Add keywoards_to_remove in abuseipdb action.

- Add `keywoards_to_remove` in abuseipdb action. This is an easy way to filter your reports. All keywords will be replaced with a `REDACTED` placeholder.
- As `actionban` is getting long, spread it over new lines to increase readability.
Will solve #3428

Sorry for duplicate, removed repo too early.

Before submitting your PR, please review the following checklist:

- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
- [X] **LIST ISSUES** this PR resolves or describe the approach in detail
- [X] **MAKE SURE** this PR doesn't break existing tests
- [X] **KEEP PR small** so it could be easily reviewed
- [X] **AVOID** making unnecessary stylistic changes in unrelated code
- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
      (and `# failJSON`) within `fail2ban/tests/files/logs/X` file
- [X] **PROVIDE ChangeLog** entry describing the pull request
```
Introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information
```
This commit is contained in:
Georgiy Sitnikov 2025-10-21 13:28:30 +02:00 committed by GitHub
parent 7bac839603
commit 23c8838634
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -75,17 +75,25 @@ actioncheck =
#
# By default, this posts directly to AbuseIPDB's API, unfortunately
# this results in a lot of backslashes/escapes appearing in the
# reports. This also may include info like your hostname.
# reports. This also may include info like your hostname (please refer to
# <keywoards_to_remove>).
# If you have your own web server with PHP available, you can
# use my (Shaun's) helper PHP script by commenting out the first #actionban
# line below, uncommenting the second one, and pointing the URL at
# wherever you install the helper script. For the PHP helper script, see
# <https://github.com/parseword/fail2ban-abuseipdb/>
#
# Tags: See jail.conf(5) man page
# Values: CMD
#
actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
actionban = lgm=$( \
msg=$(printf '%%.1000s\n...' "<matches>"); \
[ -n "<keywords_to_remove>" ] && \
msg=$(echo "$msg" | sed -E "s/\b(<keywoards_to_remove>)\b/REDACTED/gI"); \
echo "$msg" ); \
curl -sSf "https://api.abuseipdb.com/api/v2/report" \
-H "Accept: application/json" \
-H "Key: <abuseipdb_apikey>" \
--data-urlencode "comment=$lgm" \
--data-urlencode "ip=<ip>" \
--data "categories=<abuseipdb_category>"
# Option: actionunban
# Notes.: command executed when unbanning an IP. Take care that the
@ -102,3 +110,10 @@ actionunban =
# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
# You will need to set the category in the action call.
abuseipdb_apikey =
# Add the ability to modify the comment on the fly
# and remove certain keywords from the report, such as your hostname, IP, etc.
#
# Format: keyword1|keyword2
# Case-insensitive
keywords_to_remove =