github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity

update abuseipdb.local accordingly 

- Replace local file storage with AbuseIPDB SQLite database.
- Add info about preventing leaking sensitive information on reports
pull/3948/head
Hasan ÇALIŞIR 2025-03-03 18:28:46 +03:00 committed by GitHub
parent d13660c588
commit fa4ce4acba
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
files/abuseipdb.local
View File

@ -8,8 +8,8 @@
# providing users with improved control, flexibility, and security when reporting abusive IPs. # providing users with improved control, flexibility, and security when reporting abusive IPs.
# #
# Key Enhancements: # Key Enhancements:
# - Implements a **local banned IP list** to ensure **complete isolation** from Fail2Ban, # - Implements a **AbuseIPDB SQLite DB** to ensure **complete isolation** from Fail2Ban,
# enabling the script to manage and track IP bans without relying solely on Fail2Ban's internal ban management. # enabling the script to manage and track IP bans without relying solely on Fail2Ban's internal DB and ban management.
# - Performs **two API calls**: # - Performs **two API calls**:
# 1. `/v2/check`: Verifies if the IP is already reported to AbuseIPDB. # 1. `/v2/check`: Verifies if the IP is already reported to AbuseIPDB.
# 2. `/v2/report`: Reports the IP to AbuseIPDB if necessary, ensuring efficient use of API calls. # 2. `/v2/report`: Reports the IP to AbuseIPDB if necessary, ensuring efficient use of API calls.
@ -18,6 +18,18 @@
# - **Prevents redundant reporting** by checking the local list before making a report to AbuseIPDB. # - **Prevents redundant reporting** by checking the local list before making a report to AbuseIPDB.
# - Provides **custom comments** for IP reports, helping to avoid the leakage of sensitive information. # - Provides **custom comments** for IP reports, helping to avoid the leakage of sensitive information.
# #
# Example 'jail' configuration in 'jail.local' to prevent leaking sensitive information in AbuseIPDB reports:
# [nginx-botsearch]
# enabled = true
# logpath = /var/log/nginx/*.log
# port = http,https
# backend = polling
# tp_comment = Fail2Ban - NGINX bad requests 400-401-403-404-444, high level vulnerability scanning
# maxretry = 3
# findtime = 1d
# bantime = 7200
# action = %(action_mwl)s
# %(action_abuseipdb)s[matches="%(tp_comment)s", abuseipdb_apikey="YOUR_API_KEY", abuseipdb_category="21,15", bantime="%(bantime)s"]
[Definition] [Definition]
# Option: norestored # Option: norestored
@ -37,7 +49,7 @@
# ! Bypassing Fail2Ban on restarts (BYPASS_FAIL2BAN = 1) can overhelm your server and AbuseIPDB API on restarts # ! Bypassing Fail2Ban on restarts (BYPASS_FAIL2BAN = 1) can overhelm your server and AbuseIPDB API on restarts
# ! Use this option if you want to completely isolate from Fail2Ban and rely solely on the local banned IP list for reporting. # ! Use this option if you want to completely isolate from Fail2Ban and rely solely on the local banned IP list for reporting.
# BANNED_IP_LIST = "/var/log/abuseipdb/abuseipdb-banned.log" # SQLITE_DB="/var/lib/fail2ban/abuseipdb/fail2ban_abuseipdb"
# LOG_FILE = "/var/log/abuseipdb/abuseipdb.log" # LOG_FILE = "/var/log/abuseipdb/abuseipdb.log"
# BYPASS_FAIL2BAN = 0 # BYPASS_FAIL2BAN = 0
@ -46,18 +58,18 @@
###################### ######################
# Notes.: DO NOT MODIFY, JUST UNCOMMENT # Notes.: DO NOT MODIFY, JUST UNCOMMENT
# actionstart = nohup /etc/fail2ban/action.d/fail2ban_abuseipdb.sh \ # actionstart = nohup /etc/fail2ban/action.d/fail2ban_abuseipdb.sh \
# "--actionstart" "<BANNED_IP_LIST>" "<LOG_FILE>" & # "--actionstart" "<SQLITE_DB>" "<LOG_FILE>" &
# Option: actionban # Option: actionban
###################### ######################
# Notes.: DO NOT MODIFY, JUST UNCOMMENT # Notes.: DO NOT MODIFY, JUST UNCOMMENT
# actionban = /etc/fail2ban/action.d/fail2ban_abuseipdb.sh \ # actionban = /etc/fail2ban/action.d/fail2ban_abuseipdb.sh \
# "<abuseipdb_apikey>" "<matches>" "<ip>" "<abuseipdb_category>" "<bantime>" "<restored>" "<BYPASS_FAIL2BAN>" "<BANNED_IP_LIST>" "<LOG_FILE>" # "<abuseipdb_apikey>" "<matches>" "<ip>" "<abuseipdb_category>" "<bantime>" "<restored>" "<BYPASS_FAIL2BAN>" "<SQLITE_DB>" "<LOG_FILE>"
[Init] [Init]
# Option: abuseipdb_apikey # Option: abuseipdb_apikey
###################### ######################
# Notes Set your API key and COMMENT OUT # Notes Set your API key and UNCOMMENT
# abuseipdb_apikey = # abuseipdb_apikey =