Email Notification - OpenVPN Client Connect (Common Name)

Gertjan

@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):

Can i exclude a specific user from the notifications?

The script is PHP ...., so yes, you can.
But because you asked the question, you can't.
That is, for now ;)
PHP is a very old, very know "language", something like Basic in the eighties and nineties. The entire pfSense GUI is written using it (95 % or more). As half or more of all the web content on the net is produced by ... PHP.

This is the "notify.sh" I was using in the past :

#!/usr/local/bin/php -q
<?php
        require_once("/etc/inc/notices.inc");
        $local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a');
        if ( strrchr (__FILE__ , 'disconnect') ) {
        $local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED.";
        }
        notify_all_remote($local_connect_value);
?>

The OpenVPN server process, before it call's our script called "notify.sh", initializes some environment variables, so the script can act upon them.

Sop, step 1 : Goto the OpenVPN server doc, and see what openvpn is all about, and, most important : what goes on when you do this :

then you will know what info is at the scripts disposal.
The getenv() PHP function will get this info.
Now you can chose what info you want to mail.

Btw :I'm actually getitng the 'common_name' (is that the user name ?), so you could :

.....
if (getenv('common_name') != "Paul")
{
 // send all info because it's not Paul //
}
...

noplan

@Gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

if (getenv('common_name') != "Paul")

didnt we had this discussion some time ago
with sending mail rports only when IP / user is part of a group ...

have to look it up
br from a sunny vacation day NP

mrvanity

Hello,
Thank you for your answers!
I modified the script to the one below

The vpn server restarted normally, so i will check with the spesified user and report back.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') && (getenv('common_name') != "Paul")) {
	$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
notify_all_remote($local_connect_value);
}
?>

You think that the modification to send the data to a MySql DB is a doable process?

My regards.

Gertjan

@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):

MySql DB

pfSense doesn't have the PHP extension that supports MySQL transactions installed by default.
You can check that by running :

php -m

I have the mysqld module, probably because I installed th pfSense Freeradius package, which includes a mysql backend.
You could also install it manually with the pkg install ..... command, as it exists on the pfSense-FreeBSD package server.

So yes, it's very possible.

Btw : This :

@mrvanity said in Email Notification - OpenVPN Client Connect (Common Name):

FILE

is somewhat special.
I executed

ln -s notify.sh disconnect.sh

so disconnect.sh is a symbolic link to connect.sh

lrwxr-xr-x   1 root     wheel           9 Oct 10 11:48 disconnect.sh -> notify.sh

Now I can use the vpn server command

client-disconnect /root/disconnect.sh

The FILE instruction detects that the disconnect.sh is called.

Btw : it should be 'disconnect.sh', not 'disconnect'

This :
if ( strrchr (FILE , 'disconnect.sh') && (getenv('common_name') != "Paul"))
becomes true if the user Paul disconnects, and thus the file disconnect.sh was called.
The VPN server should be instructed to call that script on disconnect.

Got it ?

Btw : everyting is to be tested of course ^^

PM_13

So following scripts seems to be working for me:

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " from: " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", duration : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

If I want to add a subject line or add a line in the body field, what would be the best way to do it? I am asking here as I have no knowledge of PHP coding so can use some help.
Thanks.

serbus

Hello!

You can add content to the end of the current message body with a line like:

$local_connect_value .= "\nMore info\n";

The notify_all_remote will also send the message to telegram and pushover, but if you only need the smtp message you can use this instead and add a subject :

send_smtp_message($local_connect_value, "Subject text", 1);

The last parameter 1 is a force value that controls message deduplication, etc...

John

PM_13

@serbus

Thanks John!!
It worked like a treat, appreciate the pointers

noplan

Cuz im late to the party...
So cool Thx... Gonna test it!!

boggie1688

Thanks for this thread!

boggie1688

This might be a big ask, but is there a way to get GEOIP info for each IP address connecting to the VPN server? http://geoiplookup.net/xml-api/

It would be nice to have this info populate into the email.

PM_13

@boggie1688 I tried MaxMind service a while back but that was almost two years back, you may want to check it out.

boggie1688

@PM_13

So I don't know PHP at all, I barely can program hello world. However, I did manage this.

#!/usr/local/bin/php -q
<?php

require_once("/etc/inc/notices.inc");
    $queryprefix = "http://api.geoiplookup.net/?query=";
    $ip= getenv('trusted_ip');
    $urlip =($queryprefix.$ip);
    $xml = file_get_contents($urlip);
$local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a') . $xml;
if ( strrchr (__FILE__ , 'disconnect') ) {
$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
}
    $user_remote_ip = "VPN User ". getenv('common_name')." connected from " . getenv('trusted_ip');
    send_smtp_message($local_connect_value, $user_remote_ip, 1);

?>

It grabs the incoming ip address, and looks it up with geoiplookup.net's xml api. Then prints it into the email.

I really would like to clean up the way it prints. given it just dumps the results from the page. But this is the end of my coding ability, pretty short huh?

I can see the XML has tags <IP><HOST><ISP> etc etc, but I don't really know how just print the tags that I want.

PM_13

@boggie1688 said in Email Notification - OpenVPN Client Connect (Common Name):

PM_13

@serbus helped me with php syntax to add additional line of text in the email notification (whether vpn client is connecting or disconnecting in a particular event). I don't know php either but John's recommendations were spot on. John thanks again!!

serbus

Hello!

Once you have your $xml response you could try something like:

$country = 'Unknown';
if (preg_match ('/<countryname>(.*?)<\/countryname>/', $xml, $match))
   {
   $country = $match [1];
   }

John

Gertjan

To all : Test your VPN notification first !!

Go outside, de activate the Wifi, activate the VPN , take a big walk, swim, drive or best : take a plane.

When you get back, you'll be in for a surprise.
This surprise includes :
The huge number of mails you received.
Maybe also the mail from your mail host that states that they detect a spam bomb attack .... and that they stopped treating further mails from this 'source'.
You used another outside service : Leave your chair, take a big walk, swim, drive or best : take a plane. ? Fine : they will blacklist you, as their server has to be protected.
Etc.

It's not only about knowing what PHP is : that's an easy one : you wana drive that car ? => Go for the license (and insurance, maintenance, etc)

I'll leave this question open for now : Why did you receive hundreds, if not thousands of nearly 'notification' identical mails ?

The code given as an example above has to be .... worked on.
For example : the call to "geoiplookup.net" : it should be used wisely :
When a the VPN connect script is called, the IP obtained should be compared with the content of a file. this file contains all the IPs found in VPN connect messages.
If the IP is found : do nothing, as the IP is know.
The IP is not in the file : have it looked up, and send the mail.

Now you will receive far less mails, and no one will complain.

And I have a question : Normally, VPN access is given to people that you some how trust.
Why GEO locate them ?
Your kids ?
And then there is the eternal discussion that GEOIP data is quiet useless.
There are no more free IPv4s, it became a rare resource. The last blocks are sold often, broken up, sold again, from anywhere to anywhere. Their actual location isn't really known any more.
And take Apple and IBM for example : back then, they bought and entire /8 (or close to that). And all their IP's are in (example) Redmond, although used world wide.
With IPv6 thinks get better : You can forget the notion of GEOIP as no one can build the database that can hold all the details : there are not enough resources on this planet left to do so. Maintaining and giving access to this database will be even more difficult.

noplan

WORD !

boggie1688

@serbus Thank you for this, this would have taken me ages to figure out. Specifically the function preg_match. I was googling around and though perhaps XPATH was the right function.

boggie1688

@gertjan

I tested my VPN while moving in a car, and I see what you are saying about multiple emails coming through. As my cell reception dropped and reconnected, the notify and disconnect scripts would run.

If I'm honest, the VPN isn't used in a setting with multiple users. There is only one, who isn't very tech savy. Additionally they will only be using it on a desktop. I don't anticipate a crazy amount of emails as I doubt they will login more than once a week.

The geo data is just to confirm that my one user is indeed my who I expect it to be. IE coming from roughly the geographical area that I expect. Probably a really weak way to check, but as you can see I'm not that tech savvy.

PM_13

@boggie1688
"If I'm honest, the VPN isn't used in a setting with multiple users."

VPN are more widely used on larger networks but it is not typical for admins to set up receiving emails for each VPN user connect/disconnect session.

The reason being - a VPN user by definition is a trusted user. In addition to having credentials (user name and password), a VPN user also needs a signed certificate.

noplan

@pm_13 said in Email Notification - OpenVPN Client Connect (Common Name):

is not typical for admins to set up receiving emails for each VPN user connect/disconnect session

wrong !
it was not used to be before COVID

now a ton of admins use
the exact output of Post 26 from this topic

https://forum.netgate.com/topic/151351/email-notification-openvpn-client-connect-common-name/26

to get a view of what is goin on in HomeOffice and why, not to mention the information when a
contractor is entering the network as a trusted user.

dont get me wrong but there is a point of gettin notification via mail
but there is no point as @Gertjan mentioned earlier in geoIPlookUps

btw it would be nice if someone feels free to write the information from the mail
in a csv file to send it once a week via cron and mail to the admin stuff
so you get a nice n sweet reporting of your VPN users (it's still on my toDo list but my coding skill isnt good enough ;)

brNP