Merge a64ec106ac into 8be17b0981

ChangeLog

@@ -79,7 +79,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
     several log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd" (gh-3782)
   - `ddos` and `aggressive` modes: regex extended for timeout before authentication (optional connection from part, gh-3907)
 * `filter.d/vsftpd.conf` - fixed regex (if failures generated by systemd-journal, gh-3954)
-* `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075).	
+* `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075).
 
 ### New Features and Enhancements
 * backend `systemd` extended with new parameter `rotated` (default `false`, as prevention against "too many open files"),
@@ -123,7 +123,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition
 * `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979)
 * `filter.d/xrdp.conf` - new filter for XRDP, an open source RDP server (gh-3254)
 * `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001)
-
+* `abuseipdb` - introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information. Set `keywords_to_remove` to `keyword1|keywod2| some text`. Case insensitive
 
 ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km
 -----------

config/action.d/abuseipdb.conf

@@ -75,17 +75,26 @@ actioncheck =
 #
 #          By default, this posts directly to AbuseIPDB's API, unfortunately
 #          this results in a lot of backslashes/escapes appearing in the
-#          reports. This also may include info like your hostname.
+#          reports. This also may include info like your hostname (please refer to
+#          <keywords_to_remove>).
 #          If you have your own web server with PHP available, you can
 #          use my (Shaun's) helper PHP script by commenting out the first #actionban
 #          line below, uncommenting the second one, and pointing the URL at
-#          wherever you install the helper script. For the PHP helper script, see
-#          <https://github.com/parseword/fail2ban-abuseipdb/>
-#
 # Tags:    See jail.conf(5) man page
 # Values:  CMD
 #
-actionban = lgm=$(printf '%%.1000s\n...' "<matches>"); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: <abuseipdb_apikey>" --data-urlencode "comment=$lgm" --data-urlencode "ip=<ip>" --data "categories=<abuseipdb_category>"
+actionban = lgm=$(
+              msg="<matches>" ;\
+              [ -n "<keywords_to_remove>" ] && \
+              msg=$(echo "$msg" | sed -E "s/\b(<keywords_to_remove>)\b/REDACTED/gI") ;\
+              msg=$(printf '%%.1020s\n...' "$msg") ;\
+              echo "$msg" ) ;\
+            curl -sSf "https://api.abuseipdb.com/api/v2/report" \
+              -H "Accept: application/json" \
+              -H "Key: <abuseipdb_apikey>" \
+              --data-urlencode "comment=$lgm" \
+              --data-urlencode "ip=<ip>" \
+              --data "categories=<abuseipdb_category>"
 
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
@@ -102,3 +111,10 @@ actionunban =
 # Register for abuseipdb [https://www.abuseipdb.com], get api key and set below.
 # You will need to set the category in the action call.
 abuseipdb_apikey =
+
+# Add the ability to modify the comment on the fly
+# and remove certain keywords from the report, such as your hostname, IP, etc.
+#
+# Format: keyword1|keyword2
+# Case-insensitive
+keywords_to_remove =