Script to send email when a hotspot user login

Script to send email when a hotspot user login

The script checks each hotspot login. New firewall rules are added that attempt to add the user to the Firewall's Address List for X number of days. Users are filtered by whatever string you choose. This was tested on a stock hotspot without any other custom firewall rules, so it's possible that customized firewall rules could interfere. One thing to keep in mind is that dynamic Address List entries are created, and they are not persistent if the router reboots.

Instructions:
1. Edit the CONFIG section at the top of the script
2. You may need to edit the /tool e-mail... code further down in the script, in case your email settings are different
3. Paste this script in IP > Hotspot > User Profiles > Scripts > On Login
4. Tools > Email might need to be configured for sending email

Code:

# CONFIG --------------------------------------------\

# Email address to send to
:local emailaddress "email@domain.com";

# How long user stays in Address List
:local timeout 30d;

# Name filter, only process usernames that start with this string, CASE sensitive
# If you want to allow all users, remove everything between the quotes :local nameFilter "";
:local nameFilter "AD";

# END CONFIG ----------------------------------------/



# if username starts with nameFilter, proceed
if ([:find "$user" "$nameFilter"] = 0) do={
   /log info "[HOTSPOT] - $user - logged in, matches name filter";

# Set date and time variables
   :local date [/system clock get date];
   :local time [/system clock get time];
# get user IP
   :local ip [/ip hotspot active get [find user="$user"] address];
# delcare a few variables
   :local emailsubject;
   :local emailbody;

# if user does NOT exist in Address List
   :if ([:len [/ip firewall address-list find list~"^$user - HSLOGIN"]] = 0) do={
      /log info "[HOTSPOT] - $user - not found in Address List";

# add firewall rules that will add dynamic address list entry
      /ip firewall filter add action=add-src-to-address-list address-list="$user - HSLOGIN,$date,$time" address-list-timeout=$timeout chain=pre-hs-input disabled=no src-address=$ip comment="$user - HSLOGIN";
      /ip firewall filter add action=add-src-to-address-list address-list="$user - HSLOGIN,$date,$time" address-list-timeout=$timeout chain=forward disabled=no src-address=$ip comment="$user - HSLOGIN";

      :local counter 0;
# number of times to attempt to add user to Address List before giving up   
      :local limit 60;
# delay between attempts
      :local delaytime 5s;
# loop a number of times to check if user is added to Address List   
      :while (counter < $limit) do={
         :set counter ($counter + 1);
         /log info "[HOTSPOT] - $user - checking if user is in Address List - attempt $counter of $limit";
# wait between Address List checks      
         :delay $delaytime;
# if Address List entry is found, proceed
         :if ([:len [/ip firewall address-list find list~"^$user - HSLOGIN"]] = 1) do={
            /log info "[HOTSPOT] - $user - user has been added to Address List, sending email";
# set email subject and body variables
            :set emailsubject "New Hotspot Login ($user)";
            :set emailbody "User: $user\r\n$time, $date\r\nIP: $ip\r\nExpires in: $timeout";
# increment counter
            :set counter ($limit+10);
         } else={
# if we have reached the limit of times to check, send email
            :if ($counter = $limit) do={
               /log info "[HOTSPOT] - $user - failed to add user to Address List, sending email";
# set email subject and body variables
               :set emailsubject "New Hotspot Login ERROR ($user)";
               :set emailbody "ERROR: failed to add to Address List, need to investigate.\r\n\r\nUser: $user\r\n$time, $date\r\nIP: $ip\r\n";
            }
         }
      }
# remove firewall rules afterwards
      /ip firewall filter remove [find comment="$user - HSLOGIN"];
# send email
      /tool e-mail send to="$emailaddress" subject="$emailsubject" body="$emailbody";
# if user DOES exist in address list   
   } else={
      /log info "[HOTSPOT] - $user - already in Address List";
   }
# if user does not match name filter   
} else={
   /log info "[HOTSPOT] - $user - logged in, does not match name filter";
}