Add attributions and Add Optional Port Ignore
This commit is contained in:
Kyle Speight committed
1 parent
6e3e9f1193
commit
58340d090b
4 files changed
+38
-99
No files matched your search
@@ -1,3 +0,0 @@
|
||||
[submodule "scripts"]
|
||||
path = scripts
|
||||
url = https://github.com/sefinek/IPDB-Integration-Scripts
|
||||
@@ -1,107 +1,27 @@
|
||||
# 🛡️ UFW AbuseIPDB Reporter
|
||||
[](https://github.com/sefinek/UFW-AbuseIPDB-Reporter)
|
||||
[](https://www.gnu.org/licenses/gpl-3.0)
|
||||
[](https://github.com/2SharkyStudios/UFW-AbuseIPDB-Reporter)
|
||||
[](https://www.gnu.org/licenses/gpl-3.0)
|
||||
[](https://nodejs.org)
|
||||
[](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/commits)
|
||||
[](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/stargazers)
|
||||
[](https://github.com/2SharkyStudios/UFW-AbuseIPDB-Reporter/commits)
|
||||
[](https://github.com/2SharkyStudios/UFW-AbuseIPDB-Reporter/stargazers)
|
||||
|
||||
An integration tool designed to analyze UFW logs and report IP addresses blocked by the firewall to the [AbuseIPDB](https://www.abuseipdb.com) database.
|
||||
To prevent excessive reporting of the same IP address within a short time period, the tool uses a temporary cache file to track previously reported IP addresses.
|
||||
|
||||
⭐ If you like this repository or find it useful, I'd greatly appreciate it if you could give it a star. Many thanks!
|
||||
Also, check this out: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB)
|
||||
## Changes
|
||||
|
||||
> [!IMPORTANT]
|
||||
> - If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork).
|
||||
> - If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/2SharkyStudios/UFW-AbuseIPDB-Reporter/fork).
|
||||
> - According to AbuseIPDB's policy, [UDP traffic should not be reported](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/discussions/2)!
|
||||
|
||||
|
||||
## 📋 Requirements
|
||||
- [Node.js + npm](https://gist.github.com/sefinek/fb50041a5f456321d58104bbf3f6e649)
|
||||
- [PM2](https://www.npmjs.com/package/pm2) (`npm i -g pm2`)
|
||||
- [Git](https://gist.github.com/sefinek/1de50073ffbbae82fc901506304f0ada)
|
||||
- Linux (Ubuntu or Debian)
|
||||
|
||||
|
||||
## ✅ Features
|
||||
1. **Easy Configuration** – The [`config.js`](config.default.js) file allows for quick and simple configuration.
|
||||
2. **Simple Installer** – Enables fast and seamless integration deployment.
|
||||
3. **Self-IP Protection (IPv4 & IPv6)** – The script will never report IP addresses belonging to you or your server, even if you're using a dynamic IP address.
|
||||
4. **IP Filtering** – Local and special-purpose IP addresses will never be reported.
|
||||
5. **IP Whitelist** – Maintain a `whitelist.txt` file with IP addresses that should never be reported (e.g., your home IP when running on a VPS).
|
||||
6. **UDP Traffic Filtering** – UDP traffic is automatically skipped in accordance with [AbuseIPDB's policy](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/discussions/2).
|
||||
7. **Report Cooldown** – Prevents duplicate reports of the same IP within a configurable time window (default: 12 hours).
|
||||
8. **Bulk Reporting Support** – If the script encounters a rate limit, it will start buffering collected IPs and send a bulk report.
|
||||
9. **Discord Webhooks Integration**:
|
||||
- Critical notifications
|
||||
- Script error alerts
|
||||
- Daily summaries of reported IPs
|
||||
10. **Automatic Updates** – The script regularly fetches and applies the latest updates. You can disable this feature if you'd prefer.
|
||||
|
||||
|
||||
## 📥 Installation (Ubuntu & Debian)
|
||||
|
||||
### Automatic (easy & fast & recommended)
|
||||
#### Via curl
|
||||
```bash
|
||||
bash <(curl -fsS https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh)
|
||||
```
|
||||
|
||||
#### Via wget
|
||||
```bash
|
||||
bash <(wget -qO- https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh)
|
||||
```
|
||||
|
||||
### Manually
|
||||
#### Node.js installation
|
||||
See https://gist.github.com/sefinek/fb50041a5f456321d58104bbf3f6e649.
|
||||
|
||||
#### Git installation
|
||||
See https://gist.github.com/sefinek/1de50073ffbbae82fc901506304f0ada.
|
||||
|
||||
#### Commands
|
||||
```bash
|
||||
sudo apt update && sudo apt upgrade
|
||||
cd ~
|
||||
git clone --recurse-submodules https://github.com/sefinek/UFW-AbuseIPDB-Reporter.git ufw-abuseipdb
|
||||
cd ufw-abuseipdb
|
||||
npm install --omit=dev
|
||||
cp config.default.js config.js
|
||||
sudo chown syslog:"$USER" "$ufw_log_path"
|
||||
sudo chmod 640 "$ufw_log_path"
|
||||
npm install -g pm2@latest
|
||||
sudo mkdir -p /var/log/ufw-abuseipdb
|
||||
sudo chown -R "$USER":"$USER" /var/log/ufw-abuseipdb
|
||||
pm2 start
|
||||
eval "$(pm2 startup | grep sudo)"
|
||||
pm2 save
|
||||
```
|
||||
|
||||
|
||||
## 🖥️ Usage
|
||||
After a successful installation, the script will run continuously in the background, monitoring UFW logs and automatically reporting IP addresses.
|
||||
|
||||
Servers are constantly scanned by bots, usually looking for security vulnerabilities and similar weaknesses.
|
||||
So don't be surprised if the number of reports sent to AbuseIPDB exceeds a thousand the next day.
|
||||
|
||||
### 🔍 Check logs
|
||||
```bash
|
||||
pm2 logs ufw-abuseipdb
|
||||
```
|
||||
|
||||
### 📄 Example reports
|
||||
```text
|
||||
Blocked by UFW on NY01 [8096/tcp] | SPT: 52458 | TTL: 243 | LEN: 40 | TOS: 0x08 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
|
||||
```
|
||||
|
||||
```text
|
||||
Blocked by UFW on PL02 [64505/tcp] | SPT: 34017 | TTL: 43 | LEN: 44 | TOS: 0x00 • Reported by: github.com/sefinek/UFW-AbuseIPDB-Reporter
|
||||
```
|
||||
|
||||
# 📌 Attribution
|
||||
This project is a fork/derived work based on the original work by its creator **sefinek**. This repository keeps the original authorship/license notices and adds the necessary credit for the upstream project. <br>
|
||||
### [OG Repo](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/pulls) <br>
|
||||
Original Creator: @sefinek
|
||||
|
||||
## 🤝 Development
|
||||
If you want to contribute to the development of this project, feel free to create a new [Pull request](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/pulls). I will definitely appreciate it!
|
||||
|
||||
If you want to contribute to the development of this project, feel free to create a new [Pull request](https://github.com/2SharkyStudios/UFW-AbuseIPDB-Reporter/pulls). I will definitely not appreciate it!
|
||||
|
||||
## 🔑 [GPL-3.0 License](LICENSE)
|
||||
Copyright © 2024-2026 [Sefinek](https://sefinek.net)
|
||||
Copyright © 2026 [Terraforge LTD](https://terraforge.fun)
|
||||
@@ -13,7 +13,9 @@ const ABUSE_STATE = require('./scripts/services/state.js');
|
||||
const { refreshServerIPs, getServerIPs } = require('./scripts/services/ipFetcher.js');
|
||||
const { repoSlug, repoUrl } = require('./scripts/repo.js');
|
||||
const isSpecialPurposeIP = require('./scripts/isSpecialPurposeIP.js');
|
||||
const { initWhitelist, isWhitelisted } = require('./scripts/services/whitelist.js');
|
||||
// @chillcog Whitelist functions
|
||||
const { initWhitelist, isWhitelisted, isPortWhitelisted } = require('./scripts/services/whitelist.js');
|
||||
|
||||
const logger = require('./scripts/logger.js');
|
||||
const { UFW_LOG_FILE, SERVER_ID, EXTENDED_LOGS, AUTO_UPDATE_ENABLED, AUTO_UPDATE_SCHEDULE, DISCORD_WEBHOOK_ENABLED, DISCORD_WEBHOOK_URL, IGNORED_PORTS } = config.MAIN;
|
||||
|
||||
@@ -138,10 +140,18 @@ const processLogLine = async (line, test = false) => {
|
||||
return;
|
||||
}
|
||||
|
||||
if (Array.isArray(IGNORED_PORTS) && IGNORED_PORTS.includes(Number(dpt))) {
|
||||
// @chillcog Port whitelist (applies to all IPs)
|
||||
const dptNumber = Number(dpt);
|
||||
if (Number.isInteger(dptNumber) && isPortWhitelisted(dptNumber)) {
|
||||
if (EXTENDED_LOGS) logger.info(`Skipping whitelisted destination port: PROTO=${proto?.toLowerCase()} SRC=${srcIp} DPT=${dpt} ID=${data.id}`);
|
||||
return;
|
||||
}
|
||||
|
||||
if (Array.isArray(IGNORED_PORTS) && IGNORED_PORTS.includes(dptNumber)) {
|
||||
if (EXTENDED_LOGS) logger.info(`Skipping ignored port: PROTO=${proto?.toLowerCase()} SRC=${srcIp} DPT=${dpt} ID=${data.id}`);
|
||||
return;
|
||||
}
|
||||
// ;
|
||||
|
||||
if (test) return data;
|
||||
|
||||
|
||||
+14
-2
@@ -5,6 +5,11 @@
|
||||
# https://sefinek.net #
|
||||
##################################################################
|
||||
|
||||
##################################################################
|
||||
# Copyright 2026 (c) by Terraforge LTD All rights reserved. #
|
||||
# https://terraforge.fun #
|
||||
##################################################################
|
||||
|
||||
cat << "EOF"
|
||||
_ _ ___ ____ ____ ____
|
||||
/ \ | |__ _ _ ___ ___ |_ _| | _ \ | _ \ | __ )
|
||||
@@ -22,12 +27,15 @@ This installer will configure UFW-AbuseIPDB-Reporter, a tool that analyzes UFW l
|
||||
reports to AbuseIPDB the IP addresses that have violated firewall rules. Join my Discord
|
||||
server to stay updated on the latest changes and more: https://terraforge.fun/website/social/discord
|
||||
|
||||
📩 Author : Sefinek <postmaster@terraforge.fun> (https://terraforge.fun)
|
||||
📩 Author : Kyle Speight <postmaster@terraforge.fun> (https://terraforge.fun)
|
||||
🔵 Discord : https://terraforge.fun/website/social/discord
|
||||
😺 GitHub Issues : https://github.com/2SharkyStudios/UFW-AbuseIPDB-Reporter/issues
|
||||
😺 GitHub Issues : issues are not maintained in this repo, see below repo for issues
|
||||
😎 Original Repository : https://github.com/sefinek/UFW-AbuseIPDB-Reporter/issues
|
||||
📝 Attribution : Original creator https://github.com/sefinek/
|
||||
📦 Last update : 6.13.2026
|
||||
============================================================================================
|
||||
|
||||
|
||||
EOF
|
||||
|
||||
# Function to prompt for a Yes/no answer
|
||||
@@ -512,3 +520,7 @@ echo "⏱️ Report Cooldown : $cooldown_hours hours"
|
||||
echo "🔄 Auto-Updates : $auto_update_enabled"
|
||||
echo "💬 Discord Webhooks : $discord_enabled"
|
||||
echo "📂 Script Directory : $PWD"
|
||||
# @TheBombGamer
|
||||
echo "Thanks to sefinek for creating the original version of this tool, which I have since modified"
|
||||
echo "and extended with new features, improvements, and bug fixes. If you encounter any issues or"
|
||||
echo "have suggestions, please open an issue in my repository 2SharkyStudios/UFW-AbuseIPDB-Reporter not sefinek/UFW-AbuseIPDB-Reporter"
|
||||
Reference in new issue
Block a user