Update README

This commit is contained in:
Sefinek committed 2024-11-19 05:00:58 +01:00
1 parent 2a2629cd3a
commit ba4c2b6161
2 files changed
+17 -49

No files matched your search

+9 -22
View File
@@ -4,22 +4,16 @@
</div>
# 🛡️ UFW AbuseIPDB Reporter
A tool that analyzes UFW firewall logs and reports malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database.
If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!
A utility designed to analyze UFW firewall logs and report malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database.
To prevent redundant reporting of the same IP address within a short period, the tool uses a temporary cache file to track previously reported IPs.
If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!
See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB)
> [!IMPORTANT]
> If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork).
## ⚙️ How does it work in detail?
1. **Monitoring UFW logs:** The tool continuously monitors logs generated by the UFW firewall, looking for unauthorized access attempts or other suspicious activities.
2. **Analyzing the reported address:** After identifying a suspicious IP address, the script checks if the address has already been reported.
3. **Reporting IP to AbuseIPDB:** If the IP meets the criteria, the address is reported to the AbuseIPDB database with information about the protocol, source port, destination port, etc.
4. **Cache of reported IPs:** The tool stores a list of reported IPs in a temporary file to prevent multiple reports of the same IP address in a short period.
## 📋 Requirements
- **Operating System:** Linux with UFW firewall installed and configured.
- **AbuseIPDB Account:** An account on the AbuseIPDB service [with a valid API token](https://www.abuseipdb.com/account/api). The API token is required.
@@ -36,25 +30,18 @@ See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/
If the distribution you're using to run the tool isn't listed here and the script works correctly, please create a new [Issue](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/issues). I'll add its name to the list.
## 📥 How to install?
### 🌍 Perform repository and software updates (highly recommended)
## 📥 Installation
### curl
```bash
sudo apt update && sudo apt upgrade -y
curl -sL https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh | bash
```
### 🌌 Install required dependencies
### wget
```bash
sudo apt install -y ufw curl jq openssl
wget -qO- https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh | bash
```
### ✅ Installation
To install this tool, run the following command in the terminal (`sudo` is required):
```bash
sudo bash -c "$(curl -s https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh)"
```
The installation script will automatically download and configure the tool on your server. During installation, you will be asked to provide an [AbuseIPDB API token](https://www.abuseipdb.com/account/api).
The installation script will automatically download and configure the tool on your machine. During the installation process, you will be prompted to provide an [AbuseIPDB API token](https://www.abuseipdb.com/account/api).
## 🖥️ Usage