From 23c88386348be018fd2af7856514f0cfb01e1b03 Mon Sep 17 00:00:00 2001
From: Georgiy Sitnikov <GAS85@users.noreply.github.com>
Date: Tue, 21 Oct 2025 13:28:30 +0200
Subject: [PATCH] Add `keywoards_to_remove` in abuseipdb action.

- Add `keywoards_to_remove` in abuseipdb action. This is an easy way to filter your reports. All keywords will be replaced with a `REDACTED` placeholder.
- As `actionban` is getting long, spread it over new lines to increase readability.
Will solve #3428

Sorry for duplicate, removed repo too early.

Before submitting your PR, please review the following checklist:

- [ ] **CONSIDER adding a unit test** if your PR resolves an issue
- [X] **LIST ISSUES** this PR resolves or describe the approach in detail
- [X] **MAKE SURE** this PR doesn't break existing tests
- [X] **KEEP PR small** so it could be easily reviewed
- [X] **AVOID** making unnecessary stylistic changes in unrelated code
- [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines
      (and `# failJSON`) within `fail2ban/tests/files/logs/X` file
- [X] **PROVIDE ChangeLog** entry describing the pull request
```
Introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information
```
---
 config/action.d/abuseipdb.conf | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf
index d0d4a99b..0dec05ba 100644
--- a/config/action.d/abuseipdb.conf
+++ b/config/action.d/abuseipdb.conf
@@ -75,17 +75,25 @@ actioncheck =
 #
 #          By default, this posts directly to AbuseIPDB's API, unfortunately
 #          this results in a lot of backslashes/escapes appearing in the
-#          reports. This also may include info like your hostname.
+#          reports. This also may include info like your hostname (please refer to
+#          <keywoards_to_remove>).
 #          If you have your own web server with PHP available, you can
 #          use my (Shaun's) helper PHP script by commenting out the first #actionban
 #          line below, uncommenting the second one, and pointing the URL at
-#          wherever you install the helper script. For the PHP helper script, see
-#          <https://github.com/parseword/fail2ban-abuseipdb/>
-#
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
+actionban = lgm=$( \
+    msg=$(printf '%%.1000s\n...' "<matches>"); \
+    [ -n "<keywords_to_remove>" ] && \
+      msg=$(echo "$msg" | sed -E "s/\b(<keywoards_to_remove>)\b/REDACTED/gI"); \
+    echo "$msg" ); \
+  curl -sSf "https://api.abuseipdb.com/api/v2/report" \
+    -H "Accept: application/json" \
+    -H "Key: <abuseipdb_apikey>" \
+    --data-urlencode "comment=$lgm" \
+    --data-urlencode "ip=<ip>" \
+    --data "categories=<abuseipdb_category>"
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -102,3 +110,10 @@ actionunban =
 # Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
 # You will need to set the category in the action call.
 abuseipdb_apikey =
+
+# Add the ability to modify the comment on the fly
+# and remove certain keywords from the report, such as your hostname, IP, etc.
+#
+# Format: keyword1|keyword2
+# Case-insensitive
+keywords_to_remove =