Thank you for the information. With this
https://forums.openvpn.net/viewtopic.php?t=15927 as a start I was able to get exactly what I needed. I had to change a few things for Python3 and this was my first python script so I am sure there are things that are in there that probably aren't needed. I installed postfix as a simple send only mail server on the machine in order to send the mail as described
here. I did not do the SSL config portion as messages will be sent internally.
I created my script file on the Access Server and saved it as auth_script.py:
import time
import datetime
import smtplib
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from email.utils import COMMASPACE, formatdate
from datetime import datetime
# mail server information
mailsubject = "OpenVPN Connection"
mailsender = "OVPN Notification <from@email.com>"
mailserver = "localhost"
time = datetime.now().strftime('%Y-%m-%d %H:%M:%S')
def sendMail(to, fro, subject, text,server="localhost"):
assert type(to)==list
#assert type(files)==list
msg = MIMEMultipart()
msg['From'] = fro
msg['To'] = COMMASPACE.join(to)
msg['Date'] = formatdate(localtime=True)
msg['Subject'] = subject
msg.attach( MIMEText(text) )
smtp = smtplib.SMTP(server)
smtp.sendmail(fro, to, msg.as_string() )
smtp.close()
def post_auth(authcred, attributes, authret, info):
print("********** POST_AUTH %s %s %s %s" % (authcred, attributes, authret, info) + "\r\n************ POST_AUTH END")
body = ''
body = "Successful OpenVPN Connection at " + time + '\r\n'
if authcred.get('username'):
username = authcred.get('username')
else:
username = 'missing'
if authcred.get('client_ip_addr'):
client_ip = authcred.get('client_ip_addr')
else:
client_ip = 'noip'
body = body + "Username: " + username + '\r\n'
body = body + "Client IP: " + client_ip + '\r\n\n'
body = body + "Please note this connection. If the user should not be a member of OpenVPN group let IT know."
sendMail(['To Name <to@email.com>,To2 Name2 <to2@email.com>'],mailsender,mailsubject,body)
return authret
I then navigated to the scripts folder (on my openvpn_as it is /usr/local/openvpn_as/scripts) and ran this command:
./sacli --key "auth.module.post_auth_script" --value_file="<POST_AUTH_SCRIPT_PATH_AND_FILENAME>" ConfigPut
Then I restarted the server to apply this config:
./sacli start
Now when a successful OpenVPN connection is established, our admins receive an email with the username,time,client_ip of the connection for logging purposes. authcred, attributes, authret, info definitely have other variables that may be valuable to you. You can see in the /var/log/openvpn_as log that print command shows you the variables that may be useful.
