67 lines
4.0 KiB
JavaScript
67 lines
4.0 KiB
JavaScript
exports.MAIN = {
|
|
/* --------------------------- Server --------------------------- */
|
|
SERVER_ID: null, // Server identifier (e.g., 'hp-terminal', 'pl-cluster', 'de1'). Use 'development' for testing only. 'production' has no effect. Use null to leave it unset.
|
|
EXTENDED_LOGS: false, // true to display additional details in the logs.
|
|
UFW_LOG_FILE: '/var/log/ufw.log',
|
|
CACHE_FILE: './tmp/ufw-abuseipdb-reporter.cache',
|
|
|
|
/* --------------------------- Network --------------------------- */
|
|
IP_ASSIGNMENT: 'dynamic', // 'static' for a fixed IP, 'dynamic' if it may change over time.
|
|
IP_REFRESH_SCHEDULE: '0 */6 * * *', // Cron schedule for checking the public IP assigned by your ISP. Used only with dynamic IPs to prevent accidental self-reporting. If IP_ASSIGNMENT is set to 'static', the script will check your IP only once.
|
|
IPv6_SUPPORT: true, // Set to true if the device has a globally routable IPv6 address assigned by the ISP.
|
|
|
|
/* --------------------------- Reports --------------------------- */
|
|
ABUSEIPDB_API_KEY: '', // https://www.abuseipdb.com/account/api
|
|
IP_REPORT_COOLDOWN: 12 * 60 * 60 * 1000, // Minimum time between reports of the same IP. Must be >= 15 minutes. Do not set too low values, as it would waste API quota due to daily rate limits.
|
|
IGNORED_PORTS: [], // Destination ports to never report. Useful when running a BitTorrent client on the same machine, as peers connecting to that port would otherwise be falsely reported as port scanners. Example: [12345, 51413]
|
|
|
|
/* --------------------------- Automatic Updates --------------------------- */
|
|
AUTO_UPDATE_ENABLED: false, // Set to true to enable automatic updates via "git pull", false to disable. This option is discouraged due to potential future incompatibilities. Enable it only if you actively monitor the server and want the latest version.
|
|
AUTO_UPDATE_SCHEDULE: '0 14,16,20 * * *', // Cron schedule for automatic updates. Default: every day at 14:00, 16:00, 20:00
|
|
|
|
/* --------------------------- Discord Webhooks --------------------------- */
|
|
DISCORD_WEBHOOK_ENABLED: false, // Enables sending Discord webhooks with error reports, execution status, and other events.
|
|
DISCORD_WEBHOOK_URL: '',
|
|
DISCORD_WEBHOOK_USERNAME: 'SERVER_ID', // Username shown as the message author. Use null for default. 'SERVER_ID' will resolve to this.MAIN.SERVER_ID.
|
|
DISCORD_USER_ID: '', // Discord User ID to ping on critical events. Leave empty to disable pinging.
|
|
};
|
|
|
|
|
|
// Generates a report comment. Please do not remove the source link, I would greatly appreciate it! Thank you.
|
|
const serverId = this.MAIN.SERVER_ID ? `on ${this.MAIN.SERVER_ID} ` : '';
|
|
exports.REPORT_COMMENT = ({ date, srcIp, dstIp, proto, spt, dpt, In, Out, mac, len, ttl, id, tos, prec, res, window, urgp, syn }, fullLog) =>
|
|
`Blocked by ${serverId}[${dpt}/${proto?.toLowerCase()}] | SPT: ${spt} | TTL: ${ttl} | LEN: ${len} | TOS: ${tos} • ` +
|
|
'Reported by: abuse.terraforge.fun';
|
|
|
|
// Alternative version:
|
|
// exports.REPORT_COMMENT = ({ date, srcIp, dstIp, proto, spt, dpt, In, Out, mac, len, ttl, id, tos, prec, res, window, urgp, syn }, fullLog) =>
|
|
// `Blocked by UFW ${serverId}[${dpt}/${proto?.toLowerCase()}]. Generated by: github.com/sefinek/UFW-AbuseIPDB-Reporter`;
|
|
|
|
|
|
// See: https://www.abuseipdb.com/categories
|
|
const { FLAGS, createFlagCollection } = require('./scripts/flags.js');
|
|
const CATEGORIES = {
|
|
21: [FLAGS.PORT_SCAN, FLAGS.FTP],
|
|
22: [FLAGS.PORT_SCAN, FLAGS.SSH],
|
|
|
|
23: [FLAGS.PORT_SCAN, FLAGS.IOT_TARGETED],
|
|
2323: [FLAGS.PORT_SCAN, FLAGS.IOT_TARGETED],
|
|
5555: [FLAGS.PORT_SCAN, FLAGS.IOT_TARGETED],
|
|
7547: [FLAGS.PORT_SCAN, FLAGS.IOT_TARGETED],
|
|
8291: [FLAGS.PORT_SCAN, FLAGS.IOT_TARGETED],
|
|
|
|
25: [FLAGS.PORT_SCAN, FLAGS.EMAIL_SPAM],
|
|
465: [FLAGS.PORT_SCAN, FLAGS.EMAIL_SPAM],
|
|
587: [FLAGS.PORT_SCAN, FLAGS.EMAIL_SPAM],
|
|
|
|
5060: [FLAGS.PORT_SCAN, FLAGS.FRAUD_VOIP],
|
|
5061: [FLAGS.PORT_SCAN, FLAGS.FRAUD_VOIP],
|
|
|
|
1900: [FLAGS.PORT_SCAN, FLAGS.BAD_WEB_BOT],
|
|
};
|
|
|
|
exports.DETERMINE_CATEGORIES = ({ dpt }) => {
|
|
const set = createFlagCollection();
|
|
set.add(...(CATEGORIES[dpt] || [FLAGS.PORT_SCAN]));
|
|
return set.toString('AbuseIPDB');
|
|
}; |