add ipabusedb-docker-ssh: report sshd brute-force attempts from docker logs to AbuseIPDB

ipabusedb-docker-ssh/README.md

@@ -0,0 +1,56 @@
+# ipabusedb-docker-ssh
+
+Reads the logs of a dockerised sshd with `docker logs -t`, extracts
+brute-force / invalid-user login attempts, and emits a CSV in the format
+expected by the [AbuseIPDB bulk-report
+endpoint](https://www.abuseipdb.com/bulk-report). Optionally submits it.
+
+What gets reported:
+
+-   `Invalid user X from IP port N`
+-   `User X from IP not allowed because not listed in AllowUsers`
+-   `Failed password for invalid user X from IP port N`
+-   `Connection closed by invalid user X IP port N` and
+    `Disconnected from invalid user X IP port N`
+
+Attempts with the username `git` are excluded (so people poking a git
+host with `git@` are not reported). Private, loopback and link-local
+source addresses are skipped. Each IP appears once in the CSV, dated with
+its most recent attempt and annotated with the number of matching lines.
+Categories are `18,22` (Brute-Force, SSH).
+
+## Configuration
+
+| Variable                | Purpose                                          |
+| ----------------------- | ------------------------------------------------ |
+| `DOCKER_CONTAINER_NAME` | container whose logs are read (required)         |
+| `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required only with `--submit`) |
+
+Flags:
+
+| Flag            | Purpose                                                   |
+| --------------- | --------------------------------------------------------- |
+| `--since 24h`   | only consider lines newer than now minus this duration    |
+| `-o FILE`       | write the CSV to `FILE` instead of stdout                 |
+| `--input FILE`  | parse `FILE` (or `-` for stdin) instead of `docker logs`  |
+| `--submit`      | POST the CSV to the AbuseIPDB bulk-report endpoint        |
+
+## Usage
+
+```
+$ make build
+$ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
+$ ./ipabusedb-docker-ssh --since 24h -o reports.csv
+$ ./ipabusedb-docker-ssh --since 24h --submit
+```
+
+Submitting manually with curl instead of `--submit`:
+
+```
+$ ./ipabusedb-docker-ssh --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"
+```
+
+`make check` runs vet, the tests and the build. `loglines_example.txt`
+holds sample `docker logs -t` output used by the tests;
+`example_parser_script.py` is the reference script from AbuseIPDB that
+this program replaces.