[Resolved] up, down-pre, and down scripts not being executed

TJNII

I have a working openVPN bridge server. I'm trying to hook into down-pre for to generate some audit logs. However, none of these scripts are being executed.

I am attempting to run a simple shell script which appends `date` to a logfile. When I connect / disconnect I do not see any output in the log file. I have tried running the script as nobody, and I have set openVPN to run as root for debugging.

My server configuration:

port 1194
proto tcp-server

## Device to use
dev tap0

## Certificate configs
tls-server
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/openVPN.crt
key /etc/openvpn/keys/openVPN.key
dh /etc/openvpn/keys/dh2048.pem


# Tell OpenVPN to be a multi-client server
mode server
server-bridge


# Push DHCP options to Windows clients.
push "dhcp-option DOMAIN [OMITTED]"
push "dhcp-option DNS [OMITTED]"

# Force all traffic through the VPN tunnel
push "redirect-gateway def1"

# Delete client instances after some period
# of inactivity.
inactive 600

## Tunnel keepalive
## Keepalive every 5 secs, failover after 20 secs
keepalive 5 20

## Enable compression
comp-lzo

## Privilege deesclation
#user nobody
#group nobody
persist-key
persist-tun

## Logging options
## Don't add log or log-append options as they will redirect logging away from syslog.
verb 5

script-security 2
up-restart
down-pre "/etc/openvpn/logTraffic.sh down-pre"
down "/etc/openvpn/logTraffic.sh down"
up "/etc/openvpn/logTraffic.sh up"

## Authentication options
duplicate-cn
client-cert-not-required
username-as-common-name
auth-nocache
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so openvpn

The documentation says that these scripts are run when the device (tap0 in this case) changes state, however I believe with this configuration that won't happen as tap0 is persistent across connections. If that is true then it would explain why the scripts are not being run. If this is the case, what script hooks are available when bridging? Routing is not an option for unrelated reasons.

janjust

should the date stamp be added when a client connects and/or disconnects? then use 'client-connect' and 'client-disconnect' scripts. The 'up' and 'down' scripts are run only when the openvpn server starts and stops.

TJNII

That works and the scripts are now being run.

However, my final goal is to send openVPN SIGUSR2 on disconnect so that when a session ends openVPN writes the session statistics to the syslog. (More detailed discussion of that is here: https://forums.openvpn.net/topic9392.html)

When client-disconnect is run openVPN has already closed the connection and flushed the stats I need from its status buffer. Is there a variation of "client-disconenct" that runs when I client disconnects but before the server reacts to it? Something like how I would expect "down-pre" to act on device close?

mmiller

Edit: I fail at reading comprehension. (You mentioned down-pre already.) I'm looking into it.

In the man page under Environmental Variables:
bytes_received
Total number of bytes received from client during VPN session.
Set prior to execution of the --client-disconnect script.

bytes_sent
Total number of bytes sent to client during VPN session. Set
prior to execution of the --client-disconnect script.

time_duration
The duration (in seconds) of the client session which is now
disconnecting. Set prior to execution of the --client-discon-
nect script.

Are these insufficient for what you need to record?

Addendum: If this is the type of information you're looking for, but they don't seem to be set, remember that --setenv-safe will prepend OPENVPN_ to all your variables. You can have your client-disconnect script save them all with an "env > closing.log" to see what kind of goodies are available to you.

TJNII

That works!

Thread closed.