mirror of
https://github.com/fail2ban/fail2ban.git
synced 2026-03-11 08:55:31 +00:00
Add keywoards_to_remove in abuseipdb action.
- Add `keywoards_to_remove` in abuseipdb action. This is an easy way to filter your reports. All keywords will be replaced with a `REDACTED` placeholder. - As `actionban` is getting long, spread it over new lines to increase readability. Will solve #3428 Sorry for duplicate, removed repo too early. Before submitting your PR, please review the following checklist: - [ ] **CONSIDER adding a unit test** if your PR resolves an issue - [X] **LIST ISSUES** this PR resolves or describe the approach in detail - [X] **MAKE SURE** this PR doesn't break existing tests - [X] **KEEP PR small** so it could be easily reviewed - [X] **AVOID** making unnecessary stylistic changes in unrelated code - [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines (and `# failJSON`) within `fail2ban/tests/files/logs/X` file - [X] **PROVIDE ChangeLog** entry describing the pull request ``` Introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information ```
This commit is contained in:
parent
7bac839603
commit
23c8838634
1 changed files with 20 additions and 5 deletions
|
|
@ -75,17 +75,25 @@ actioncheck =
|
|||
#
|
||||
# By default, this posts directly to AbuseIPDB's API, unfortunately
|
||||
# this results in a lot of backslashes/escapes appearing in the
|
||||
# reports. This also may include info like your hostname.
|
||||
# reports. This also may include info like your hostname (please refer to
|
||||
# <keywoards_to_remove>).
|
||||
# If you have your own web server with PHP available, you can
|
||||
# use my (Shaun's) helper PHP script by commenting out the first #actionban
|
||||
# line below, uncommenting the second one, and pointing the URL at
|
||||
# wherever you install the helper script. For the PHP helper script, see
|
||||
# <https://github.com/parseword/fail2ban-abuseipdb/>
|
||||
#
|
||||
# Tags: See jail.conf(5) man page
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
|
||||
actionban = lgm=$( \
|
||||
msg=$(printf '%%.1000s\n...' "<matches>"); \
|
||||
[ -n "<keywords_to_remove>" ] && \
|
||||
msg=$(echo "$msg" | sed -E "s/\b(<keywoards_to_remove>)\b/REDACTED/gI"); \
|
||||
echo "$msg" ); \
|
||||
curl -sSf "https://api.abuseipdb.com/api/v2/report" \
|
||||
-H "Accept: application/json" \
|
||||
-H "Key: <abuseipdb_apikey>" \
|
||||
--data-urlencode "comment=$lgm" \
|
||||
--data-urlencode "ip=<ip>" \
|
||||
--data "categories=<abuseipdb_category>"
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
|
|
@ -102,3 +110,10 @@ actionunban =
|
|||
# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
|
||||
# You will need to set the category in the action call.
|
||||
abuseipdb_apikey =
|
||||
|
||||
# Add the ability to modify the comment on the fly
|
||||
# and remove certain keywords from the report, such as your hostname, IP, etc.
|
||||
#
|
||||
# Format: keyword1|keyword2
|
||||
# Case-insensitive
|
||||
keywords_to_remove =
|
||||
|
|
|
|||
Loading…
Reference in a new issue