Email Notification - OpenVPN Client Connect (Common Name)

provels

@Armstrong I copied @Gertjan 's script to /root/notify.sh
and /root/disconnect.sh. Added his lines to server custom options. OVPN service stopped on Save and won't start. I'm at home with my FW.

No other errors on status page, like at top. No big deal for me, I just didn't want you to break your connection.

Armstrong

@provels Thanks for taking the hit to test!

I'll go up to the site physically later then and give it a try when there's no risk of me losing my connection.

Out of interest did you try just the basic notify script I had?

provels

@Armstrong Not yet, will advise.

Gertjan

@provels said in Email Notification - OpenVPN Client Connect (Common Name):

/root/notify.sh
and /root/disconnect.sh

Because these are script files, or plain text files that contain commands, the script files should be marked as "executable".

chmod +x /root/notify.sh
chmod +x /root/disconnect.sh

check :

[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: ls -al notify.sh
-rwxr-xr-x  2 root  wheel  504 Jun 26  2019 notify.sh
[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: ls -al disconnect.sh
-rwxr-xr-x  2 root  wheel  504 Jun 26  2019 disconnect.sh

Also, be sure for this (file encoding) :

[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: file notify.sh
notify.sh: PHP script, ASCII text executable

same thing for "disconnect.sh".

provels

@Gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

chmod +x /root/notify.sh
chmod +x /root/disconnect.sh

That was it. Student Driver here. Sorry. Works a treat! Thanks to both of you. Glad I read this post!

Armstrong

@Gertjan Ah yeah, I should've mentioned that it needs to be executable too.

I decided to go full on and just implement over the wire. Scripts work fine.

The only thing I would ask, is that the "disconnect" part doesn't seem to send the disconnect notification until I reconnect? I disconnect, no email, then when I re-connect after a short period I receive two notifications:

13:08:17 user_name: username vpn_client_ip: x.x.x.x on 18 March during : 120 seconds DISCONNECTED
13:08:17 user_name: username vpn_client_ip x.x.x.x 18 March

It doesn't really bother me, I only wanted to know the users, but just out of curiosity.

Thank you for your help!

provels

@Armstrong My disco msg lagged a little, but did come about a minute after. Your messages may have overlapped.

EDIT - 2 minutes

Armstrong

@provels Yup just tested that (with a little patience), it does indeed send through after about a minute. Must just take a bit for it to fully "close" the connection.

Armstrong

Also before I go, I made one change (connecting IP) so adding it to this post if anyone wants that too and would like to just copy and paste.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " from: " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", duration : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

Thanks for the input everyone!

provels

@Armstrong Great to have if someone happens to snag your creds. Thanks.

mikekoke

Hi, I followed the comments and set up the @Armstrong script but I'm not getting any notification.
I created the files, gave the permissions, added the two lines to openvpn and restarted the service.

Armstrong

@mikekoke Dumb question, do you have notifications set up in Pfsense to send you emails?

mikekoke

Yes of course, I also took the test and received the notification.

Armstrong

@mikekoke Gotta ask.

You can connect to the VPN and disconnect as well, no errors with syntax or anything? It should work right away (latest OpenVPN version) so I can only suggest some other issue in your configuration.

I would try my original script and config (client-connect /root/notify.sh) and see if that works for you firstly. If it doesn't then there's more amiss than I could tell you.

mikekoke

I can connect to the VPN and everything works correctly, the script I am using is the first one, that of your post.

Armstrong

@mikekoke Can you run that notify script from the terminal verbose and see what happens?

It sounds like there's a problem with notifications, if everything's running but you're not getting an email. As I said it works straight away if you have email notifications on and everything on the latest version.

mikekoke

When I try to run it it exits written: Exception: Zend Extension ./disconnect.sh does not exist

edit: Problem solved. Thanks for your help.

Armstrong

@mikekoke What was the issue?

mikekoke

I had to create the files from the terminal.

noplan

@Armstrong said in Email Notification - OpenVPN Client Connect (Common Name):

i felt free to make some cahnges for a readable output.
the output from disconnect.sh received via e-mail looks now like this.

as far as i'm concerned with this output i don't need the connect.sh cuz as the more users there are
the more e-mails you'll receive.

the source for disconnect.sh is here.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

to reduce the mass on mails i was thinkin to use disconnect.sh with (client specific overrides)

but it was not workin and ended with someting like this:
Options error: option 'client-disconnect' cannot be used in this context

The main reason i wanted to do this, i put my clients in categries like

management (trusted)
sysops (trusted)
employees (trusted ;)
contractors (notification needed)

so that notification will only be sent if (untrusted or notification needed) as i mentioned earlier reduce tons of mails.
but i'll open a topic on this one and edit this post later on.

any hints are welcome
#stayHealthy