# ipabusedb-docker-reporter

Reads the logs of a dockerised sshd with `docker logs -t`, extracts
brute-force / invalid-user login attempts, and emits a CSV in the format
expected by the [AbuseIPDB bulk-report
endpoint](https://www.abuseipdb.com/bulk-report). Optionally submits it.

What gets reported:

-   `Invalid user X from IP port N`
-   `User X from IP not allowed because not listed in AllowUsers`
-   `Failed password for invalid user X from IP port N`
-   `Connection closed by invalid user X IP port N` and
    `Disconnected from invalid user X IP port N`

Attempts with the username `git` are excluded (so people poking a git
host with `git@` are not reported). Private, loopback and link-local
source addresses are skipped. Each IP appears once in the CSV, dated with
its most recent attempt and annotated with the number of matching lines.
Categories are `18,22` (Brute-Force, SSH).

## Configuration

A `.env` file in the working directory is loaded at startup (see
`.env.example`; `.env` is gitignored). Variables already set in the
shell take precedence over the file.

| Variable                | Purpose                                                  |
| ----------------------- | -------------------------------------------------------- |
| `DOCKER_CONTAINER_NAME` | container whose logs are read (required)                 |
| `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required only with `--submit`)        |
| `DOCKER_HOST`           | passed through to the `docker` CLI to target a remote daemon |

Because the program shells out to the `docker` CLI with its own
environment, `DOCKER_HOST` (and `DOCKER_CONTEXT`, `DOCKER_TLS_VERIFY`,
`DOCKER_CERT_PATH`) work exactly as they do for `docker` itself. Set
`DOCKER_HOST=ssh://user@host` in `.env` to read logs from a remote
daemon while the AbuseIPDB key never leaves the local machine.

Flags:

| Flag            | Purpose                                                   |
| --------------- | --------------------------------------------------------- |
| `--since 24h`   | only consider lines newer than now minus this duration    |
| `-o FILE`       | write the CSV to `FILE` instead of stdout                 |
| `--input FILE`  | parse `FILE` (or `-` for stdin) instead of `docker logs`  |
| `--submit`      | POST the CSV to the AbuseIPDB bulk-report endpoint        |
| `--env FILE`    | env file to autoload (default `.env`; missing is ignored) |

## Usage

```
$ make build
$ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
$ ./ipabusedb-docker-reporter --since 24h -o reports.csv
$ ./ipabusedb-docker-reporter --since 24h --submit
```

Submitting manually with curl instead of `--submit`:

```
$ ./ipabusedb-docker-reporter --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"
```

## Running as a container

The `Dockerfile` builds on `git.eeqj.de/sneak/baseimage` and installs the
program as a runit service (`sv/ipabusedb-docker-reporter/run`) that
sleeps `INTERVAL` seconds, then runs the reporter with
`--since ${INTERVAL}s --submit`, and repeats. The docker CLI is copied in
from the official `docker` CLI image (pinned by tag and digest in the
`Dockerfile`) so the program can read logs through the host's docker
socket.

| Variable                | Purpose                                            |
| ----------------------- | -------------------------------------------------- |
| `DOCKER_CONTAINER_NAME` | container whose logs are read (required)           |
| `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required)                       |
| `INTERVAL`              | seconds between runs, and the report window (1200) |

`make image` builds the image, tagged locally as
`ipabusedb-docker-reporter` and as
`git.eeqj.de/sneak/ipabusedb-docker-reporter` with today's date and
`latest`. `make push` builds and pushes both registry tags (log in once
with `docker login git.eeqj.de`).

```
$ make push
$ docker run -d --restart unless-stopped \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -e DOCKER_CONTAINER_NAME=sshd \
    -e IPABUSEDB_API_KEY=... \
    -e INTERVAL=1200 \
    git.eeqj.de/sneak/ipabusedb-docker-reporter:latest
```

Each run's CSV and the AbuseIPDB response go to the container log. If a
required variable is missing the service logs an error, sleeps a minute
and exits so runit can retry.

`make check` runs vet, the tests and the build. `loglines_example.txt`
holds sample `docker logs -t` output used by the tests;
`example_parser_script.py` is the reference script from AbuseIPDB that
this program replaces.