hacks/ipabusedb-docker-ssh/README.md

ipabusedb-docker-ssh

Reads the logs of a dockerised sshd with docker logs -t, extracts brute-force / invalid-user login attempts, and emits a CSV in the format expected by the AbuseIPDB bulk-report endpoint. Optionally submits it.

What gets reported:

• Invalid user X from IP port N
• User X from IP not allowed because not listed in AllowUsers
• Failed password for invalid user X from IP port N
• Connection closed by invalid user X IP port N and Disconnected from invalid user X IP port N

Attempts with the username git are excluded (so people poking a git host with git@ are not reported). Private, loopback and link-local source addresses are skipped. Each IP appears once in the CSV, dated with its most recent attempt and annotated with the number of matching lines. Categories are 18,22 (Brute-Force, SSH).

Configuration

Variable	Purpose
DOCKER_CONTAINER_NAME	container whose logs are read (required)
IPABUSEDB_API_KEY	AbuseIPDB API key (required only with --submit)

Flags:

Flag	Purpose
--since 24h	only consider lines newer than now minus this duration
-o FILE	write the CSV to FILE instead of stdout
--input FILE	parse FILE (or - for stdin) instead of docker logs
--submit	POST the CSV to the AbuseIPDB bulk-report endpoint

Usage

$ make build
$ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
$ ./ipabusedb-docker-ssh --since 24h -o reports.csv
$ ./ipabusedb-docker-ssh --since 24h --submit

Submitting manually with curl instead of --submit:

$ ./ipabusedb-docker-ssh --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"

make check runs vet, the tests and the build. loglines_example.txt holds sample docker logs -t output used by the tests; example_parser_script.py is the reference script from AbuseIPDB that this program replaces.