Email Notification - OpenVPN Client Connect (Common Name)
-
OK so I see two things - it seems that OpenVPN "generates" these variables at the time of connection, and in PHP there's
getenv
.Could I then change the script to something like this:
#!/usr/local/bin/php -q <?php $name = getenv('common_name'); require_once("/etc/inc/notices.inc"); notify_all_remote strval($name); ?>
-
I'm using :
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); $local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a'); if ( strrchr (__FILE__ , 'disconnect') ) { $local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED."; } notify_all_remote($local_connect_value); ?>
connect.sh and disconnect.sh are identical.
-
Hi Gertjan,
That's awesome, thank you. I assume I could feasibly just transplant this in to my notify/disconnect files without issue? I'm sure, I just ask as I work remotely and don't want to break my connection (again).
-
@Armstrong It's probably me, but I just tried this and OpenVPN stopped and won't start. Like I said, probably me, but maybe not. I put the .sh lines in the Server Custom Options.
-
@provels Do you have access to the VPN config still? As in you're local to it, rather than doing remote working.
Out of interest, if you modify the notify script to be what mine originally was / is:
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); notify_all_remote("VPN Connected"); ?>
Just to narrow down whether it's your box or if there's something in the script.
You should also be able to see on your front page dashboard, an error notification. This should pop up if there were any syntax errors or something similar.
-
@Armstrong I copied @Gertjan 's script to /root/notify.sh
and /root/disconnect.sh. Added his lines to server custom options. OVPN service stopped on Save and won't start. I'm at home with my FW.No other errors on status page, like at top. No big deal for me, I just didn't want you to break your connection.
-
@provels Thanks for taking the hit to test!
I'll go up to the site physically later then and give it a try when there's no risk of me losing my connection.
Out of interest did you try just the basic notify script I had?
-
@Armstrong Not yet, will advise.
-
@provels said in Email Notification - OpenVPN Client Connect (Common Name):
/root/notify.sh
and /root/disconnect.shBecause these are script files, or plain text files that contain commands, the script files should be marked as "executable".
chmod +x /root/notify.sh chmod +x /root/disconnect.sh
check :
[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: ls -al notify.sh -rwxr-xr-x 2 root wheel 504 Jun 26 2019 notify.sh [2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: ls -al disconnect.sh -rwxr-xr-x 2 root wheel 504 Jun 26 2019 disconnect.sh
Also, be sure for this (file encoding) :
[2.4.5-RC][admin@pfsense.brit-hotel-fumel.net]/root: file notify.sh notify.sh: PHP script, ASCII text executable
same thing for "disconnect.sh".
-
@Gertjan said in Email Notification - OpenVPN Client Connect (Common Name):
chmod +x /root/notify.sh
chmod +x /root/disconnect.shThat was it. Student Driver here. Sorry. Works a treat! Thanks to both of you. Glad I read this post!
-
@Gertjan Ah yeah, I should've mentioned that it needs to be executable too.
I decided to go full on and just implement over the wire. Scripts work fine.
The only thing I would ask, is that the "disconnect" part doesn't seem to send the disconnect notification until I reconnect? I disconnect, no email, then when I re-connect after a short period I receive two notifications:
13:08:17 user_name: username vpn_client_ip: x.x.x.x on 18 March during : 120 seconds DISCONNECTED
13:08:17 user_name: username vpn_client_ip x.x.x.x 18 MarchIt doesn't really bother me, I only wanted to know the users, but just out of curiosity.
Thank you for your help!
-
@Armstrong My disco msg lagged a little, but did come about a minute after. Your messages may have overlapped.
EDIT - 2 minutes
-
@provels Yup just tested that (with a little patience), it does indeed send through after about a minute. Must just take a bit for it to fully "close" the connection.
-
Also before I go, I made one change (connecting IP) so adding it to this post if anyone wants that too and would like to just copy and paste.
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); $local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " from: " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a'); if ( strrchr (__FILE__ , 'disconnect') ) { $local_connect_value .= ", duration : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNECTED."; } notify_all_remote($local_connect_value); ?>
Thanks for the input everyone!
-
@Armstrong Great to have if someone happens to snag your creds. Thanks.
-
Hi, I followed the comments and set up the @Armstrong script but I'm not getting any notification.
I created the files, gave the permissions, added the two lines to openvpn and restarted the service. -
@mikekoke Dumb question, do you have notifications set up in Pfsense to send you emails?
-
Yes of course, I also took the test and received the notification.
-
@mikekoke Gotta ask.
You can connect to the VPN and disconnect as well, no errors with syntax or anything? It should work right away (latest OpenVPN version) so I can only suggest some other issue in your configuration.
I would try my original script and config (
client-connect /root/notify.sh
) and see if that works for you firstly. If it doesn't then there's more amiss than I could tell you. -
I can connect to the VPN and everything works correctly, the script I am using is the first one, that of your post.
-
@mikekoke Can you run that notify script from the terminal verbose and see what happens?
It sounds like there's a problem with notifications, if everything's running but you're not getting an email. As I said it works straight away if you have email notifications on and everything on the latest version.
-
When I try to run it it exits written: Exception: Zend Extension ./disconnect.sh does not exist
edit: Problem solved. Thanks for your help.
-
@mikekoke What was the issue?
-
I had to create the files from the terminal.
-
@Armstrong said in Email Notification - OpenVPN Client Connect (Common Name):
i felt free to make some cahnges for a readable output.
the output from disconnect.sh received via e-mail looks now like this.as far as i'm concerned with this output i don't need the connect.sh cuz as the more users there are
the more e-mails you'll receive.the source for disconnect.sh is here.
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); $local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a'); if ( strrchr (__FILE__ , 'disconnect') ) { $local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . " hours, or " . round(((getenv('time_duration'))/60),2) . " minutes, or " . getenv('time_duration') . " seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED."; } notify_all_remote($local_connect_value); ?>
to reduce the mass on mails i was thinkin to use disconnect.sh with (client specific overrides)
but it was not workin and ended with someting like this:
Options error: option 'client-disconnect' cannot be used in this contextThe main reason i wanted to do this, i put my clients in categries like
- management (trusted)
- sysops (trusted)
- employees (trusted ;)
- contractors (notification needed)
so that notification will only be sent if (untrusted or notification needed) as i mentioned earlier reduce tons of mails.
but i'll open a topic on this one and edit this post later on.any hints are welcome
#stayHealthy -
@noplan That definitely looks a lot better format-wise, thanks for the update. PHP isn't my strongest area.
I only have a small number of users so it's OK with me to have the number of emails I do, though for a larger organization it makes sense. I'm afraid I couldn't comment on the use of client overrides, but someone else may be able to provide advice.
-
i'm so happy that you came up with a version i can play on.
and look its workin. pretty fine.if someone digs into it a cool thing would be a email
and a weekly report send by cron
vpn-client | date | time-in | time-out | client-vpn-ip | client foreign ip | duration connection (hours) | received (MB) | send (MB) |mybe a nice project.
so a weekly report of VPN-clients "timesheets" could be generatedbut maybe all things niceToHave on a firewall ;)
writtin this post
i am thinking to write the informations vom disconnect.sh into a txt file and send it via cron to
another machine doing the formating and generating a sweet pdf. (this could be fun i think )#stayHealthy
-
Hi guys, sorry if I reopen this discussion;
- I have configured the pfsense notifications and by sending the smtp test, the e-mail will arrive safely.
- I created the notify.sh file and placed it under root
- I ran the command: chmod + x /root/notify.sh to make it executable
- I also ran the ls -al notify.sh command and the result is this:
- but I don't receive any email when I connect remotely, nothing at all :(
The notify.sh file contains this:
I tried to manually start the notify.sh file with the ./notify.sh command under root, but nothing happens ...
at this point I would like to check the notification logs and together with you understand the problem. Do you know where the notification logs are located?
-
Create the notify.sh file from the pfsense gui with Diagnostics -> Edit File or from the terminal, I had the same error, I had created the file on windows and moved it to pfsense through winscp but it didn't work.
-
@mikekoke Hello and thank you first.
After some time I managed to create the file and compile it, but despite this, it still doesn't go.
I did this procedure:
Compiled like this and saved:
After that I sent the command chmod +x /root/notify.sh from ssh (putty), since I don't know how to send it from diagnostics-command prompt.
Where am I wrong? -
@vettalex said in Email Notification - OpenVPN Client Connect (Common Name):
Where am I wrong?
Did you definitely add the
client-connect /root/notify.sh
part to the configuration of OpenVPN? -
@Armstrong Yes, in OpenVPN - Server - Edit Server:
-
@vettalex OK, I just tested by running my own notify.sh (which is different now to the one you're using) and that sends me an empty email. That suggests you have a problem with the notification and probably some kind of syntax error.
I would maybe try to run
php -l notify.sh
or lint the raw php to see if there are any syntax errors. I would generally suggest coding the script yourself from scratch (not copying and pasting) to avoid random errors. Lint first, then rebuild and test again. If the code checks out you have a notification issue.Equally I would test with one of the newer
notify.sh
scripts deeper into the thread. -
Hey folks
What I don't get and what's pretty frustrating
Readin this from top to bottom gives you a step by step howto for dummies to achieve a pretty professional solution for the request the only f#@&* thing u have to do is read and thinkI don't get it
NP -
@Armstrong Just done, the result I think is, no syntax errors:
-
@Armstrong Maybe there we are .... I am finding these errors .. even if they do not correspond to the sending time of the notify.sh scirpt (how can I check the correct date and time of pfsense?).
The strange thing is that the SMTP test during the configuration of the notification, is successful:
-
Everything ok, it was a google problem ... I don't know what problem it was. I used another email and everything works. Thanks a lot to all guys
-
This post is deleted! -
@Armstrong I followed these instructions:
- SMTP notification is working from "Advanced Setup", checked it again!
- Added under OpenVPN server following lines:
client-connect /root/notify.sh
- The script at /etc/notify.sh has executable flag and reads as follows:
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); notify_all_remote("VPN Connected"); ?>
- The client connects to OpenVPN but not getting email notification.
And do not see any errors in the log either. Is there anything I missed from the steps above or you have any pointers?
Thanks!
-
@PM_13 You're calling the script at /root, but you say that you're script is actually located in /etc ?