Email Notification - OpenVPN Client Connect (Common Name)

PM_13

@boggie1688
"If I'm honest, the VPN isn't used in a setting with multiple users."

VPN are more widely used on larger networks but it is not typical for admins to set up receiving emails for each VPN user connect/disconnect session.

The reason being - a VPN user by definition is a trusted user. In addition to having credentials (user name and password), a VPN user also needs a signed certificate.

noplan

@pm_13 said in Email Notification - OpenVPN Client Connect (Common Name):

is not typical for admins to set up receiving emails for each VPN user connect/disconnect session

wrong !
it was not used to be before COVID

now a ton of admins use
the exact output of Post 26 from this topic

https://forum.netgate.com/topic/151351/email-notification-openvpn-client-connect-common-name/26

to get a view of what is goin on in HomeOffice and why, not to mention the information when a
contractor is entering the network as a trusted user.

dont get me wrong but there is a point of gettin notification via mail
but there is no point as @Gertjan mentioned earlier in geoIPlookUps

btw it would be nice if someone feels free to write the information from the mail
in a csv file to send it once a week via cron and mail to the admin stuff
so you get a nice n sweet reporting of your VPN users (it's still on my toDo list but my coding skill isnt good enough ;)

brNP

bingo600

Fun with ovpn connect/disconnect scripts.

Using ssh directly to the firewall , select 8 for shell.

NOTE: Don't do this while working via a VPN server that uses these scripts
If you FSCK' up the php connect script , and the script returns an error. OpenVPN will reject new connects.

I made a /root/ovpn-connect.sh file , and pasted this into it.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = __FILE__ . " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strpos (__FILE__ , 'ovpn-disconnect') !== false ) {
	$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

Made it executeble:

chmod +x /root/ovpn-connect.sh

Copied it to /root/ovpn-disconnect.sh

cp /root/ovpn-connect.sh  /root/ovpn-disconnect.sh

Activated it in the OpenVPN Server -> Advanced Configuration

Done !

Edit:
Im my e-mail client (thunderbird) i made a filter that triggers :
If From contains : My Notifications -> From e-mail address
And Body Contains : /root/ovpn
Move mail to : Ovpn e-mail Connect folder

bingo600

What i learned , and did different from the above solutions:

1:
DON'T symlink the disconnect script to the connect script.
As nice (and logical) as this seems to be , your disconnect section won't work.
As FILE will resolve symlinks too , and you'll end up with the connect filename for both connect & disconnect.

From : https://www.php.net/manual/en/language.constants.predefined.php

__FILE__ 	The full path and filename of the file with symlinks resolved. If used inside an include, the name of the included file is returned.

I have included the the passed FILE variable in the e-mail body to verify that.

2:
The use of strrchr funct. here , seems bogus to me.

if ( strrchr (__FILE__ , 'disconnect') )

From : https://www.php.net/manual/en/function.strrchr.php
strrchr — Find the last occurrence of a character in a string

I want a full string match , not a character match.

I replaced that with strpos()
Watch out .. the !== false is not a kludge.

if ( strpos (__FILE__ , 'ovpn-disconnect') !== false )

I could have used different connect & disconnect files , and skipped the file match of "disconnect".
But the challenge of detecting & resolve the FILE variable had to be overcomed

So even though they are two separate files , the contents are equal.

Hope it's usable for someone

/Bingo

Gertjan

@bingo600 said in Email Notification - OpenVPN Client Connect (Common Name):

DON'T symlink the disconnect script to the connect script.

That breaks the script.

Because this :

if ( strrchr (__FILE__ , 'disconnect') )

The "disconnect.sh" should contain the word "disconnect" so it knows it's called on a disconnect event.

"strrchr " means the word "disconnect" should exist in the file name.

You can of course use seperate files for both events.
Or choose other file names, but in that case, the _FILE search has to be adapted, if needed.

bingo600

@gertjan
Nope ...

From : https://www.php.net/manual/en/function.strrchr.php
strrchr — Find the last occurrence of a character in a string

I'we used that functions tonzz of times in "C".

Edit: Re: symlink
If you prepend the FILE . as below , you'll see how it's resolved in your e-mail body.
connect vs disconnect.

$local_connect_value = __FILE__ . " \n user_name: "

bingo600

@gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

You can of course use seperate files for both events.
Or choose other file names, but in that case, the _FILE search has to be adapted, if needed.

I totally agree here ... Match the __FILE with the filename used for disconnect

/Bingo

noplan

@bingo600

and what does the output look like ?

something like that, and this txt file will
a) be mailed to admin via cron each Sunday morining 09:00
b) will be cleared each Sunday morning 09:05 after file was mailed
(storing a backup of this file would be pretty cool ) just in case the mail isnt workin ;)

Then the rest is up to som fancy XLS reporting stuff ;)

helps you out comparing the billed hours on your system with the real hours they spend on it.

bingo600

@noplan said in Email Notification - OpenVPN Client Connect (Common Name):

@bingo600

and what does the output look like ?

I just added the called filename to the output.
And fixed the "stringcompare"

Rest is the same.

Credit for the script & decoding the env vars , should go to the original authors.

/Bingo

Armstrong

This post is deleted!

newnub

Apparently there is a bug with FreeRADIUS and Assigned IPv4 Address for your OpenVPN if you use the email script by adding it to:
OpenVPN Server -> Advanced Configuration > Custom Options

If you invoke script from Custom Options under OpenVPN Server -> Advanced Configuration, then FreeRADIUS will no longer assign your static IPv4 for OpenVPN. I don't know how to get around this but just FYI if suddenly your OpenVPN IP is no longer your defined static address.

Stewart

I know this thread is kinda old but I don't know that starting a new topic is the best course of action. I'm trying to implement this but there is a delay of a couple of minutes on the disconnect script and the connect script won't log if it's waiting for the disconnect script.

In the Advanced Configuration -> Custom Options I have:

I've modified the scripts to both send an email and output to a log file when run. When a client connects, I see the log file updated immediately and the email comes very quickly. When a client disconnects it takes 2 -2.5 minutes before the log file is updated and the email is sent. During that window of time if I reconnect it doesn't log or send an email. There is very little difference in the two scripts at this point as I try to narrow down the issue.

Does anyone have any idea what this delay is and what's going on?

Gertjan

@stewart said in Email Notification - OpenVPN Client Connect (Common Name):

kinda old

Nothing changed.

My /root/notify.sh file :

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " on " . date('F j, Y, g:i a');
	log_error("About to send a mail : Connecting");
	notify_all_remote($local_connect_value);
?>

The disconnect.sh file :

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value .= ", during : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNRECTED.";
	log_error("About to send a mail : Disconnecting");
	notify_all_remote($local_connect_value);
?>

The files :

ls -al *.sh
-rwxr-xr-x  1 root  wheel  353 Sep  8 08:13 disconnect.sh
-rwxr-xr-x  1 root  wheel  316 Sep  8 08:14 notify.sh

I connected to my pfSense VPN server, and disconnected a couple of seconds later.

My centralized syslog server showed :

...
2021-09-08 08:21:32	User.Error	pfsense	1 2021-09-08T08:21:35.264334+02:00 pfsense.my-network.tld php 15669 - - /root/notify.sh: About to send a mail : Connecting
2021-09-08 08:21:35	User.Error	pfsense	1 2021-09-08T08:21:37.728863+02:00 pfsense.my-network.tld php 15908 - - notify_monitor.php: Message sent to my-gmail@gmail.com OK
....
2021-09-08 08:21:49	User.Error	pfsense	1 2021-09-08T08:21:52.325734+02:00 pfsense.my-network.tld php 16254 - - /root/disconnect.sh: About to send a mail : Disconnecting
2021-09-08 08:21:51	Daemon.Warning	pfsense	1 2021-09-08T08:21:54.188458+02:00 pfsense.my-network.tld radvd 93362 - - sendmsg: Permission denied
2021-09-08 08:21:56	User.Error	pfsense	1 2021-09-08T08:21:58.979760+02:00 pfsense.my-network.tld php 15908 - - notify_monitor.php: Message sent to my-gmail@gmail.com OK
....

You can also use a console or SSH session, and execute :

tail -f /var/log/system.log

to see real time system log events.

Logs lines showed up instantly.
I received the mails.

Stewart

@gertjan said in Email Notification - OpenVPN Client Connect (Common Name):

@stewart said in Email Notification - OpenVPN Client Connect (Common Name):

kinda old

Nothing changed.

I only mentioned it because I'm always wary of necroposting and people getting upset. I'm sure it isn't the scripts themselves. Even if I have client-connect and client-disconnect call the same script the delay is still there. Would it matter if the OpenVPN server is set to Remote Access (SSL/TLS + User Auth) and authenticated by the Active Directory?

Gertjan

@stewart said in Email Notification - OpenVPN Client Connect (Common Name):

Even if I have client-connect and client-disconnect call the same script the delay is still there.

I was using the same file for the connect / disconnect event, but @bingo600 has a point - see above.
The OpenVPN connect and disconnect are instantaneously for me.

I'm using myself SSL/TLS only.
Authentication (using AD) only happens when the user logs in.

Stewart

@gertjan

I'm using different scripts for each event but tried it with the same script to rule it out.

Stewart

Progress! I've found that if I add
explicit-exit-notify
to the client then it populates immediately. I guess that without it then it's waiting for a timeout period before it disconnects the session.

Since we have a lot of clients out there already, is there a way to add this to the VPN server config? Or does it have to be manually entered into every client? I've tried adding into the server Custom Options but it doesn't work.

Gertjan

@stewart said in Email Notification - OpenVPN Client Connect (Common Name):

Progress! I've found that if I add
explicit-exit-notify
to the client then it populates immediately.

Client ?
These are OpenVPN server 'custom' command options.
At least, they are in the context of this forum thread.
You can see the doc here : https://build.openvpn.net/man/openvpn-2.5/openvpn.8.html

You are using OpenVPN 2.5.x, right ? And UDP tunnnels ?

@stewart said in Email Notification - OpenVPN Client Connect (Common Name):

I've tried adding into the server Custom Options but it doesn't work.

As above, see again :

JeGr

@stewart said in Email Notification - OpenVPN Client Connect (Common Name):

Progress! I've found that if I add
explicit-exit-notify
to the client then it populates immediately. I guess that without it then it's waiting for a timeout period before it disconnects the session.

It is. For UDP clients you have to wait your configured timeout period (normally ~60-90s) for the disconnect script to get executed as the server doesn't see the client disconnecting. Explicit-exit-notify on the client fixes that by alerting the server of the clients disconnect wish.

Gertjan

@jegr Aha !! I get it.
I was disconnecting manually my client, by sliding the on/off button in the client while testing.
That probably makes the sending a "connection down" to the server, so there were no delays for me doing such a test.

When the client looses the connection because of bad data reception (Wifi or data carrier like 4G5G) then the server would apply a wait period before it fires a "client-disconnect" cmd.

@JeGr Thanks for making that clear.