diff --git a/config/action.d/abuseipdb.conf b/config/action.d/abuseipdb.conf index 3bcfb065..15e41fbe 100644 --- a/config/action.d/abuseipdb.conf +++ b/config/action.d/abuseipdb.conf @@ -3,6 +3,9 @@ # Action to report IP address to abuseipdb.com # You must sign up to obtain an API key from abuseipdb.com. # +# NOTE: These reports may include sensitive Info. +# If you want cleaner reports that ensure no user data see the helper script at the below website. +# # IMPORTANT: # # Reporting an IP of abuse is a serious complaint. Make sure that it is @@ -13,6 +16,15 @@ # password incorrectly. # * For filters that have a low likelihood of receiving human errors # +# This action relies on a api_key being added to the above action conf, +# and the appropriate categories set. +# +# Example, for ssh bruteforce (in section [sshd] of `jail.local`): +# action = %(known/action)s +# %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"] +# +# See below for catagories. +# # Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban # Added to fail2ban by Andrew James Collett (ajcollett)