PM

Also before I go, I made one change (connecting IP) so adding it to this post if anyone wants that too and would like to just copy and paste.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " from: " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", duration : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

Thanks for the input everyone!

provels · Mar 17, 2020, 1:51 PM

@Armstrong Great to have if someone happens to snag your creds. Thanks.

mikekoke · Mar 19, 2020, 7:25 PM

Hi, I followed the comments and set up the @Armstrong script but I'm not getting any notification.
I created the files, gave the permissions, added the two lines to openvpn and restarted the service.

Armstrong · Mar 19, 2020, 7:50 PM

@mikekoke Dumb question, do you have notifications set up in Pfsense to send you emails?

mikekoke · Mar 19, 2020, 7:53 PM

Yes of course, I also took the test and received the notification.

Armstrong · Mar 19, 2020, 7:58 PM

@mikekoke Gotta ask.

You can connect to the VPN and disconnect as well, no errors with syntax or anything? It should work right away (latest OpenVPN version) so I can only suggest some other issue in your configuration.

I would try my original script and config (client-connect /root/notify.sh) and see if that works for you firstly. If it doesn't then there's more amiss than I could tell you.