57 lines
2.3 KiB
Markdown
57 lines
2.3 KiB
Markdown
# ipabusedb-docker-ssh
|
|
|
|
Reads the logs of a dockerised sshd with `docker logs -t`, extracts
|
|
brute-force / invalid-user login attempts, and emits a CSV in the format
|
|
expected by the [AbuseIPDB bulk-report
|
|
endpoint](https://www.abuseipdb.com/bulk-report). Optionally submits it.
|
|
|
|
What gets reported:
|
|
|
|
- `Invalid user X from IP port N`
|
|
- `User X from IP not allowed because not listed in AllowUsers`
|
|
- `Failed password for invalid user X from IP port N`
|
|
- `Connection closed by invalid user X IP port N` and
|
|
`Disconnected from invalid user X IP port N`
|
|
|
|
Attempts with the username `git` are excluded (so people poking a git
|
|
host with `git@` are not reported). Private, loopback and link-local
|
|
source addresses are skipped. Each IP appears once in the CSV, dated with
|
|
its most recent attempt and annotated with the number of matching lines.
|
|
Categories are `18,22` (Brute-Force, SSH).
|
|
|
|
## Configuration
|
|
|
|
| Variable | Purpose |
|
|
| ----------------------- | ------------------------------------------------ |
|
|
| `DOCKER_CONTAINER_NAME` | container whose logs are read (required) |
|
|
| `IPABUSEDB_API_KEY` | AbuseIPDB API key (required only with `--submit`) |
|
|
|
|
Flags:
|
|
|
|
| Flag | Purpose |
|
|
| --------------- | --------------------------------------------------------- |
|
|
| `--since 24h` | only consider lines newer than now minus this duration |
|
|
| `-o FILE` | write the CSV to `FILE` instead of stdout |
|
|
| `--input FILE` | parse `FILE` (or `-` for stdin) instead of `docker logs` |
|
|
| `--submit` | POST the CSV to the AbuseIPDB bulk-report endpoint |
|
|
|
|
## Usage
|
|
|
|
```
|
|
$ make build
|
|
$ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
|
|
$ ./ipabusedb-docker-ssh --since 24h -o reports.csv
|
|
$ ./ipabusedb-docker-ssh --since 24h --submit
|
|
```
|
|
|
|
Submitting manually with curl instead of `--submit`:
|
|
|
|
```
|
|
$ ./ipabusedb-docker-ssh --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"
|
|
```
|
|
|
|
`make check` runs vet, the tests and the build. `loglines_example.txt`
|
|
holds sample `docker logs -t` output used by the tests;
|
|
`example_parser_script.py` is the reference script from AbuseIPDB that
|
|
this program replaces.
|