JoshS/UFW-AbuseIPDB-Reporter
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add SERVER_IDENTIFIER

Browse source
This commit is contained in:
Sefinek 2024-12-19 15:40:28 +01:00
parent d2d3f27b2c
commit ce1b231dc8
2 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
default.config.js
View file

@ -1,15 +1,19 @@
exports.MAIN = { exports.MAIN = {
// Server
LOG_FILE: '/var/log/ufw.log', LOG_FILE: '/var/log/ufw.log',
CACHE_FILE: '/tmp/ufw-abuseipdb-reporter.cache', CACHE_FILE: '/tmp/ufw-abuseipdb-reporter.cache',
SERVER_IDENTIFIER: null,
// Reporting
ABUSEIPDB_API_KEY: '', ABUSEIPDB_API_KEY: '',
GITHUB_REPO: 'https://github.com/sefinek/UFW-AbuseIPDB-Reporter',
REPORT_INTERVAL: 12 * 60 * 60 * 1000, // 12h REPORT_INTERVAL: 12 * 60 * 60 * 1000, // 12h
// Project
GITHUB_REPO: 'https://github.com/sefinek/UFW-AbuseIPDB-Reporter',
}; };
exports.REPORT_COMMENT = (timestamp, srcIp, dstIp, proto, spt, dpt, ttl, len, tos) => { exports.REPORT_COMMENT = (timestamp, srcIp, dstIp, proto, spt, dpt, ttl, len, tos, serverName) => {
return `Blocked by UFW (${proto} on ${dpt}) return `Blocked by UFW ${serverName ? `on ${serverName} ` : ''}[${dpt}/${proto?.toLowerCase()}]
Source port: ${spt} Source port: ${spt}
TTL: ${ttl || 'N/A'} TTL: ${ttl || 'N/A'}
Packet length: ${len || 'N/A'} Packet length: ${len || 'N/A'}

6
index.js
View file

@ -6,7 +6,7 @@ const log = require('./utils/log.js');
const axios = require('./services/axios.js'); const axios = require('./services/axios.js');
const config = require('./config.js'); const config = require('./config.js');
const { version } = require('./package.json'); const { version } = require('./package.json');
const { LOG_FILE, ABUSEIPDB_API_KEY } = config.MAIN; const { LOG_FILE, ABUSEIPDB_API_KEY, SERVER_IDENTIFIER } = config.MAIN;
let fileOffset = 0; let fileOffset = 0;
@ -71,9 +71,9 @@ const processLogLine = async line => {
} }
const categories = config.DETERMINE_CATEGORIES(proto, dpt); const categories = config.DETERMINE_CATEGORIES(proto, dpt);
const comment = config.REPORT_COMMENT(match.timestamp, srcIp, match.dstIp, proto, match.spt, dpt, match.ttl, match.len, match.tos); const comment = config.REPORT_COMMENT(match.timestamp, srcIp, match.dstIp, proto, match.spt, dpt, match.ttl, match.len, match.tos, SERVER_IDENTIFIER);
log(0, `Reporting IP ${srcIp} (${proto} ${dpt}) with categories ${categories}`); log(0, `Reporting IP ${srcIp} (${proto} ${dpt}) with categories: ${categories}`);
if (await reportToAbuseIpDb(srcIp, categories, comment)) { if (await reportToAbuseIpDb(srcIp, categories, comment)) {
markIpAsReported(srcIp); markIpAsReported(srcIp);