diff --git a/README.md b/README.md index 95608ad..189bc64 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,17 @@ # šŸ›”ļø UFW AbuseIPDB Reporter -A utility designed to analyze UFW firewall logs and report malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database. -To prevent redundant reporting of the same IP address within a short period, the tool uses a temporary cache file to track previously reported IPs. +A utility designed to analyze UFW logs and report IP addresses blocked by the firewall to the [AbuseIPDB](https://www.abuseipdb.com) database. +To prevent excessive reporting of the same IP address within a short period, the tool uses a temporary cache file to track previously reported IP addresses. -This project was previously written in Bash, but it has been rewritten in [Node.js](https://nodejs.org). All my integration tools are currently written in Node, hence the change. -If you were using the old version, [uninstall it](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/tree/node.js?tab=readme-ov-file#%EF%B8%8F-remove-the-old-version) as it will no longer be supported. +This project was previously written in Bash but has been rewritten in [Node.js](https://nodejs.org). All my integration tools are now written in Node, hence this change. +If you were using the old version, please [uninstall it](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/tree/node.js?tab=readme-ov-file#%EF%B8%8F-remove-the-old-version) as it will no longer be supported. -If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot! -See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB) +If you like this repository or find it useful, I’d greatly appreciate it if you could give it a star ⭐. Many thanks! +Also, check this out: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB) -> [!IMPORTANT] -> If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork). +> [!IMPORTANT] +> - If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork). +> +> - According to AbuseIPDB's policy, UDP traffic should not be reported! ## šŸ“‹ Requirements @@ -18,6 +20,14 @@ See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/ 3. [Git](https://git-scm.com) +## āœ… Features +1. A `config.js` file enabling easy configuration. +2. A simple installer allowing quick integration deployment. +3. Integration with Discord Webhooks (coming soon): + - Alerts in case of script errors + - Daily summaries of reported IP addresses + + ## šŸ“„ Installation ### Automatic (Easy & recommenced) @@ -67,10 +77,10 @@ pm2 startup pm2 save ``` + ## šŸ—‘ļø Uninstall the deprecated version if you have it ```bash -sudo systemctl stop abuseipdb-ufw.service -sudo systemctl disable abuseipdb-ufw.service +sudo systemctl stop abuseipdb-ufw.service && sudo systemctl disable abuseipdb-ufw.service sudo rm /etc/systemd/system/abuseipdb-ufw.service sudo systemctl daemon-reload sudo rm -r /usr/local/bin/UFW-AbuseIPDB-Reporter @@ -92,7 +102,7 @@ pm2 logs ufw-abuseipdb ### šŸ“„ Example reports #### 1ļøāƒ£ ```text -Blocked by UFW on vserver1 [80/tcp] +Blocked by UFW on homeserver01 [80/tcp] Source port: 23639 TTL: 247 Packet length: 40 @@ -104,7 +114,7 @@ https://github.com/sefinek/UFW-AbuseIPDB-Reporter #### 2ļøāƒ£ ```text -Blocked by UFW on vserver1 [30049/tcp]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter +Blocked by UFW on homeserver01 [30049/tcp]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter ``` @@ -112,5 +122,5 @@ Blocked by UFW on vserver1 [30049/tcp]. Generated by: https://github.com/sefinek If you want to contribute to the development of this project, feel free to create a new [Pull request](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/pulls). I will definitely appreciate it! -## šŸ”‘ GPL-3.0 License -Copyright 2024 Ā© by [Sefinek](https://sefinek.net). All rights reserved. See the [LICENSE](LICENSE) file for more information. \ No newline at end of file +## šŸ”‘ [GPL-3.0 License](LICENSE) +Copyright 2024-2025 Ā© by [Sefinek](https://sefinek.net). All rights reserved. \ No newline at end of file diff --git a/default.config.js b/default.config.js index af73952..3baf9eb 100644 --- a/default.config.js +++ b/default.config.js @@ -2,7 +2,7 @@ exports.MAIN = { // Server UFW_FILE: '/var/log/ufw.log', CACHE_FILE: '/tmp/ufw-abuseipdb-reporter.cache', - SERVER_ID: null, // The server name that will be visible in the reports. If you don't want to define it, leave the value as null. + SERVER_ID: null, // The server name that will be visible in the reports (e.g. 'homeserver01'). If you don't want to define it, leave the value as null. // Reporting ABUSEIPDB_API_KEY: '', @@ -50,7 +50,7 @@ https://github.com/sefinek/UFW-AbuseIPDB-Reporter`; // Please do not remove this // Alternative version: // exports.REPORT_COMMENT = ({ timestamp, In, Out, srcIp, dstIp, res, tos, prec, ttl, id, proto, spt, dpt, len, urgp, mac, window, syn }, fullLog, serverName) => -// `Blocked by UFW ${serverName ? `on ${serverName} ` : ''}[${dpt}/${proto?.toLowerCase()}]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter`; // Please do not remove this URL; I would be very grateful! Thank you. šŸ’™ +// `Blocked by UFW ${serverName ? `on ${serverName} ` : ''}[${dpt}/${proto?.toLowerCase()}]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter`; // See: https://www.abuseipdb.com/categories