# ipabusedb-docker-ssh

Reads the logs of a dockerised sshd with `docker logs -t`, extracts
brute-force / invalid-user login attempts, and emits a CSV in the format
expected by the [AbuseIPDB bulk-report
endpoint](https://www.abuseipdb.com/bulk-report). Optionally submits it.

What gets reported:

-   `Invalid user X from IP port N`
-   `User X from IP not allowed because not listed in AllowUsers`
-   `Failed password for invalid user X from IP port N`
-   `Connection closed by invalid user X IP port N` and
    `Disconnected from invalid user X IP port N`

Attempts with the username `git` are excluded (so people poking a git
host with `git@` are not reported). Private, loopback and link-local
source addresses are skipped. Each IP appears once in the CSV, dated with
its most recent attempt and annotated with the number of matching lines.
Categories are `18,22` (Brute-Force, SSH).

## Configuration

| Variable                | Purpose                                          |
| ----------------------- | ------------------------------------------------ |
| `DOCKER_CONTAINER_NAME` | container whose logs are read (required)         |
| `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required only with `--submit`) |

Flags:

| Flag            | Purpose                                                   |
| --------------- | --------------------------------------------------------- |
| `--since 24h`   | only consider lines newer than now minus this duration    |
| `-o FILE`       | write the CSV to `FILE` instead of stdout                 |
| `--input FILE`  | parse `FILE` (or `-` for stdin) instead of `docker logs`  |
| `--submit`      | POST the CSV to the AbuseIPDB bulk-report endpoint        |

## Usage

```
$ make build
$ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
$ ./ipabusedb-docker-ssh --since 24h -o reports.csv
$ ./ipabusedb-docker-ssh --since 24h --submit
```

Submitting manually with curl instead of `--submit`:

```
$ ./ipabusedb-docker-ssh --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"
```

`make check` runs vet, the tests and the build. `loglines_example.txt`
holds sample `docker logs -t` output used by the tests;
`example_parser_script.py` is the reference script from AbuseIPDB that
this program replaces.