AbuseIPDB and CSF/Others

factor

factor

Verified User
Joined
Jul 22, 2017
Messages
3,729
Location
USA
All:
Just in case you did not know. AbuseIPDB allows auto reporting of the "bad guys" with CSF and Others. You just need a free account.

AbuseIPDB provides a free API for reporting and checking IP addresses.
Click to expand...
Every day webmasters, system administrators, and other IT professionals use our API to report thousands of IP addresses engaging spamming, hacking, vulnerability scanning, and other malicious activity in real time.

ConfigServer Security & Firewall (csf) is a stateful packet inspection (SPI) firewall, Login/Intrusion Detection and security application for Linux servers.

In this tutorial, we will learn how to set up CSF so that attempted intrusions against your system are automatically blocked. It is also possible to use CSF to pre-emptively block IP addresses in our blacklist.
Click to expand...

The main link is here https://www.abuseipdb.com/
CSF link is https://www.abuseipdb.com/csf
Fail2Ban link https://www.abuseipdb.com/fail2ban.html

The csf integration works great.

They even have a bulk reporter log scanner as well.
Bulk link https://www.abuseipdb.com/bulk-report
 
Seems very interesting. But I'm not really into auto reporting. It's happens that also good customers get blocked, for example because they create a new email address and instantly forget their password. They should not get into blacklists.

So handle with care, also because there is no limits in ip's so as they also say, watch for restraining your system.
 
Eureka said:
I just signed up for a free account, looks like you can only use one domain per account. ?
Click to expand...
I just used my company domain. Then verified. Then used the api key for all my servers. The domain as far as I know is used to verify your the owner of the domain.
 
It is what I did. I am still trying this out. It seems to work so far.

I did need to add perl-JSON on centos
 
Last edited:
Running into some trouble and appreciate some help.
Trying to make this work at CentOS 8 with csf/lfd.

I registered at abuseipdb and generated an api v2 key.
With this api key I can import the blacklist fine, but the reporting script gives me errors with this api v2 key.

First problem I encountered when I ran the script was: Can't locate JSON.pm in @INC (you may need to install the JSON module)
Googled it and find a solution: yum install perl-JSON

Now I'm getting:
Code: 
[root@ bin]# ./abuseipdb_report.pl
Global symbol "$YOUR_API_KEY" requires explicit package name (did you forget to declare "my $YOUR_API_KEY"?) at ./abuseipdb_report.pl line 30.
Execution of ./abuseipdb_report.pl aborted due to compilation errors.
[root@ bin]# ./abuseipdb_report.pl
Use of uninitialized value $message in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $ports in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $inout in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $trigger in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $logs in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $01259875265 in concatenation (.) or string at ./abuseipdb_report.pl line 28.
Use of uninitialized value in subroutine entry at /usr/share/perl5/vendor_perl/HTTP/Tiny.pm line 988.
{
   "errors" : [
      {
         "detail" : "Authentication failed. You are either missing your API key or it is incorrect. Note: The APIv2 key differs from the APIv1 key.",
         "status" : 401
      }
   ]
}
Entered my api v2 key and ran the script again. Than a lot of concatenation messages appeared. Not worrying yet, because the apiv1 key might fix that.

But I can't find an api v1 in my account?
Could it be that I registered as a "private" instead of a webmaster?

Update: Went through the webmaster procedure and verified a domain and implemented a contributor badge. My limits were upgraded, but still no api v1 to be found.
 
Last edited:
Wanabo said:
Running into some trouble and appreciate some help.
Trying to make this work at CentOS 8 with csf/lfd.

I registered at abuseipdb and generated an api v2 key.
With this api key I can import the blacklist fine, but the reporting script gives me errors with this api v2 key.

First problem I encountered when I ran the script was: Can't locate JSON.pm in @INC (you may need to install the JSON module)
Googled it and find a solution: yum install perl-JSON

Now I'm getting:
Code: 
[root@ bin]# ./abuseipdb_report.pl
Global symbol "$YOUR_API_KEY" requires explicit package name (did you forget to declare "my $YOUR_API_KEY"?) at ./abuseipdb_report.pl line 30.
Execution of ./abuseipdb_report.pl aborted due to compilation errors.
[root@ bin]# ./abuseipdb_report.pl
Use of uninitialized value $message in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $ports in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $inout in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $trigger in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $logs in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $01259875265 in concatenation (.) or string at ./abuseipdb_report.pl line 28.
Use of uninitialized value in subroutine entry at /usr/share/perl5/vendor_perl/HTTP/Tiny.pm line 988.
{
   "errors" : [
      {
         "detail" : "Authentication failed. You are either missing your API key or it is incorrect. Note: The APIv2 key differs from the APIv1 key.",
         "status" : 401
      }
   ]
}
Entered my api v2 key and ran the script again. Than a lot of concatenation messages appeared. Not worrying yet, because the apiv1 key might fix that.

But I can't find an api v1 in my account?
Could it be that I registered as a "private" instead of a webmaster?

Update: Went through the webmaster procedure and verified a domain and implemented a contributor badge. My limits were upgraded, but still no api v1 to be found.
Click to expand...
You need
Code: 
dnf install perl-HTTP-Tiny

as well
See if that helps
 
I see the issue in their doc the names conflict

abuseipdb_block.pl hosted with ❤ by GitHub
And then make the script file executable using

chmod +x


2.) Set the BLOCK_REPORT variable in /etc/csf.conf to the executable script file.


BLOCK_REPORT = "/path/to/abuseipdb_report.pl"
Click to expand...

Make them match
 
Hi Brent,
perl-HTTP-Tiny is all ready installed.
bdacus01 said:
You need
Code: 
dnf install perl-HTTP-Tiny

as well
See if that helps
Click to expand...
Code: 
# yum install perl-HTTP-Tiny
Last metadata expiration check: 1:19:40 ago on Wed 05 Aug 2020 05:48:07 AM UTC.
Package perl-HTTP-Tiny-0.074-1.el8.noarch is already installed.
Dependencies resolved.
Nothing to do.

bdacus01 said:
are you here
Reporting to AbuseIPDB (Optional)
1.) Create an executable script that reports to AbuseIPDB.

What link are you on?
Click to expand...
Yes! I've put the script in: /usr/local/csf/bin/abuseipdb_report.pl and chmod it to: 100700 root:root
Or do you mean by link this? https://www.abuseipdb.com/csf


bdacus01 said:
I see the issue in their doc the names conflict



Make them match
Click to expand...
They were matched! BLOCK_REPORT = "/usr/local/csf/bin/abuseipdb_report.pl"

As far as I can see I did everything right. :(
 
Ok fixed the api issue. I left a $ sign!
"Key" => "$YOUR_API_KEY",
I only removed YOUR_API_KEY leaving the $ before my api key.

But still not working.
Code: 
# ./abuseipdb_report.pl
Use of uninitialized value $message in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $ports in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $inout in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $trigger in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value $logs in concatenation (.) or string at ./abuseipdb_report.pl line 16.
Use of uninitialized value in subroutine entry at /usr/share/perl5/vendor_perl/HTTP/Tiny.pm line 988.
{
   "errors" : [
      {
         "source" : {
            "parameter" : "ip"
         },
         "status" : 422,
         "detail" : "The ip field is required."
      }
   ]
}

Edit: Suddenly I had this thought. I'm running the script directly, but it is intended to be called by csf/lfd. Then the values might be passed.
So perhaps just wait and see if ip's are getting reported in my dashboard at abuseipdb.
@Brent, what happens if you run the script directly from the command line?
 
Last edited:
You must log in or register to reply here.
Back
Top