Solved Many connections from amazonaws? And Abuseipdb config to block abusers.

zEitEr said:
You might try any other.
Click to expand...
I tried 192.168.10.1 and as expected no report to abuseipdb. Expected because other cluster reports generated by csf themselves, also did not report to abuseipdb.

I now removed the extra line from the perl script and see if reporting is still done.
 
Richard G said:
I tried 192.168.10.1 and as expected no report to abuseipdb. Expected because other cluster reports generated by csf themselves, also did not report to abuseipdb.

I now removed the extra line from the perl script and see if reporting is still done.
Click to expand...
Does any AbuseIPDB recorded logs ever report Cluster member reports? Maybe AbuseIPDB is filtering them out as they'd be considered duplicates?
 
eva2000 said:
Does any AbuseIPDB recorded logs ever report Cluster member reports?
Click to expand...
Yes, see post #28. ;)

I looking now what is wrong, because not it's not reporting anything anymore, so I'm testing with the perl script if the perl script even still works because on the other server I used the .sh script.
 
You might try this one with some logging added:

Perl: 
#!/usr/bin/perl
# This file was written as an executable to be used in the auto report function
# of csf and lfd. By replacing $YOUR_API_KEY below with your abuseipdb api key,
# allows you to use this code to integrate your csf system with abuseipdb.com
use strict;
use warnings;
use HTTP::Tiny;
use JSON;
use POSIX qw(strftime);

# Gather the information from the commandline passed by lfd
my $ports = $ARGV[1];
my $inout = $ARGV[3];
my $message = $ARGV[5];
my $logs = $ARGV[6];
my $trigger = $ARGV[7];
my $comment = $message . "; Ports: " . $ports . "; Direction: " . $inout . "; Trigger: " . $trigger . "; Logs: " . $logs;
my $ua = HTTP::Tiny->new;

$comment =~ s/Cluster member.*said,/***/g;

log_str("Reporting: ". $comment);

my $url = 'https://api.abuseipdb.com/api/v2/report';

my $data = {
    ip => $ARGV[0],
    comment => $comment,
    categories => 14
};

my %options = (
   "headers", {
       "Key" => "YOUR_API_KEY",
       "Accept" => "application/json"
   },
);

my $response = $ua->post_form($url, $data, \%options);
my $json = JSON->new;
my $output = $json->pretty->encode($json->decode($response->{'content'}));

if ($response->{'status'} == 200){
    print "Report Succesful!\n" . $output;
} elsif ($response->{'status'} == 429) {
    print $output;
} elsif ($response->{'status'} == 422) {
    print $output;
} elsif ($response->{'status'} == 401) {
    print $output;
}

log_str("Response: ". $output);

sub log_str
{
    my ($str) = @_;
    my $date = localtime();
    open (LOG, ">> /var/log/lfd_abuseipdb.log");
    print LOG "${date}: ${str}\n";
    close(LOG);
}

Trigger a block and then check logs: /var/log/lfd_abuseipdb.log
 
Thank you @zEitEr I will do that for sure.
Edit: tested and log works like a charm.

Yesterday evening late, I've been doing some more testing and searching and found out that the perl script was not working at all, hence also not the exclusion line. :)
But I didn't know why until I found a little older thread by accident, here on the forums, which brought me the solution I found in there.

I had to install perl-JSON and after that, the perl script worked, and the exclusion line too.

Only thing left now is that sometimes it places way to much log, containing other abusing ip's next to the reported one.
(Fixed by removing the log statement part).

Now I'm testing a script with @eva2000 with several nice options and I will test your script with log too, because logging is great.

@Active8 Hahaha, yeah you get that right. I have adjusted it to give a better reflection.
 
Last edited:
Oooh yes... I use a tool now which makes everything perfect, even masking, reporting in the correct category and all.

Have al ook at this one.
github.com

GitHub - centminmod/centminmod-abuseipdb-reporter: CSF Firewall and AbuseIPDB API integration with specific focus on data privacy and prevention of sensitive data leaked to public AbuseIPDB database report

CSF Firewall and AbuseIPDB API integration with specific focus on data privacy and prevention of sensitive data leaked to public AbuseIPDB database report - centminmod/centminmod-abuseipdb-reporter
github.com github.com
 
Richard G said:
Oooh yes... I use a tool now which makes everything perfect, even masking, reporting in the correct category and all.

Have al ook at this one.
github.com

GitHub - centminmod/centminmod-abuseipdb-reporter: CSF Firewall and AbuseIPDB API integration with specific focus on data privacy and prevention of sensitive data leaked to public AbuseIPDB database report

CSF Firewall and AbuseIPDB API integration with specific focus on data privacy and prevention of sensitive data leaked to public AbuseIPDB database report - centminmod/centminmod-abuseipdb-reporter
github.com github.com
Click to expand...
Glad you like. Been deploying my scripts on all my servers too :D
 
You must log in or register to reply here.
Back
Top