Syslog openvpn

tunge2

I want to see the users that logon and logoff from/with Openvpn on our Pfsense machine. (they connect with cerificates) I do not see any authenticated log rules. The rest i see in our syslog file

I have made an export to syslog (export pfsense-Openvpn log.)

Gertjan

@tunge2 said in Syslog openvpn:

I want to see

Ask OpenVPN to show the details.
Like :

to the maximum value.
Expect a lot of details.

tunge2

@Gertjan Thank You

Thats a lot of information but not al little overkill
. It still not clear on when a user exactly connect and disconnect

Rico

With the OpenVPN RAS Verbosity Level set to default I see those two lines after a User authenticated successfully:

Mar 23 15:57:01 	openvpn 	62926 	CLIENTIP:CLIENTPORT [USERNAME] Peer Connection Initiated with [AF_INET]CLIENTIP:CLIENTPORT
Mar 23 15:57:01 	openvpn 		user 'USERNAME' authenticated

-Rico

Gertjan

@tunge2 said in Syslog openvpn:

It still not clear on when a user exactly connect and disconnect

Have a look here.
Very recently, some threads discussed just that : VPN connect and disconnect notifications. SEnd to you by mail, etc.

Rico

Log with a matching User/Cert but wrong password:

Mar 23 16:02:42 	openvpn 		user 'USERNAME' could not authenticate.

Log with a wrong (unknown) User:

Mar 23 16:05:15 	openvpn 		Username does not match certificate common name (WRONGUSER != USERNAME), access denied.

-Rico

tunge2

@Rico the first line i found. the second log line i did not found.
The connect line is found.
But the disconnect line in the logfile is not so clear
the only rule is this one. The problem is that i does not say the username. Only that some one disconnects.

Logfile Openvpn
openvpn[42273]: MANAGEMENT: Client disconnected

tunge2

@Rico we only use certificates without the username part.

Gertjan

Found it : https://forum.netgate.com/topic/151351/email-notification-openvpn-client-connect-common-name

tunge2

@Gertjan but thats different right? i use syslog and not direct php on the pfsense system