Email Notification - OpenVPN Client Connect (Common Name)

Armstrong

@vettalex OK, I just tested by running my own notify.sh (which is different now to the one you're using) and that sends me an empty email. That suggests you have a problem with the notification and probably some kind of syntax error.

I would maybe try to run php -l notify.sh or lint the raw php to see if there are any syntax errors. I would generally suggest coding the script yourself from scratch (not copying and pasting) to avoid random errors. Lint first, then rebuild and test again. If the code checks out you have a notification issue.

Equally I would test with one of the newer notify.sh scripts deeper into the thread.

noplan

Hey folks
What I don't get and what's pretty frustrating
Readin this from top to bottom gives you a step by step howto for dummies to achieve a pretty professional solution for the request the only f#@&* thing u have to do is read and think

I don't get it
NP

vettalex

@Armstrong Just done, the result I think is, no syntax errors:
no error.JPG

vettalex

@Armstrong Maybe there we are .... I am finding these errors .. even if they do not correspond to the sending time of the notify.sh scirpt (how can I check the correct date and time of pfsense?).
The strange thing is that the SMTP test during the configuration of the notification, is successful:
eroro log sent mail.JPG

vettalex

Everything ok, it was a google problem ... I don't know what problem it was. I used another email and everything works. Thanks a lot to all guys

mrvanity

This post is deleted!

PM_13

@Armstrong I followed these instructions:

SMTP notification is working from "Advanced Setup", checked it again!
Added under OpenVPN server following lines:

client-connect /root/notify.sh

The script at /etc/notify.sh has executable flag and reads as follows:

#!/usr/local/bin/php -q
<?php

        require_once("/etc/inc/notices.inc");
        notify_all_remote("VPN Connected");
?>

The client connects to OpenVPN but not getting email notification.

And do not see any errors in the log either. Is there anything I missed from the steps above or you have any pointers?

Thanks!

FuzzzyWuzzzy

@PM_13 You're calling the script at /root, but you say that you're script is actually located in /etc ?

PM_13

@CollectiveSoul thanks for your comments.

I checked the configuration, the script is at "/root/notify.sh" and have mis-typed in the message above.

One sideline question, if I run this script (as root) from command line then it should send an email..correct?Just hoping that I do not have to log in from OpenVPN to test it.

Thanks.

Gertjan

@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):

if I run this script (as root) from command line then it should send an email..correct?

Yes. The mail would be send.

Can you test this :

[2.4.5-RELEASE][admin@pfsense.internal.net]/root: file notify.sh
notify.sh: PHP script, ASCII text executable
[2.4.5-RELEASE][admin@pfsense.internal.net]/root: ls -al notify.sh
-rwxr-xr-x  2 root  wheel  504 Jun 26  2019 notify.sh

edit : when a mail is actually send - accepted by the mail server, you see this in the main log :

Not seeing such a line means : the mail never got out.

PM_13

@Gertjan Found some interesting things:

[2.4.5-RELEASE][admin@pfSense.localdomain]/root: file notify.sh
notify.sh: PHP script, ASCII text executable
[2.4.5-RELEASE][admin@pfSense.localdomain]/root: ls -al notify.sh
-rwxr-xr-x  1 root  wheel  124 Oct  5 19:56 notify.sh

After executing notify.sh from command line (as root), in the logs I see following:

Oct 7 19:51:09	php-cgi		notify_monitor.php: Could not send the message to <redacted> -- Error: Failed to set sender: <redacted> [SMTP: Invalid response code received from server (code: 550, response: 5.1.0 Authentication required)]

So went back to System => Advanced => Notifications and re-entered the values for email server, smtp server, login, password, port etc. Then hit "Test SMTP Settings" and I receive a test email promptly.

Went back to command prompt and executed "notify.sh" and got the same error again.

So the SMTP works for test settings but not for "notify.sh" command line execution.
Any ideas what I might be missing here?

PM_13

I ran few more commands and output is listed below:

[2.4.5-RELEASE][admin@pfSense.localdomain]/root: tcsh -v notify.sh

< ?php
Invalid null command.
[2.4.5-RELEASE][admin@pfSense.localdomain]/root: cat notify.sh
#!/usr/local/bin/php -q
<?php

        require_once("/etc/inc/notices.inc");
        notify_all_remote("VPN Connected");
?>

I am not conversant in php, is there any syntax error in notify.sh?

Gertjan

@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):

re-entered the values for email server, smtp server, login, password, port etc. Then hit "Test SMTP Settings"

Noop.

You enter all the details.
Then you hit Save.
Only then you hit "Test SMTP Settings".

Add a log line in your script file :

...
        require_once("/etc/inc/notices.inc");
        log_error("About to send a mail ...");
        notify_all_remote("VPN Connected");
....

Now you should see this in your :

This simple test shows that the script is executed.

PM_13

@Gertjan Thanks, I saved the settings then tried test SMTP which went smoothly.

The execution of /root/notify.sh from command line still gives the same error as before. So I went to webUI => Diagnostics => Command Prompt => Execute PHP Commands and typed following in the text box:

require_once("/etc/inc/notices.inc");
log_error("About to send a mail ...");
notify_all_remote("VPN Connected");

Now under Status => System => Logs => System => General, I see following:

Oct 8 10:22:35	php-cgi		notify_monitor.php: Message sent to <redacted> OK
Oct 8 10:22:23	php		/tmp/user_code/zZQWIi: About to send a mail ...

And the email was also received with message "VPN Connected" in the body!!

So seems like we made some progress but still cannot figure out why /root/notify.sh execution from command line is not working as it should.

serbus

Hello!

@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):

still cannot figure out why /root/notify.sh execution from command line is not working as it should

It could be a tcsh-shell-shebang-something issue.

What about running just:

/root/notify.sh

John

PM_13

@serbus Yes that solved the issue and script executes from command line!
Thanks @Gertjan for all the pointers!

mrvanity

Hello there!
The notifications works just fine to my system as well.
Thanks for that!

I have a couple of questions.

Can i exclude a specific user from the notifications?
I mean that i want to be notified for all users connecting , except one.
Is there a chance to modify the script to push the data to a MySql instead of sending emails?

My regards.

Gertjan

@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):

Can i exclude a specific user from the notifications?

The script is PHP ...., so yes, you can.
But because you asked the question, you can't.
That is, for now ;)
PHP is a very old, very know "language", something like Basic in the eighties and nineties. The entire pfSense GUI is written using it (95 % or more). As half or more of all the web content on the net is produced by ... PHP.

This is the "notify.sh" I was using in the past :

#!/usr/local/bin/php -q
<?php
        require_once("/etc/inc/notices.inc");
        $local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a');
        if ( strrchr (__FILE__ , 'disconnect') ) {
        $local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED.";
        }
        notify_all_remote($local_connect_value);
?>

The OpenVPN server process, before it call's our script called "notify.sh", initializes some environment variables, so the script can act upon them.

Sop, step 1 : Goto the OpenVPN server doc, and see what openvpn is all about, and, most important : what goes on when you do this :

then you will know what info is at the scripts disposal.
The getenv() PHP function will get this info.
Now you can chose what info you want to mail.

Btw :I'm actually getitng the 'common_name' (is that the user name ?), so you could :

.....
if (getenv('common_name') != "Paul")
{
 // send all info because it's not Paul //
}
...

noplan

@Gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

if (getenv('common_name') != "Paul")

didnt we had this discussion some time ago
with sending mail rports only when IP / user is part of a group ...

have to look it up
br from a sunny vacation day NP

mrvanity

Hello,
Thank you for your answers!
I modified the script to the one below

The vpn server restarted normally, so i will check with the spesified user and report back.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') && (getenv('common_name') != "Paul")) {
	$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
notify_all_remote($local_connect_value);
}
?>

You think that the modification to send the data to a MySql DB is a doable process?

My regards.