We recently setup a LibreSwan VPN and for the most part it is working great. One thing we are having some trouble with is trying to see who is currently logged in. I found a solution for seeing the number of active solutions at https://lists.openswan.org/pipermail/users/2011-January/020042.html but not for actually seeing who is logged into the sessions (removing the grep gives a lot of detail including connected IP's but not the actual usernames).

My current thought is to grep /var/log/messages for connections and report any that don't have an accompanying disconnect message. PPPD is nice enough to tag everything with the PID which makes it somewhat straightforward, but I was hoping there is a better way.


In case anyone else comes across this, here is the script I ended up using. It searches /var/log/messages for log in messages, then checks if the PID is still in use by pppd. It outputs just the user name and when they logged in.

# Process each log in message
grep "logged in" /var/log/messages | grep pppd | while read -r line ; do
    #echo "$line"  # Useful for debugging
    # Extract the PID
    pid=$(echo $line | cut -d "[" -f2 | cut -d "]" -f1)
    user=$(echo $line | grep -o -P '(?<=user ).*(?= logged)')
    #echo $pid  # Useful for debugging
    # See if the PID is still in use
    ps aux | grep pppd | grep $pid  > /dev/null
    # If it is in use report the user who logged in as active
    if [[ $disconnectCheck -eq 0 ]] ; then
        echo "$user logged in at ${line:0:15}"

I added this to my /etc/ppp/options.xl2tpd:

plugin /usr/lib64/pptpd/pptpd-logwtmp.so

(my server also has PPTPD installed - but disabled.)

With that in place, I can do:

last | grep ppp | grep "still logged in"

Only downside is, unlike a pptp session, it doesn't record the IP address of the connecting client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.