Email Notification - OpenVPN Client Connect (Common Name)
-
@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):
if I run this script (as root) from command line then it should send an email..correct?
Yes. The mail would be send.
Can you test this :
[2.4.5-RELEASE][admin@pfsense.internal.net]/root: file notify.sh notify.sh: PHP script, ASCII text executable [2.4.5-RELEASE][admin@pfsense.internal.net]/root: ls -al notify.sh -rwxr-xr-x 2 root wheel 504 Jun 26 2019 notify.shedit : when a mail is actually send - accepted by the mail server, you see this in the main log :
Not seeing such a line means : the mail never got out.
-
@Gertjan Found some interesting things:
[2.4.5-RELEASE][admin@pfSense.localdomain]/root: file notify.sh notify.sh: PHP script, ASCII text executable [2.4.5-RELEASE][admin@pfSense.localdomain]/root: ls -al notify.sh -rwxr-xr-x 1 root wheel 124 Oct 5 19:56 notify.shAfter executing notify.sh from command line (as root), in the logs I see following:
Oct 7 19:51:09 php-cgi notify_monitor.php: Could not send the message to <redacted> -- Error: Failed to set sender: <redacted> [SMTP: Invalid response code received from server (code: 550, response: 5.1.0 Authentication required)]So went back to System => Advanced => Notifications and re-entered the values for email server, smtp server, login, password, port etc. Then hit "Test SMTP Settings" and I receive a test email promptly.
Went back to command prompt and executed "notify.sh" and got the same error again.
So the SMTP works for test settings but not for "notify.sh" command line execution.
Any ideas what I might be missing here? -
I ran few more commands and output is listed below:
[2.4.5-RELEASE][admin@pfSense.localdomain]/root: tcsh -v notify.sh < ?php Invalid null command. [2.4.5-RELEASE][admin@pfSense.localdomain]/root: cat notify.sh #!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); notify_all_remote("VPN Connected"); ?>I am not conversant in php, is there any syntax error in notify.sh?
-
@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):
re-entered the values for email server, smtp server, login, password, port etc. Then hit "Test SMTP Settings"
Noop.
You enter all the details.
Then you hit Save.
Only then you hit "Test SMTP Settings".Add a log line in your script file :
... require_once("/etc/inc/notices.inc"); log_error("About to send a mail ..."); notify_all_remote("VPN Connected"); ....Now you should see this in your :
This simple test shows that the script is executed.
-
@Gertjan Thanks, I saved the settings then tried test SMTP which went smoothly.
The execution of /root/notify.sh from command line still gives the same error as before. So I went to webUI => Diagnostics => Command Prompt => Execute PHP Commands and typed following in the text box:
require_once("/etc/inc/notices.inc"); log_error("About to send a mail ..."); notify_all_remote("VPN Connected");Now under Status => System => Logs => System => General, I see following:
Oct 8 10:22:35 php-cgi notify_monitor.php: Message sent to <redacted> OK Oct 8 10:22:23 php /tmp/user_code/zZQWIi: About to send a mail ...And the email was also received with message "VPN Connected" in the body!!
So seems like we made some progress but still cannot figure out why /root/notify.sh execution from command line is not working as it should.
-
Hello!
@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):
still cannot figure out why /root/notify.sh execution from command line is not working as it should
It could be a tcsh-shell-shebang-something issue.
What about running just:
/root/notify.shJohn
-
-
Hello there!
The notifications works just fine to my system as well.
Thanks for that!I have a couple of questions.
-
Can i exclude a specific user from the notifications?
I mean that i want to be notified for all users connecting , except one. -
Is there a chance to modify the script to push the data to a MySql instead of sending emails?
My regards.
-
-
@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):
Can i exclude a specific user from the notifications?
The script is PHP ...., so yes, you can.
But because you asked the question, you can't.
That is, for now ;)
PHP is a very old, very know "language", something like Basic in the eighties and nineties. The entire pfSense GUI is written using it (95 % or more). As half or more of all the web content on the net is produced by ... PHP.This is the "notify.sh" I was using in the past :
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); $local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a'); if ( strrchr (__FILE__ , 'disconnect') ) { $local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED."; } notify_all_remote($local_connect_value); ?>The OpenVPN server process, before it call's our script called "notify.sh", initializes some environment variables, so the script can act upon them.
Sop, step 1 : Goto the OpenVPN server doc, and see what openvpn is all about, and, most important : what goes on when you do this :
then you will know what info is at the scripts disposal.
The getenv() PHP function will get this info.
Now you can chose what info you want to mail.Btw :I'm actually getitng the 'common_name' (is that the user name ?), so you could :
..... if (getenv('common_name') != "Paul") { // send all info because it's not Paul // } ... -
@Gertjan said in Email Notification - OpenVPN Client Connect (Common Name):
if (getenv('common_name') != "Paul")
didnt we had this discussion some time ago
with sending mail rports only when IP / user is part of a group ...have to look it up
br from a sunny vacation day NP -
Hello,
Thank you for your answers!
I modified the script to the one belowThe vpn server restarted normally, so i will check with the spesified user and report back.
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); $local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a'); if ( strrchr (__FILE__ , 'disconnect') && (getenv('common_name') != "Paul")) { $local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . " hours, or " . round(((getenv('time_duration'))/60),2) . " minutes, or " . getenv('time_duration') . " seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED."; notify_all_remote($local_connect_value); } ?>You think that the modification to send the data to a MySql DB is a doable process?
My regards.
-
@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):
MySql DB
pfSense doesn't have the PHP extension that supports MySQL transactions installed by default.
You can check that by running :php -mI have the mysqld module, probably because I installed th pfSense Freeradius package, which includes a mysql backend.
You could also install it manually with the pkg install ..... command, as it exists on the pfSense-FreeBSD package server.So yes, it's very possible.
Btw : This :
@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):
FILE
is somewhat special.
I executedln -s notify.sh disconnect.shso disconnect.sh is a symbolic link to connect.sh
lrwxr-xr-x 1 root wheel 9 Oct 10 11:48 disconnect.sh -> notify.shNow I can use the vpn server command
client-disconnect /root/disconnect.shThe FILE instruction detects that the disconnect.sh is called.
Btw : it should be 'disconnect.sh', not 'disconnect'
This :
if ( strrchr (FILE , 'disconnect.sh') && (getenv('common_name') != "Paul"))
becomes true if the user Paul disconnects, and thus the file disconnect.sh was called.
The VPN server should be instructed to call that script on disconnect.Got it ?
Btw : everyting is to be tested of course ^^
-
So following scripts seems to be working for me:
#!/usr/local/bin/php -q <?php require_once("/etc/inc/notices.inc"); $local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " from: " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a'); if ( strrchr (__FILE__ , 'disconnect') ) { $local_connect_value .= ", duration : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNECTED."; } notify_all_remote($local_connect_value); ?>If I want to add a subject line or add a line in the body field, what would be the best way to do it? I am asking here as I have no knowledge of PHP coding so can use some help.
Thanks. -
Hello!
You can add content to the end of the current message body with a line like:
$local_connect_value .= "\nMore info\n";The notify_all_remote will also send the message to telegram and pushover, but if you only need the smtp message you can use this instead and add a subject :
send_smtp_message($local_connect_value, "Subject text", 1);The last parameter 1 is a force value that controls message deduplication, etc...
John
-
Thanks John!!
It worked like a treat, appreciate the pointers
-
Cuz im late to the party...
So cool Thx... Gonna test it!! -
Thanks for this thread!
-
This might be a big ask, but is there a way to get GEOIP info for each IP address connecting to the VPN server? http://geoiplookup.net/xml-api/
It would be nice to have this info populate into the email.
-
@boggie1688 I tried MaxMind service a while back but that was almost two years back, you may want to check it out.
-
So I don't know PHP at all, I barely can program hello world. However, I did manage this.
#!/usr/local/bin/php -q
<?phprequire_once("/etc/inc/notices.inc"); $queryprefix = "http://api.geoiplookup.net/?query="; $ip= getenv('trusted_ip'); $urlip =($queryprefix.$ip); $xml = file_get_contents($urlip); $local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a') . $xml; if ( strrchr (__FILE__ , 'disconnect') ) { $local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . " hours, or " . round(((getenv('time_duration'))/60),2) . " minutes, or " . getenv('time_duration') . " seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED."; } $user_remote_ip = "VPN User ". getenv('common_name')." connected from " . getenv('trusted_ip'); send_smtp_message($local_connect_value, $user_remote_ip, 1);?>
It grabs the incoming ip address, and looks it up with geoiplookup.net's xml api. Then prints it into the email.
I really would like to clean up the way it prints. given it just dumps the results from the page. But this is the end of my coding ability, pretty short huh?
I can see the XML has tags <IP><HOST><ISP> etc etc, but I don't really know how just print the tags that I want.
