From 23c88386348be018fd2af7856514f0cfb01e1b03 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Tue, 21 Oct 2025 13:28:30 +0200 Subject: [PATCH 1/7] Add `keywoards_to_remove` in abuseipdb action. - Add `keywoards_to_remove` in abuseipdb action. This is an easy way to filter your reports. All keywords will be replaced with a `REDACTED` placeholder. - As `actionban` is getting long, spread it over new lines to increase readability. Will solve #3428 Sorry for duplicate, removed repo too early. Before submitting your PR, please review the following checklist: - [ ] **CONSIDER adding a unit test** if your PR resolves an issue - [X] **LIST ISSUES** this PR resolves or describe the approach in detail - [X] **MAKE SURE** this PR doesn't break existing tests - [X] **KEEP PR small** so it could be easily reviewed - [X] **AVOID** making unnecessary stylistic changes in unrelated code - [ ] **ACCOMPANY** each new `failregex` for filter `X` with sample log lines (and `# failJSON`) within `fail2ban/tests/files/logs/X` file - [X] **PROVIDE ChangeLog** entry describing the pull request ``` Introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information ``` --- config/action.d/abuseipdb.conf | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index d0d4a99b..0dec05ba 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -75,17 +75,25 @@ actioncheck = # # By default, this posts directly to AbuseIPDB's API, unfortunately # this results in a lot of backslashes/escapes appearing in the -# reports. This also may include info like your hostname. +# reports. This also may include info like your hostname (please refer to +# ). # If you have your own web server with PHP available, you can # use my (Shaun's) helper PHP script by commenting out the first #actionban # line below, uncommenting the second one, and pointing the URL at -# wherever you install the helper script. For the PHP helper script, see -# -# # Tags: See jail.conf(5) man page # Values: CMD # -actionban = lgm=$(printf '%%.1000s\n...' ""); curl -sSf "https://api.abuseipdb.com/api/v2/report" -H "Accept: application/json" -H "Key: " --data-urlencode "comment=$lgm" --data-urlencode "ip=" --data "categories=" +actionban = lgm=$( \ + msg=$(printf '%%.1000s\n...' ""); \ + [ -n "" ] && \ + msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI"); \ + echo "$msg" ); \ + curl -sSf "https://api.abuseipdb.com/api/v2/report" \ + -H "Accept: application/json" \ + -H "Key: " \ + --data-urlencode "comment=$lgm" \ + --data-urlencode "ip=" \ + --data "categories=" # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the @@ -102,3 +110,10 @@ actionunban = # Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. # You will need to set the category in the action call. abuseipdb_apikey = + +# Add the ability to modify the comment on the fly +# and remove certain keywords from the report, such as your hostname, IP, etc. +# +# Format: keyword1|keyword2 +# Case-insensitive +keywords_to_remove = From 3f721eb019c91a42dc975845b8aa5a89cfc60159 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Wed, 22 Oct 2025 09:32:47 +0200 Subject: [PATCH 2/7] Refactor actionban command in abuseipdb.conf Move limit logic to the end, so that it will apply after keywords will be removed. --- config/action.d/abuseipdb.conf | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index 0dec05ba..aa70496d 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -83,17 +83,18 @@ actioncheck = # Tags: See jail.conf(5) man page # Values: CMD # -actionban = lgm=$( \ - msg=$(printf '%%.1000s\n...' ""); \ - [ -n "" ] && \ - msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI"); \ - echo "$msg" ); \ - curl -sSf "https://api.abuseipdb.com/api/v2/report" \ - -H "Accept: application/json" \ - -H "Key: " \ - --data-urlencode "comment=$lgm" \ - --data-urlencode "ip=" \ - --data "categories=" +actionban = lgm=$( + msg="" ;\ + [ -n "" ] && \ + msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI") ;\ + msg=$(printf '%%.1000s\n...' "$msg") ;\ + echo "$msg" ) ;\ + curl -sSf "https://api.abuseipdb.com/api/v2/report" \ + -H "Accept: application/json" \ + -H "Key: " \ + --data-urlencode "comment=$lgm" \ + --data-urlencode "ip=" \ + --data "categories=" # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the From af66ef879963142470c423d9285da14fca2ea0de Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Thu, 23 Oct 2025 11:27:58 +0200 Subject: [PATCH 3/7] Update froxlor-auth.conf and add keywords_to_remove option Updated regex in froxlor-auth.conf to match new logging format and modified logpath in jail.conf. Introduced keywords_to_remove option in abuseipdb action for improved reporting. --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index d6588117..9efe5bef 100644 --- a/ChangeLog +++ b/ChangeLog @@ -73,7 +73,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition several log messages will be tagged with as originating from a process named "sshd-session" rather than "sshd" (gh-3782) - `ddos` and `aggressive` modes: regex extended for timeout before authentication (optional connection from part, gh-3907) * `filter.d/vsftpd.conf` - fixed regex (if failures generated by systemd-journal, gh-3954) -* `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075). +* `filter.d/froxlor-auth.conf` - updated the regex to the new logging situation for froxlor and changed logpath in jail.conf (gh-4075). ### New Features and Enhancements * backend `systemd` extended with new parameter `rotated` (default `false`, as prevention against "too many open files"), @@ -114,7 +114,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `filter.d/sendmail-reject.conf` - also recognize "Domain of sender address ... does not resolve" (gh-4035) * `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979) * `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001) - +* `abuseipdb` - introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information. Set `keywords_to_remove` to `keyword1|keywod2| some text`. Case insensetive ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km ----------- From 93b01f0951f3f82460b582dcd9018376c0ebc996 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Mon, 27 Oct 2025 14:23:51 +0100 Subject: [PATCH 4/7] Fix typo in keywords removal regex --- config/action.d/abuseipdb.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index aa70496d..37efa1be 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -86,7 +86,7 @@ actioncheck = actionban = lgm=$( msg="" ;\ [ -n "" ] && \ - msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI") ;\ + msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI") ;\ msg=$(printf '%%.1000s\n...' "$msg") ;\ echo "$msg" ) ;\ curl -sSf "https://api.abuseipdb.com/api/v2/report" \ From 51516c7c8e9fa7c9484a6dff52a10f3a74b6ea41 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Wed, 5 Nov 2025 11:29:56 +0100 Subject: [PATCH 5/7] Apply suggestion from @GAS85 --- config/action.d/abuseipdb.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index 37efa1be..b9e82210 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -87,7 +87,7 @@ actionban = lgm=$( msg="" ;\ [ -n "" ] && \ msg=$(echo "$msg" | sed -E "s/\b()\b/REDACTED/gI") ;\ - msg=$(printf '%%.1000s\n...' "$msg") ;\ + msg=$(printf '%%.1020s\n...' "$msg") ;\ echo "$msg" ) ;\ curl -sSf "https://api.abuseipdb.com/api/v2/report" \ -H "Accept: application/json" \ From fb84cf36a0f0c3bbef472933621d2e5ff9cd4345 Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Wed, 5 Nov 2025 11:32:30 +0100 Subject: [PATCH 6/7] Apply suggestion from @GAS85 --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 9efe5bef..f8f5e593 100644 --- a/ChangeLog +++ b/ChangeLog @@ -114,7 +114,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `filter.d/sendmail-reject.conf` - also recognize "Domain of sender address ... does not resolve" (gh-4035) * `filter.d/vaultwarden.conf` - new filter and jail for Vaultwarden (gh-3979) * `fail2ban-regex` extended with new option `-i` or `--invert` to output not-matched lines by `-o` or `--out` (gh-4001) -* `abuseipdb` - introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information. Set `keywords_to_remove` to `keyword1|keywod2| some text`. Case insensetive +* `abuseipdb` - introduce `keywords_to_remove` option in `abuseipdb` action to improve reporting with filtering out important information. Set `keywords_to_remove` to `keyword1|keywod2| some text`. Case insensitive ver. 1.1.0 (2024/04/25) - object-found--norad-59479-cospar-2024-069a--altitude-36267km ----------- From a64ec106ac6204b3b065499b1ad8269ba22b924a Mon Sep 17 00:00:00 2001 From: Georgiy Sitnikov Date: Tue, 11 Nov 2025 14:42:37 +0100 Subject: [PATCH 7/7] Update config/action.d/abuseipdb.conf --- config/action.d/abuseipdb.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index b9e82210..c673f9fe 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -76,7 +76,7 @@ actioncheck = # By default, this posts directly to AbuseIPDB's API, unfortunately # this results in a lot of backslashes/escapes appearing in the # reports. This also may include info like your hostname (please refer to -# ). +# ). # If you have your own web server with PHP available, you can # use my (Shaun's) helper PHP script by commenting out the first #actionban # line below, uncommenting the second one, and pointing the URL at