From 31f4ea59cb86fb91221778902b7e6776c53553f5 Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Thu, 13 Feb 2014 22:00:33 +0000 Subject: [PATCH 1/2] BF: Use abusix Abuse Contact DB to get more accurate abuse addresses Taken from xarf-login-attack action from 0.9 branch by Daniel Black --- config/action.d/complain.conf | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf index 62331f19..a85c21ec 100644 --- a/config/action.d/complain.conf +++ b/config/action.d/complain.conf @@ -1,17 +1,16 @@ # Fail2Ban configuration file # -# Author: Russell Odom +# Author: Russell Odom , Daniel Black # Sends a complaint e-mail to addresses listed in the whois record for an # offending IP address. +# This uses the https://abusix.com/contactdb.html to lookup abuse contacts. +# +# DEPENDANCIES: +# This requires the dig command from bind-utils # # You should provide the in the jail config - lines from the log # matching the given IP address will be provided in the complaint as evidence. # -# Note that we will try to use e-mail addresses that are most likely to be abuse -# addresses (based on various keywords). If they aren't found we fall back on -# any other addresses found in the whois record, with a few exceptions. -# If no addresses are found, no e-mail is sent. -# # WARNING # ------- # @@ -55,7 +54,7 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = ADDRESSES=`whois | perl -e 'while () { next if /^changed|@(ripe|apnic)\.net/io; $m += (/abuse|trouble:|report|spam|security/io?3:0); if (/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)/io) { while (s/([a-z0-9_\-\.+]+@[a-z0-9\-]+(\.[[a-z0-9\-]+)+)//io) { if ($m) { $a{lc($1)}=$m } else { $b{lc($1)}=$m } } $m=0 } else { $m && --$m } } if (%%a) {print join(",",keys(%%a))} else {print join(",",keys(%%b))}'` +actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP} ;ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} IP= if [ ! -z "$ADDRESSES" ]; then (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])([^0-9]|$)' ) | "Abuse from " $ADDRESSES @@ -70,7 +69,7 @@ actionban = ADDRESSES=`whois | perl -e 'while () { next if /^changed actionunban = [Init] -message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a whois lookup is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process. This mail was generated by Fail2Ban.)\n +message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n # Path to the log files which contain relevant lines for the abuser IP # From 997729e274407863415aa3b7b24d878fbf410c96 Mon Sep 17 00:00:00 2001 From: Steven Hiscocks Date: Tue, 18 Feb 2014 15:05:06 +0000 Subject: [PATCH 2/2] BF: Fix complain action for multiple recipients and misplaced ";" --- config/action.d/complain.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/action.d/complain.conf b/config/action.d/complain.conf index a85c21ec..c0175831 100644 --- a/config/action.d/complain.conf +++ b/config/action.d/complain.conf @@ -54,10 +54,10 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP} ;ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} +actionban = oifs=${IFS}; IFS=.;SEP_IP=( ); set -- ${SEP_IP}; ADDRESSES=$(dig +short -t txt -q $4.$3.$2.$1.abuse-contacts.abusix.org); IFS=${oifs} IP= if [ ! -z "$ADDRESSES" ]; then - (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])([^0-9]|$)' ) | "Abuse from " $ADDRESSES + (printf %%b "\n"; date '+Note: Local timezone is %%z (%%Z)'; grep -E '(^|[^0-9])([^0-9]|$)' ) | "Abuse from " ${ADDRESSES//,/\" \"} fi # Option: actionunban