Logging#

There are three places where you can have VPN server logging:

• OpenVPN logging
• VPN client connection logging
• Web server logging

Journal#

Except for the web server log, the logging is written to the systemd journal.

We noticed that by default the log retention is based on the disk space used by the log, and not a retention time. In order to solve this you can run the following commands and set the log retention to 1 month:

$ sudo mkdir -p /etc/systemd/journald.conf.d
$ cat << 'EOF' | sudo tee /etc/systemd/journald.conf.d/retention.conf
[Journal]
MaxRetentionSec=1month
EOF
$ sudo systemctl restart systemd-journald

OpenVPN Log#

The OpenVPN logging can be enabled in the Profile Configuration with the oEnableLog option.

This is mostly useful for debugging connection problems, e.g. figure out why a client connection was rejected. You can use journalctl to “follow” the log:

$ sudo journalctl -f -t openvpn

Authentication Log#

NOTE: this information is current as of vpn-user-portal >= 3.6.4

When using a “local” authentication mechanism, i.e. LDAP, RADIUS or the local user database, a syslog entry is generated of both successful and failing user authentication.

By default the “User ID” is logged for which the authentication was performed, or attempted, e.g.:

$ journalctl -f -t vpn-user-portal
Mai 17 09:56:39 X vpn-user-portal[8538]: AUTH OK [USER_ID=foo]
Mai 17 09:56:50 X vpn-user-portal[8538]: AUTH FAIL [USER_ID=bar]

We made it possible to configure this log format using the authLogOkTemplate and authLogFailTemplate templates. The below shows the default:

    'Log' => [
        'authLogOkTemplate' => 'AUTH OK [USER_ID={{USER_ID}}]',
        'authLogFailTemplate' => 'AUTH FAIL [USER_ID={{USER_ID}}]',
    ],

You can additionally use the following template variables that will be replaced by their actual values:

NOTE: in vpn-user-portal >= 3.7.0 we sanitize the USER_ID value and replace all characters that are not a-z, A-Z, 0-9, . and - with an underscore (_). If you want the actual value provided by the user in the “Username” input field, use RAW_USER_ID.

NOTE: the RAW_USER_ID and FAIL_REASON field MAY contain any character, including " and ], so when “parsing” the syslog message, make sure you take that in consideration!

    'Log' => [
        'authLogOkTemplate' => 'AUTH OK [USER_ID={{USER_ID}},REMOTE_ADDR={{REMOTE_ADDR}}]',
        'authLogFailTemplate' => 'AUTH FAIL [USER_ID={{USER_ID}},REMOTE_ADDR={{REMOTE_ADDR}}]: {{FAIL_REASON}}',
    ],

VPN Connection Log#

Portal#

Finding out which user had a particular IP address at a specified moment can be done through the portal as an admin.

Syslog#

Connect and disconnect events can be written in syslog as well.

Modify /etc/vpn-user-portal/config.php to enable it:

    'Log' => [
        // Write CONNECT/DISCONNECT events to syslog
        // OPTIONAL, DEFAULT = false
        'syslogConnectionEvents' => true,

        // Log the "originating IP", i.e. the IP the VPN client is connecting
        // from. Currently only available for OpenVPN connections.
        // OPTIONAL, DEFAULT = false
        //'originatingIp' => false,

        // Log the `authData` column from the `users` table to syslog as well
        // (Unpadded Base64 URL-safe encoded)
        // OPTIONAL, DEFAULT = false
        'authData' => false,

        // Specify your own connect/disconnect template
        // OPTIONAL, DEFAULT = see below
        //'connectLogTemplate' => 'C {{USER_ID}} {{PROFILE_ID}}',
        //'disconnectLogTemplate' => 'D {{USER_ID}} {{PROFILE_ID}}'

        // GeoIP database to use to determine CC (and "Geo URI") of originating 
        // IP
        //'geoIpDb' => '/usr/local/share/DB-IP/dbip-city-lite.mmdb',
    ],

NOTE: the authData option is available in vpn-user-portal >= 3.4.1. The authData column is currently only used with Guest Access.

NOTE: the connectLogTemplate and disconnectLogTemplate options are only available in vpn-user-portal >= 3.5.0 and makes the authData option obsolete as you can configure your template to include it (or not).

Connect#

Default format:

CONNECT {{USER_ID}} ({{PROFILE_ID}}:{{CONNECTION_ID}}) [{{ORIGINATING_IP}} => {{IP_FOUR}},{{IP_SIX}}]

Example:

CONNECT fkooman (prefer-openvpn:FvrfxD1m0rvaxfWKZFY+kXAb3hn2yQjY7O37po1XDGM=) [* => 10.222.172.6,fde6:76bd:ad97:ac5e::6]

NOTE: the {{CONNECTION_ID}} field is replaced with the X.509 certificate Common Name (CN) of the OpenVPN client certificate, or in case of WireGuard with the WireGuard Public Key.

If the originatingIp configuration option is set to true, the IP address of the client establishing the connection is also logged and written instead of the *. This is currently only available when clients connect using OpenVPN and this IP address is not logged anywhere else.

The default format with authData enabled, looks like this:

CONNECT {{USER_ID}} ({{PROFILE_ID}}:{{CONNECTION_ID}}) [{{ORIGINATING_IP}} => {{IP_FOUR}},{{IP_SIX}}] [AUTH_DATA={{AUTH_DATA}}]

Example:

CONNECT fkooman (prefer-openvpn:FvrfxD1m0rvaxfWKZFY+kXAb3hn2yQjY7O37po1XDGM=) [* => 10.222.172.6,fde6:76bd:ad97:ac5e::6] [AUTH_DATA=eyJ1c2VySWQiOiJmb28ifQo]

NOTE: if no authData is available, this results in the “empty string”, i.e. [AUTH_DATA=]. The authData is always Base64 URL-safe encoded without padding.

Disconnect#

Default format:

DISCONNECT {{USER_ID}} ({{PROFILE_ID}}:{{CONNECTION_ID}})

Example:

DISCONNECT fkooman (prefer-openvpn:FvrfxD1m0rvaxfWKZFY+kXAb3hn2yQjY7O37po1XDGM=)

Templates#

NOTE: only available in vpn-user-portal >= 3.5.0

NOTE: the GEO_IP_* variables are available in vpn-user-portal >= 3.6.1. See Geo IP for more information.

NOTE: the NODE_* variables are available in vpn-user-portal >= 3.7.2.

If you do not like the default templates, or would like additional (or less) information logged, you can use your own templates using the connectLogTemplate and disconnectLogTemplate options.

The table below lists the available variables you can use in your template and when they are available:

If you want to log only the user ID and the profile the user connect(ed) to, you can use this:

'connectLogTemplate' => 'C {{USER_ID}} {{PROFILE_ID}}',
'disconnectLogTemplate' => 'D {{USER_ID}} {{PROFILE_ID}}'

Web Server Log#

The Web server request logging you can enable as well by modifying the virtual host configuration, on Fedora/EL in /etc/httpd/conf.d/vpn.example.org.conf where vpn.example.org is the hostname of your VPN server. In the <VirtualHost *:443> section you can uncomment this line:

TransferLog logs/vpn.example.org_ssl_access_log

After that, restart Apache:

$ sudo systemctl restart httpd

The web server log file will be written to /var/log/httpd/vpn.example.org_ssl_access_log.