Update README
This commit is contained in:
1 parent
2a2629cd3a
commit
ba4c2b6161
2 files changed
+17
-49
No files matched your search
@@ -4,22 +4,16 @@
|
||||
</div>
|
||||
|
||||
# 🛡️ UFW AbuseIPDB Reporter
|
||||
A tool that analyzes UFW firewall logs and reports malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database.
|
||||
If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!
|
||||
A utility designed to analyze UFW firewall logs and report malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database.
|
||||
To prevent redundant reporting of the same IP address within a short period, the tool uses a temporary cache file to track previously reported IPs.
|
||||
|
||||
If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!
|
||||
See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork).
|
||||
|
||||
|
||||
## ⚙️ How does it work in detail?
|
||||
1. **Monitoring UFW logs:** The tool continuously monitors logs generated by the UFW firewall, looking for unauthorized access attempts or other suspicious activities.
|
||||
2. **Analyzing the reported address:** After identifying a suspicious IP address, the script checks if the address has already been reported.
|
||||
3. **Reporting IP to AbuseIPDB:** If the IP meets the criteria, the address is reported to the AbuseIPDB database with information about the protocol, source port, destination port, etc.
|
||||
4. **Cache of reported IPs:** The tool stores a list of reported IPs in a temporary file to prevent multiple reports of the same IP address in a short period.
|
||||
|
||||
|
||||
## 📋 Requirements
|
||||
- **Operating System:** Linux with UFW firewall installed and configured.
|
||||
- **AbuseIPDB Account:** An account on the AbuseIPDB service [with a valid API token](https://www.abuseipdb.com/account/api). The API token is required.
|
||||
@@ -36,25 +30,18 @@ See also this: [sefinek/Cloudflare-WAF-To-AbuseIPDB](https://github.com/sefinek/
|
||||
If the distribution you're using to run the tool isn't listed here and the script works correctly, please create a new [Issue](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/issues). I'll add its name to the list.
|
||||
|
||||
|
||||
## 📥 How to install?
|
||||
|
||||
### 🌍 Perform repository and software updates (highly recommended)
|
||||
## 📥 Installation
|
||||
### curl
|
||||
```bash
|
||||
sudo apt update && sudo apt upgrade -y
|
||||
curl -sL https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh | bash
|
||||
```
|
||||
|
||||
### 🌌 Install required dependencies
|
||||
### wget
|
||||
```bash
|
||||
sudo apt install -y ufw curl jq openssl
|
||||
wget -qO- https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh | bash
|
||||
```
|
||||
|
||||
### ✅ Installation
|
||||
To install this tool, run the following command in the terminal (`sudo` is required):
|
||||
```bash
|
||||
sudo bash -c "$(curl -s https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh)"
|
||||
```
|
||||
|
||||
The installation script will automatically download and configure the tool on your server. During installation, you will be asked to provide an [AbuseIPDB API token](https://www.abuseipdb.com/account/api).
|
||||
The installation script will automatically download and configure the tool on your machine. During the installation process, you will be prompted to provide an [AbuseIPDB API token](https://www.abuseipdb.com/account/api).
|
||||
|
||||
|
||||
## 🖥️ Usage
|
||||
|
||||
Reference in new issue
Block a user