Mikrotik – Send email with information about clients connecting to WiFi network

Mikrotik devices give a lot of configuration options to play with, and this post is one of those configuration which automatically register information about login/logouts in wifi network, and at daily basis send them to custom email address.

Let assume you have already configure email capability in mikrotik system.

Next we want to set topic of information we want to store to file (ex. wifi.log):

#winbox
system > logging > actions > add > wifilog, type:disk, filename: wifi.log
system > logging > rules > add > topics: wireless, info action: wifilog

#console
/system logging action add name=wifilog disk-file-name=wifi.log target=disk
/system logging add action=wifilog topics=wireless

#winbox

system > logging > actions > add > wifilog, type:disk, filename: wifi.log

system > logging > rules > add > topics: wireless, info action: wifilog

#console

/system logging action add name=wifilog disk-file-name=wifi.log target=disk

/system logging add action=wifilog topics=wireless

Next lets create script that will be backuping log file, send it to your email account, delete backup to free up some space and delete user that will do those things to not make it a easy target:

#winbox 
system > scripts > add > name: event_wifi

#console
/system script add name=event_wifi

#wklejamy zawartość skryptu:
/user group add name=wifi policy=ftp,read comment="wifi log"
/user add name=wifi group=wifi address=127.0.0.1 comment="wifi log" password=your_password disabled=no
/tool fetch address=127.0.0.1 mode=ftp user=wifi password=your_password src-path=wifi.log.0.txt dst-path=wifi34.txt
:delay 10
/tool e-mail send file=wifi.txt to="your_email@example.com" body="raport" subject=([/system identity get name] . " " . [/system clock get time] . " " . [/system clock get date] . " WiFi Log")
/file set wifi.log.0.txt contents=""
:delay 30
/file remove wifi.txt
/user remove "wifi"
/user group remove "wifi"

#winbox

system > scripts > add > name: event_wifi

#console

/system script add name=event_wifi

#wklejamy zawartość skryptu:

/user group add name=wifi policy=ftp,read comment="wifi log"

/user add name=wifi group=wifi address=127.0.0.1 comment="wifi log" password=your_password disabled=no

/tool fetch address=127.0.0.1 mode=ftp user=wifi password=your_password src-path=wifi.log.0.txt dst-path=wifi34.txt

:delay 10

/tool e-mail send file=wifi.txt to="your_email@example.com" body="raport" subject=([/system identity get name] . " " . [/system clock get time] . " " . [/system clock get date] . " WiFi Log")

/file set wifi.log.0.txt contents=""

:delay 30

/file remove wifi.txt

/user remove "wifi"

/user group remove "wifi"

Don’t forget to setup scheduler that will run our script on daily basis:

#winbox
system > scheduler > add > name: wifi interval: 24:00:00 on event: event_wifi

#console
/system scheduler add name=wifi interval=24:00:00 on-event=event_wifi

#winbox

system > scheduler > add > name: wifi interval: 24:00:00 on event: event_wifi

#console

/system scheduler add name=wifi interval=24:00:00 on-event=event_wifi

Linux – Monitoring sendmail function (php) usage

Often we can encounter server that started to send spam (infected page, virus inside php file, bad plugin).

If its our own server we can very easily monitor usage of sendmail which is commonly used in php to send mails, and we will do it with usage of simply ‘wrapper’ .

1. Create /usr/local/bin/phpsendmail:

vi /usr/local/bin/phpsendmail
### content ###
#!/usr/bin/php
<?php

/**
  This script is a sendmail wrapper for php to log calls of the php mail() function.
  Author: Till Brehm, www.ispconfig.org
  (Hopefully) secured by David Goodwin <david @ _palepurple_.co.uk>
*/

$sendmail_bin = '/usr/sbin/sendmail';
$logfile = '/tmp/mail_php.log';

//* Get the email content
$logline = '';
$pointer = fopen('php://stdin', 'r');

while ($line = fgets($pointer)) {
        if(preg_match('/^to:/i', $line) || preg_match('/^from:/i', $line)) {
                $logline .= trim($line).' ';
        }
        $mail .= $line;
}

//* compose the sendmail command
$command = 'echo ' . escapeshellarg($mail) . ' | '.$sendmail_bin.' -t -i';
for ($i = 1; $i < $_SERVER['argc']; $i++) {
        $command .= escapeshellarg($_SERVER['argv'][$i]).' ';
}

//* Write the log
file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline, FILE_APPEND);
//* Execute the command
return shell_exec($command);
?>
### end of content ###

vi /usr/local/bin/phpsendmail

### content ###

#!/usr/bin/php

<?php

/**

This script is a sendmail wrapper for php to log calls of the php mail() function.

Author: Till Brehm, www.ispconfig.org

(Hopefully) secured by David Goodwin <david @ _palepurple_.co.uk>

$sendmail_bin = '/usr/sbin/sendmail';

$logfile = '/tmp/mail_php.log';

//* Get the email content

$logline = '';

$pointer = fopen('php://stdin', 'r');

while ($line = fgets($pointer)) {

if(preg_match('/^to:/i', $line) || preg_match('/^from:/i', $line)) {

$logline .= trim($line).' ';

}

$mail .= $line;

}

//* compose the sendmail command

$command = 'echo ' . escapeshellarg($mail) . ' | '.$sendmail_bin.' -t -i';

for ($i = 1; $i < $_SERVER['argc']; $i++) {

$command .= escapeshellarg($_SERVER['argv'][$i]).' ';

}

//* Write the log

file_put_contents($logfile, date('Y-m-d H:i:s') . ' ' . $_ENV['PWD'] . ' ' . $logline, FILE_APPEND);

//* Execute the command

return shell_exec($command);

### end of content ###

Lets check where is sendmail:

which sendmail

1	which sendmail

If its not in this localization /usr/sbin/sendmail then we will need to edit above script

Setup right permissions for file:

chmod +x /usr/local/bin/phpsendmail
#make log file
touch /var/log/mail.form
chmod 777 /var/log/mail.form

chmod +x /usr/local/bin/phpsendmail

#make log file

touch /var/log/mail.form

chmod 777 /var/log/mail.form

2. Next we need edit php.ini file

vi /etc/php5/apache2/php.ini
#change this code:
[mail function]
; For Win32 only.
SMTP = localhost
smtp_port = 25

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
;sendmail_path =
## to this:
[mail function]
; For Win32 only.
;SMTP = localhost
;smtp_port = 25

; For Win32 only.
;sendmail_from = me@example.com

; For Unix only.  You may supply arguments as well (default: "sendmail -t -i").
sendmail_path = /usr/local/bin/phpsendmail

vi /etc/php5/apache2/php.ini

#change this code:

[mail function]

; For Win32 only.

SMTP = localhost

smtp_port = 25

; For Win32 only.

;sendmail_from = me@example.com

; For Unix only. You may supply arguments as well (default: "sendmail -t -i").

;sendmail_path =

## to this:

[mail function]

; For Win32 only.

;SMTP = localhost

;smtp_port = 25

; For Win32 only.

;sendmail_from = me@example.com

; For Unix only. You may supply arguments as well (default: "sendmail -t -i").

sendmail_path = /usr/local/bin/phpsendmail

If we use PHP as CGI or suPHP, you need edit also /etc/php5/cgi/php.ini

Restart service:

service apache2 restart

1	service apache2 restart

3. Lets test our wrapper

Create mailtest.php in www directory ex. /var/www/example.com/public_html

<?php
mail('yourname@yourdomain.com','This is a test message subject','This is a test message body');
echo 'Mail sent.'; 
?>

<?php

mail('yourname@yourdomain.com','This is a test message subject','This is a test message body');

echo 'Mail sent.';

Open file in browser

Check if you have something in log file:

cat /var/log/mail.form

1	cat /var/log/mail.form

Linux – change Pure-FTPD log path

Default pure-ftpd settings store logs thru ‘syslog’. Thanks to this we can forward logs inside syslog/rsyslog.

# inside /etc/syslogd.conf file find:

*.*;mail.none;news.none -/var/log/messages

#add ftp.none:

*.*;ftp.none;mail.none.news.none -/var/log/messages

#add new line for ftp:

ftp.* /var/log/ftp

# inside /etc/syslogd.conf file find:

*.*;mail.none;news.none -/var/log/messages

#add ftp.none:

*.*;ftp.none;mail.none.news.none -/var/log/messages

#add new line for ftp:

ftp.* /var/log/ftp

Linux – SQUID3 log rotation

If we want for squid logs to rotate same as the system logs because we don’t want one big blob log:

#root
crontab –e
0 0 * * * /usr/sbin/squid3 -k rotate

#root

crontab –e

0 0 * * * /usr/sbin/squid3 -k rotate

M	T	W	T	F	S	S
« Dec
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31