Update README.md

This commit is contained in:
Sefinek committed 2024-10-31 02:47:25 +01:00
1 parent 9c2f8f0a40
commit bc0289ffdd
2 files changed
+26 -52

No files matched your search

+13 -26
View File
@@ -7,33 +7,20 @@
A tool that analyzes UFW firewall logs and reports malicious IP addresses to the [AbuseIPDB](https://www.abuseipdb.com) database.
If you like this repository or find it useful, I would greatly appreciate it if you could give it a star ⭐. Thanks a lot!
See also this: [sefinek24/Node-Cloudflare-WAF-AbuseIPDB](https://github.com/sefinek24/Node-Cloudflare-WAF-AbuseIPDB)
> [!IMPORTANT]
> If you'd like to make changes to any files in this repository, please start by creating a [public fork](https://github.com/sefinek/UFW-AbuseIPDB-Reporter/fork).
- [⚙️ How does it work in detail?](#how-it-works)
- [📋 Requirements](#requirements)
- [🛠️ Installing required packages](#installing-required-packages)
- [🌍 Perform repository and software updates](#perform-repository-and-software-updates)
- [🌌 Install required dependencies](#install-required-dependencies)
- [🧪 Tested operating systems](#tested-operating-systems)
- [📥 Installation](#installation)
- [🖥️ Usage](#usage)
- [🔍 Checking service status](#checking-service-status)
- [📄 Example report](#example-report)
- [🤝 Development](#development)
- [🔑 MIT License](#license)
See also this: [sefinek24/Node-Cloudflare-WAF-AbuseIPDB](https://github.com/sefinek24/Node-Cloudflare-WAF-AbuseIPDB)
## ⚙️ How does it work in detail?<div id="how-it-works"></div>
## ⚙️ How does it work in detail?
1. **Monitoring UFW logs:** The tool continuously monitors logs generated by the UFW firewall, looking for unauthorized access attempts or other suspicious activities.
2. **Analyzing the reported address:** After identifying a suspicious IP address, the script checks if the address has already been reported.
3. **Reporting IP to AbuseIPDB:** If the IP meets the criteria, the address is reported to the AbuseIPDB database with information about the protocol, source port, destination port, etc.
4. **Cache of reported IPs:** The tool stores a list of reported IPs in a temporary file to prevent multiple reports of the same IP address in a short period.
## 📋 Requirements<div id="requirements"></div>
## 📋 Requirements
- **Operating System:** Linux with UFW firewall installed and configured.
- **AbuseIPDB Account:** An account on the AbuseIPDB service [with a valid API token](https://www.abuseipdb.com/account/api). The API token is required.
- **Installed packages:**
@@ -43,20 +30,20 @@ See also this: [sefinek24/Node-Cloudflare-WAF-AbuseIPDB](https://github.com/sefi
- `tail`, `awk`, `grep`, `sed`: Standard Unix tools used for text processing and log analysis.
## 🧪 Tested operating systems<div id="tested-operating-systems"></div>
## 🧪 Tested operating systems
- **Ubuntu Server:** 20.04 & 22.04
If the distribution you're using to run the tool isn't listed here and the script works correctly, please create a new [Issue](https://github.com/sefinek24/UFW-AbuseIPDB-Reporter/issues). I'll add its name to the list.
## 📥 How to install?<div id="installation"></div>
## 📥 How to install?
### 🌍 Perform repository and software updates (highly recommended)<div id="perform-repository-and-software-updates"></div>
### 🌍 Perform repository and software updates (highly recommended)
```bash
sudo apt update && sudo apt upgrade -y
```
### 🌌 Install required dependencies<div id="install-required-dependencies"></div>
### 🌌 Install required dependencies
```bash
sudo apt install -y ufw curl jq openssl
```
@@ -70,14 +57,14 @@ sudo bash -c "$(curl -s https://raw.githubusercontent.com/sefinek24/UFW-AbuseIPD
The installation script will automatically download and configure the tool on your server. During installation, you will be asked to provide an [AbuseIPDB API token](https://www.abuseipdb.com/account/api).
## 🖥️ Usage<div id="usage"></div>
## 🖥️ Usage
After successful installation, the script will run continuously in the background, monitoring UFW logs and automatically reporting malicious IP addresses.
The tool requires no additional user action after installation. However, it's worth occasionally checking its operation and updating the script regularly (by running the installation command).
Servers open to the world are constantly scanned by bots, usually looking for vulnerabilities or other security gaps.
So don't be surprised if the next day, the number of reports to AbuseIPDB exceeds a thousand.
### 🔍 Checking service status<div id="checking-service-status"></div>
### 🔍 Checking service status
If the tool was installed as a system service, you can check its status using the following command:
```bash
sudo systemctl status abuseipdb-ufw.service
@@ -88,7 +75,7 @@ To see the current logs generated by the process, use the command:
journalctl -u abuseipdb-ufw.service -f
```
### 📄 Example report<div id="example-report"></div>
### 📄 Example report
```
Blocked by UFW (TCP on port 80).
Source port: 28586
@@ -101,8 +88,8 @@ https://github.com/sefinek24/UFW-AbuseIPDB-Reporter
```
## 🤝 Development<div id="development"></div>
## 🤝 Development
If you want to contribute to the development of this project, feel free to create a new [Pull request](https://github.com/sefinek24/UFW-AbuseIPDB-Reporter/pulls). I will definitely appreciate it!
## 🔑 GPL-3.0 License<div id="license"></div>
## 🔑 GPL-3.0 License
Copyright 2024 © by [Sefinek](https://sefinek.net). All rights reserved. See the [LICENSE](LICENSE) file for more information.