Small fixes
This commit is contained in:
parent
4f16dfda77
commit
edb5a9d8fe
2 changed files with 26 additions and 16 deletions
36
README.md
36
README.md
|
|
@ -1,15 +1,17 @@
|
||||||
# 🛡️ UFW AbuseIPDB Reporter
|
# 🛡️ UFW AbuseIPDB Reporter
|
||||||
A utility designed to analyze UFW firewall logs and report malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database.
|
A utility designed to analyze UFW logs and report IP addresses blocked by the firewall to the [AbuseIPDB](https://www.abuseipdb.com) database.
|
||||||
To prevent redundant reporting of the same IP address within a short period, the tool uses a temporary cache file to track previously reported IPs.
|
To prevent excessive reporting of the same IP address within a short period, the tool uses a temporary cache file to track previously reported IP addresses.
|
||||||
|
|
||||||
This project was previously written in Bash, but it has been rewritten in [Node.js](https://nodejs.org). All my integration tools are currently written in Node, hence the change.
|
This project was previously written in Bash but has been rewritten in [Node.js](https://nodejs.org). All my integration tools are now written in Node, hence this change.
|
||||||
If you were using the old version, [uninstall it](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/tree/node.js?tab=readme-ov-file#%EF%B8%8F-remove-the-old-version) as it will no longer be supported.
|
If you were using the old version, please [uninstall it](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/tree/node.js?tab=readme-ov-file#%EF%B8%8F-remove-the-old-version) as it will no longer be supported.
|
||||||
|
|
||||||
If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!
|
If you like this repository or find it useful, I’d greatly appreciate it if you could give it a star ⭐. Many thanks!
|
||||||
See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB)
|
Also, check this out: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB)
|
||||||
|
|
||||||
> [!IMPORTANT]
|
> [!IMPORTANT]
|
||||||
> If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork).
|
> - If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork).
|
||||||
|
>
|
||||||
|
> - According to AbuseIPDB's policy, UDP traffic should not be reported!
|
||||||
|
|
||||||
|
|
||||||
## 📋 Requirements
|
## 📋 Requirements
|
||||||
|
|
@ -18,6 +20,14 @@ See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/
|
||||||
3. [Git](https://git-scm.com)
|
3. [Git](https://git-scm.com)
|
||||||
|
|
||||||
|
|
||||||
|
## ✅ Features
|
||||||
|
1. A `config.js` file enabling easy configuration.
|
||||||
|
2. A simple installer allowing quick integration deployment.
|
||||||
|
3. Integration with Discord Webhooks (coming soon):
|
||||||
|
- Alerts in case of script errors
|
||||||
|
- Daily summaries of reported IP addresses
|
||||||
|
|
||||||
|
|
||||||
## 📥 Installation
|
## 📥 Installation
|
||||||
|
|
||||||
### Automatic (Easy & recommenced)
|
### Automatic (Easy & recommenced)
|
||||||
|
|
@ -67,10 +77,10 @@ pm2 startup
|
||||||
pm2 save
|
pm2 save
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## 🗑️ Uninstall the deprecated version if you have it
|
## 🗑️ Uninstall the deprecated version if you have it
|
||||||
```bash
|
```bash
|
||||||
sudo systemctl stop abuseipdb-ufw.service
|
sudo systemctl stop abuseipdb-ufw.service && sudo systemctl disable abuseipdb-ufw.service
|
||||||
sudo systemctl disable abuseipdb-ufw.service
|
|
||||||
sudo rm /etc/systemd/system/abuseipdb-ufw.service
|
sudo rm /etc/systemd/system/abuseipdb-ufw.service
|
||||||
sudo systemctl daemon-reload
|
sudo systemctl daemon-reload
|
||||||
sudo rm -r /usr/local/bin/UFW-AbuseIPDB-Reporter
|
sudo rm -r /usr/local/bin/UFW-AbuseIPDB-Reporter
|
||||||
|
|
@ -92,7 +102,7 @@ pm2 logs ufw-abuseipdb
|
||||||
### 📄 Example reports
|
### 📄 Example reports
|
||||||
#### 1️⃣
|
#### 1️⃣
|
||||||
```text
|
```text
|
||||||
Blocked by UFW on vserver1 [80/tcp]
|
Blocked by UFW on homeserver01 [80/tcp]
|
||||||
Source port: 23639
|
Source port: 23639
|
||||||
TTL: 247
|
TTL: 247
|
||||||
Packet length: 40
|
Packet length: 40
|
||||||
|
|
@ -104,7 +114,7 @@ https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
||||||
|
|
||||||
#### 2️⃣
|
#### 2️⃣
|
||||||
```text
|
```text
|
||||||
Blocked by UFW on vserver1 [30049/tcp]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
Blocked by UFW on homeserver01 [30049/tcp]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -112,5 +122,5 @@ Blocked by UFW on vserver1 [30049/tcp]. Generated by: https://github.com/sefinek
|
||||||
If you want to contribute to the development of this project, feel free to create a new [Pull request](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/pulls). I will definitely appreciate it!
|
If you want to contribute to the development of this project, feel free to create a new [Pull request](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/pulls). I will definitely appreciate it!
|
||||||
|
|
||||||
|
|
||||||
## 🔑 GPL-3.0 License
|
## 🔑 [GPL-3.0 License](LICENSE)
|
||||||
Copyright 2024 © by [Sefinek](https://sefinek.net). All rights reserved. See the [LICENSE](LICENSE) file for more information.
|
Copyright 2024-2025 © by [Sefinek](https://sefinek.net). All rights reserved.
|
||||||
|
|
@ -2,7 +2,7 @@ exports.MAIN = {
|
||||||
// Server
|
// Server
|
||||||
UFW_FILE: '/var/log/ufw.log',
|
UFW_FILE: '/var/log/ufw.log',
|
||||||
CACHE_FILE: '/tmp/ufw-abuseipdb-reporter.cache',
|
CACHE_FILE: '/tmp/ufw-abuseipdb-reporter.cache',
|
||||||
SERVER_ID: null, // The server name that will be visible in the reports. If you don't want to define it, leave the value as null.
|
SERVER_ID: null, // The server name that will be visible in the reports (e.g. 'homeserver01'). If you don't want to define it, leave the value as null.
|
||||||
|
|
||||||
// Reporting
|
// Reporting
|
||||||
ABUSEIPDB_API_KEY: '',
|
ABUSEIPDB_API_KEY: '',
|
||||||
|
|
@ -50,7 +50,7 @@ https://github.com/sefinek/UFW-AbuseIPDB-Reporter`; // Please do not remove this
|
||||||
|
|
||||||
// Alternative version:
|
// Alternative version:
|
||||||
// exports.REPORT_COMMENT = ({ timestamp, In, Out, srcIp, dstIp, res, tos, prec, ttl, id, proto, spt, dpt, len, urgp, mac, window, syn }, fullLog, serverName) =>
|
// exports.REPORT_COMMENT = ({ timestamp, In, Out, srcIp, dstIp, res, tos, prec, ttl, id, proto, spt, dpt, len, urgp, mac, window, syn }, fullLog, serverName) =>
|
||||||
// `Blocked by UFW ${serverName ? `on ${serverName} ` : ''}[${dpt}/${proto?.toLowerCase()}]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter`; // Please do not remove this URL; I would be very grateful! Thank you. 💙
|
// `Blocked by UFW ${serverName ? `on ${serverName} ` : ''}[${dpt}/${proto?.toLowerCase()}]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter`;
|
||||||
|
|
||||||
|
|
||||||
// See: https://www.abuseipdb.com/categories
|
// See: https://www.abuseipdb.com/categories
|
||||||
|
|
|
||||||
Loading…
Add table
Reference in a new issue