diff --git a/ChangeLog b/ChangeLog index a87cc00f..5e96517b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -79,7 +79,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition several log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd" (gh-3782) - `ddos` and `aggressive` modes: regex extended for timeout before authentication (optional connection from part, gh-3907) * `filter.d/vsftpd.conf` - fixed regex (if failures generated by systemd-journal, gh-3954) -* `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075). +* `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075). ### New Features and Enhancements * backend `systemd` extended with new parameter `rotated` (default `false`, as prevention against "too many open files"), @@ -123,7 +123,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979) * `filter.d/xrdp.conf` - new filter for XRDP, an open source RDP server (gh-3254) * `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001) - +* `abuseipdb` - introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information. Set `keywords_to_remove` to `keyword1|keywod2| some text`. Case insensitive ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km ----------- diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index d0d4a99b..c673f9fe 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -75,17 +75,26 @@ actioncheck = # # By default, this posts directly to AbuseIPDB's API, unfortunately # this results in a lot of backslashes/escapes appearing in the -# reports. This also may include info like your hostname. +# reports. This also may include info like your hostname (please refer to +# ). # If you have your own web server with PHP available, you can # use my (Shaun's) helper PHP script by commenting out the first #actionban # line below, uncommenting the second one, and pointing the URL at -# wherever you install the helper script. For the PHP helper script, see -# -# # Tags: See jail.conf(5) man page # Values: CMD # -actionban = lgm=$(printf '%%.1000s\n...' ""); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: " --data-urlencode "comment=$lgm" --data-urlencode "ip=" --data "categories=" +actionban = lgm=$( + msg="" ;\ + [ -n "" ] && \ + msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI") ;\ + msg=$(printf '%%.1020s\n...' "$msg") ;\ + echo "$msg" ) ;\ + curl -sSf "https://api.abuseipdb.com/api/v2/report" \ + -H "Accept: application/json" \ + -H "Key: " \ + --data-urlencode "comment=$lgm" \ + --data-urlencode "ip=" \ + --data "categories=" # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -102,3 +111,10 @@ actionunban = # Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. # You will need to set the category in the action call. abuseipdb_apikey = + +# Add the ability to modify the comment on the fly +# and remove certain keywords from the report, such as your hostname, IP, etc. +# +# Format: keyword1|keyword2 +# Case-insensitive +keywords_to_remove =