Reads the logs of a dockerised sshd with docker logs -t, extracts brute-force / invalid-user login attempts, and emits a CSV in the format expected by the AbuseIPDB bulk-report endpoint. Optionally submits it.

What gets reported:

Invalid user X from IP port N
User X from IP not allowed because not listed in AllowUsers
Failed password for invalid user X from IP port N
Connection closed by invalid user X IP port N and Disconnected from invalid user X IP port N

Attempts with the username git are excluded (so people poking a git host with git@ are not reported). Private, loopback and link-local source addresses are skipped. Each IP appears once in the CSV, dated with its most recent attempt and annotated with the number of matching lines. Categories are 18,22 (Brute-Force, SSH).

Configuration

A .env file in the working directory is loaded at startup (see .env.example; .env is gitignored). Variables already set in the shell take precedence over the file.

Variable	Purpose
`DOCKER_CONTAINER_NAME`	container whose logs are read (required)
`IPABUSEDB_API_KEY`	AbuseIPDB API key (required only with `--submit`)
`DOCKER_HOST`	passed through to the `docker` CLI to target a remote daemon

Because the program shells out to the docker CLI with its own environment, DOCKER_HOST (and DOCKER_CONTEXT, DOCKER_TLS_VERIFY, DOCKER_CERT_PATH) work exactly as they do for docker itself. Set DOCKER_HOST=ssh://user@host in .env to read logs from a remote daemon while the AbuseIPDB key never leaves the local machine.

Flags:

Flag	Purpose
`--since 24h`	only consider lines newer than now minus this duration
`-o FILE`	write the CSV to `FILE` instead of stdout
`--input FILE`	parse `FILE` (or `-` for stdin) instead of `docker logs`
`--submit`	POST the CSV to the AbuseIPDB bulk-report endpoint
`--env FILE`	env file to autoload (default `.env`; missing is ignored)

Usage

$ make build
$ export DOCKER_CONTAINER_NAME=sshd IPABUSEDB_API_KEY=...
$ ./ipabusedb-docker-ssh --since 24h -o reports.csv
$ ./ipabusedb-docker-ssh --since 24h --submit

Submitting manually with curl instead of --submit:

$ ./ipabusedb-docker-ssh --since 24h > reports.csv && curl https://api.abuseipdb.com/api/v2/bulk-report -F csv=@reports.csv -H "Key: $IPABUSEDB_API_KEY"

make check runs vet, the tests and the build. loglines_example.txt holds sample docker logs -t output used by the tests; example_parser_script.py is the reference script from AbuseIPDB that this program replaces.