Email Notification - OpenVPN Client Connect (Common Name)

[Armstrong]

@Gertjan Ah yeah, I should've mentioned that it needs to be executable too.

I decided to go full on and just implement over the wire. Scripts work fine.

The only thing I would ask, is that the "disconnect" part doesn't seem to send the disconnect notification until I reconnect? I disconnect, no email, then when I re-connect after a short period I receive two notifications:

13:08:17 user_name: username vpn_client_ip: x.x.x.x on 18 March during : 120 seconds DISCONNECTED
13:08:17 user_name: username vpn_client_ip x.x.x.x 18 March

It doesn't really bother me, I only wanted to know the users, but just out of curiosity.

Thank you for your help!

[provels]

@Armstrong My disco msg lagged a little, but did come about a minute after. Your messages may have overlapped.

EDIT - 2 minutes

[Armstrong]

@provels Yup just tested that (with a little patience), it does indeed send through after about a minute. Must just take a bit for it to fully "close" the connection.

[Armstrong]

Also before I go, I made one change (connecting IP) so adding it to this post if anyone wants that too and would like to just copy and paste.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " user_name: " . getenv('common_name') . " vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') . " from: " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", duration : " . getenv('time_duration') . " seconds, received : " . getenv('bytes_received') . " bytes, send : " . getenv('bytes_sent') ." bytes. DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

Thanks for the input everyone!

[provels]

@Armstrong Great to have if someone happens to snag your creds. Thanks.

[mikekoke]

Hi, I followed the comments and set up the @Armstrong script but I'm not getting any notification.
I created the files, gave the permissions, added the two lines to openvpn and restarted the service.

[Armstrong]

@mikekoke Dumb question, do you have notifications set up in Pfsense to send you emails?

[mikekoke]

Yes of course, I also took the test and received the notification.

[Armstrong]

@mikekoke Gotta ask.

You can connect to the VPN and disconnect as well, no errors with syntax or anything? It should work right away (latest OpenVPN version) so I can only suggest some other issue in your configuration.

I would try my original script and config (client-connect /root/notify.sh) and see if that works for you firstly. If it doesn't then there's more amiss than I could tell you.

[mikekoke]

I can connect to the VPN and everything works correctly, the script I am using is the first one, that of your post.

[Armstrong]

@mikekoke Can you run that notify script from the terminal verbose and see what happens?

It sounds like there's a problem with notifications, if everything's running but you're not getting an email. As I said it works straight away if you have email notifications on and everything on the latest version.

[mikekoke]

When I try to run it it exits written: Exception: Zend Extension ./disconnect.sh does not exist

edit: Problem solved. Thanks for your help.

[Armstrong]

@mikekoke What was the issue?

[mikekoke]

I had to create the files from the terminal.

[noplan]

@Armstrong said in Email Notification - OpenVPN Client Connect (Common Name):

i felt free to make some cahnges for a readable output.
the output from disconnect.sh received via e-mail looks now like this.

as far as i'm concerned with this output i don't need the connect.sh cuz as the more users there are
the more e-mails you'll receive.

the source for disconnect.sh is here.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

to reduce the mass on mails i was thinkin to use disconnect.sh with (client specific overrides)

but it was not workin and ended with someting like this:
Options error: option 'client-disconnect' cannot be used in this context

The main reason i wanted to do this, i put my clients in categries like

• management (trusted)
• sysops (trusted)
• employees (trusted ;)
• contractors (notification needed)

so that notification will only be sent if (untrusted or notification needed) as i mentioned earlier reduce tons of mails.
but i'll open a topic on this one and edit this post later on.

any hints are welcome
#stayHealthy

[Armstrong]

@noplan That definitely looks a lot better format-wise, thanks for the update. PHP isn't my strongest area.

I only have a small number of users so it's OK with me to have the number of emails I do, though for a larger organization it makes sense. I'm afraid I couldn't comment on the use of client overrides, but someone else may be able to provide advice.

[noplan]

i'm so happy that you came up with a version i can play on.
and look its workin. pretty fine.

if someone digs into it a cool thing would be a email
and a weekly report send by cron
vpn-client | date | time-in | time-out | client-vpn-ip | client foreign ip | duration connection (hours) | received (MB) | send (MB) |

mybe a nice project.
so a weekly report of VPN-clients "timesheets" could be generated

but maybe all things niceToHave on a firewall ;)

writtin this post
i am thinking to write the informations vom disconnect.sh into a txt file and send it via cron to
another machine doing the formating and generating a sweet pdf. (this could be fun i think )

#stayHealthy

[vettalex]

Hi guys, sorry if I reopen this discussion;

• I have configured the pfsense notifications and by sending the smtp test, the e-mail will arrive safely.
• I created the notify.sh file and placed it under root
• I ran the command: chmod + x /root/notify.sh to make it executable
• I also ran the ls -al notify.sh command and the result is this:
  
• but I don't receive any email when I connect remotely, nothing at all :(
  The notify.sh file contains this:
  
  I tried to manually start the notify.sh file with the ./notify.sh command under root, but nothing happens ...
  at this point I would like to check the notification logs and together with you understand the problem. Do you know where the notification logs are located?

[mikekoke]

Create the notify.sh file from the pfsense gui with Diagnostics -> Edit File or from the terminal, I had the same error, I had created the file on windows and moved it to pfsense through winscp but it didn't work.

[vettalex]

@mikekoke Hello and thank you first.
After some time I managed to create the file and compile it, but despite this, it still doesn't go.
I did this procedure:
Compiled like this and saved:

After that I sent the command chmod +x /root/notify.sh from ssh (putty), since I don't know how to send it from diagnostics-command prompt.
Where am I wrong?