1

We recently setup a LibreSwan VPN and for the most part it is working great. One thing we are having some trouble with is trying to see who is currently logged in. I found a solution for seeing the number of active solutions at https://lists.openswan.org/pipermail/users/2011-January/020042.html but not for actually seeing who is logged into the sessions (removing the grep gives a lot of detail including connected IP's but not the actual usernames).

My current thought is to grep /var/log/messages for connections and report any that don't have an accompanying disconnect message. PPPD is nice enough to tag everything with the PID which makes it somewhat straightforward, but I was hoping there is a better way.

2 Answers 2

3

In case anyone else comes across this, here is the script I ended up using. It searches /var/log/messages for log in messages, then checks if the PID is still in use by pppd. It outputs just the user name and when they logged in.

#!/bin/bash
# Process each log in message
grep "logged in" /var/log/messages | grep pppd | while read -r line ; do
    #echo "$line"  # Useful for debugging
    # Extract the PID
    pid=$(echo $line | cut -d "[" -f2 | cut -d "]" -f1)
    user=$(echo $line | grep -o -P '(?<=user ).*(?= logged)')
    #echo $pid  # Useful for debugging
    # See if the PID is still in use
    ps aux | grep pppd | grep $pid  > /dev/null
    disconnectCheck=$?
    # If it is in use report the user who logged in as active
    if [[ $disconnectCheck -eq 0 ]] ; then
        echo "$user logged in at ${line:0:15}"
    fi
done
0

I added this to my /etc/ppp/options.xl2tpd:

plugin /usr/lib64/pptpd/pptpd-logwtmp.so

(my server also has PPTPD installed - but disabled.)

With that in place, I can do:

last | grep ppp | grep "still logged in"

Only downside is, unlike a pptp session, it doesn't record the IP address of the connecting client.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .