Email Notification - OpenVPN Client Connect (Common Name)

mikekoke

I had to create the files from the terminal.

noplan

@Armstrong said in Email Notification - OpenVPN Client Connect (Common Name):

i felt free to make some cahnges for a readable output.
the output from disconnect.sh received via e-mail looks now like this.

as far as i'm concerned with this output i don't need the connect.sh cuz as the more users there are
the more e-mails you'll receive.

the source for disconnect.sh is here.

#!/usr/local/bin/php -q
<?php
	require_once("/etc/inc/notices.inc");
	$local_connect_value = " \n user_name: " . getenv('common_name') . " \n vpn_client_ip: " . getenv('ifconfig_pool_remote_ip') ." connected from " . getenv('trusted_ip') . " on " . date('F j, Y, g:i a');
	if ( strrchr (__FILE__ , 'disconnect') ) {
	$local_connect_value .= ", \n duration : " . round(((getenv('time_duration'))/3600),2) . "  hours, or " . round(((getenv('time_duration'))/60),2) . "  minutes, or " . getenv('time_duration') . "  seconds,\n upload from vpn-client (received) : " . round(((getenv('bytes_received'))/1048576),2) . " MB, \n download to vpn-client (send) : " . round(((getenv('bytes_sent'))/1048576),2) ." MB. \n DISCONNECTED.";
	}
	notify_all_remote($local_connect_value);
?>

to reduce the mass on mails i was thinkin to use disconnect.sh with (client specific overrides)

but it was not workin and ended with someting like this:
Options error: option 'client-disconnect' cannot be used in this context

The main reason i wanted to do this, i put my clients in categries like

management (trusted)
sysops (trusted)
employees (trusted ;)
contractors (notification needed)

so that notification will only be sent if (untrusted or notification needed) as i mentioned earlier reduce tons of mails.
but i'll open a topic on this one and edit this post later on.

any hints are welcome
#stayHealthy

Armstrong

@noplan That definitely looks a lot better format-wise, thanks for the update. PHP isn't my strongest area.

I only have a small number of users so it's OK with me to have the number of emails I do, though for a larger organization it makes sense. I'm afraid I couldn't comment on the use of client overrides, but someone else may be able to provide advice.

noplan

i'm so happy that you came up with a version i can play on.
and look its workin. pretty fine.

mybe a nice project.
so a weekly report of VPN-clients "timesheets" could be generated

but maybe all things niceToHave on a firewall ;)

writtin this post
i am thinking to write the informations vom disconnect.sh into a txt file and send it via cron to
another machine doing the formating and generating a sweet pdf. (this could be fun i think )

#stayHealthy

vettalex

Hi guys, sorry if I reopen this discussion;

I have configured the pfsense notifications and by sending the smtp test, the e-mail will arrive safely.
I created the notify.sh file and placed it under root
I ran the command: chmod + x /root/notify.sh to make it executable
I also ran the ls -al notify.sh command and the result is this:
but I don't receive any email when I connect remotely, nothing at all :(
The notify.sh file contains this:

I tried to manually start the notify.sh file with the ./notify.sh command under root, but nothing happens ...
at this point I would like to check the notification logs and together with you understand the problem. Do you know where the notification logs are located?

mikekoke

Create the notify.sh file from the pfsense gui with Diagnostics -> Edit File or from the terminal, I had the same error, I had created the file on windows and moved it to pfsense through winscp but it didn't work.

vettalex

@mikekoke Hello and thank you first.
After some time I managed to create the file and compile it, but despite this, it still doesn't go.
I did this procedure: notify.sh diagnostics.JPG
Compiled like this and saved:
notify.sh diagnostics intern.JPG
After that I sent the command chmod +x /root/notify.sh from ssh (putty), since I don't know how to send it from diagnostics-command prompt.
Where am I wrong?

Armstrong

@vettalex said in Email Notification - OpenVPN Client Connect (Common Name):

Where am I wrong?

Did you definitely add the client-connect /root/notify.sh part to the configuration of OpenVPN?

vettalex

@Armstrong Yes, in OpenVPN - Server - Edit Server:
edit server openvpn.JPG

Armstrong

@vettalex OK, I just tested by running my own notify.sh (which is different now to the one you're using) and that sends me an empty email. That suggests you have a problem with the notification and probably some kind of syntax error.

I would maybe try to run php -l notify.sh or lint the raw php to see if there are any syntax errors. I would generally suggest coding the script yourself from scratch (not copying and pasting) to avoid random errors. Lint first, then rebuild and test again. If the code checks out you have a notification issue.

Equally I would test with one of the newer notify.sh scripts deeper into the thread.

noplan

Hey folks
What I don't get and what's pretty frustrating
Readin this from top to bottom gives you a step by step howto for dummies to achieve a pretty professional solution for the request the only f#@&* thing u have to do is read and think

I don't get it
NP

vettalex

@Armstrong Just done, the result I think is, no syntax errors:
no error.JPG

vettalex

@Armstrong Maybe there we are .... I am finding these errors .. even if they do not correspond to the sending time of the notify.sh scirpt (how can I check the correct date and time of pfsense?).
The strange thing is that the SMTP test during the configuration of the notification, is successful:
eroro log sent mail.JPG

vettalex

Everything ok, it was a google problem ... I don't know what problem it was. I used another email and everything works. Thanks a lot to all guys

mrvanity

This post is deleted!

PM_13

@Armstrong I followed these instructions:

SMTP notification is working from "Advanced Setup", checked it again!
Added under OpenVPN server following lines:

client-connect /root/notify.sh

The script at /etc/notify.sh has executable flag and reads as follows:

#!/usr/local/bin/php -q
<?php

        require_once("/etc/inc/notices.inc");
        notify_all_remote("VPN Connected");
?>

The client connects to OpenVPN but not getting email notification.

And do not see any errors in the log either. Is there anything I missed from the steps above or you have any pointers?

Thanks!

FuzzzyWuzzzy

@PM_13 You're calling the script at /root, but you say that you're script is actually located in /etc ?

PM_13

@CollectiveSoul thanks for your comments.

I checked the configuration, the script is at "/root/notify.sh" and have mis-typed in the message above.

One sideline question, if I run this script (as root) from command line then it should send an email..correct?Just hoping that I do not have to log in from OpenVPN to test it.

Thanks.

Gertjan

@PM_13 said in Email Notification - OpenVPN Client Connect (Common Name):

if I run this script (as root) from command line then it should send an email..correct?

Yes. The mail would be send.

Can you test this :

[2.4.5-RELEASE][admin@pfsense.internal.net]/root: file notify.sh
notify.sh: PHP script, ASCII text executable
[2.4.5-RELEASE][admin@pfsense.internal.net]/root: ls -al notify.sh
-rwxr-xr-x  2 root  wheel  504 Jun 26  2019 notify.sh

edit : when a mail is actually send - accepted by the mail server, you see this in the main log :

Not seeing such a line means : the mail never got out.

PM_13

@Gertjan Found some interesting things:

[2.4.5-RELEASE][admin@pfSense.localdomain]/root: file notify.sh
notify.sh: PHP script, ASCII text executable
[2.4.5-RELEASE][admin@pfSense.localdomain]/root: ls -al notify.sh
-rwxr-xr-x  1 root  wheel  124 Oct  5 19:56 notify.sh

After executing notify.sh from command line (as root), in the logs I see following:

Oct 7 19:51:09	php-cgi		notify_monitor.php: Could not send the message to <redacted> -- Error: Failed to set sender: <redacted> [SMTP: Invalid response code received from server (code: 550, response: 5.1.0 Authentication required)]

So went back to System => Advanced => Notifications and re-entered the values for email server, smtp server, login, password, port etc. Then hit "Test SMTP Settings" and I receive a test email promptly.

Went back to command prompt and executed "notify.sh" and got the same error again.

So the SMTP works for test settings but not for "notify.sh" command line execution.
Any ideas what I might be missing here?