Skip to content

Commit

Permalink
Added a README
Browse files Browse the repository at this point in the history
  • Loading branch information
Simon Cahill committed Oct 9, 2022
1 parent 134eb44 commit f37c1b5
Showing 1 changed file with 69 additions and 0 deletions.
69 changes: 69 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,69 @@
# fail2abuseipdb

fail2abuseipdb is a server administration tool (currently WIP!) which allows server administrators to **easily** and **automagically** convert
fail2ban's output (which a weird semi-JSON format) to a CSV-format which can directly be published to abuseipdb!

# Features
fail2abuseipdb provides a limited featureset, although it is enough for its task.

- Reading fail2ban's output from a file
- Reading fail2ban's output from stdin via pipes (**WIP**)
- Reading fail2ban's output directly by calling fail2ban (requires elevated privileges and may be dangerous!) (**WIP**)
- Comment customisation
- Supports both individual jails and complete f2b output!
- Jail names are detected automatically when full output is detected

# Arguments

The following table describes the individual arguments and switches fail2abuseipdb understands.
Arguments and switched marked as ((planned)) are not use available (or usable)!

| Long | Short | Description | Status |
|---------------|-------|-----------------------------------------------------------------------|---------------|
| --help | -h | Prints the help menu and exits. | working |
| --stdin | -s | Reads input from stdin (pipe). | ((planned)) |
| --file= | -f[f] | Reads input from the passed file or fail2ban.json if no file passed. | working |
| --version | -v | Prints the version information and exits. | ((planned)) |
| --comment | -c | Overrides the default value for the comment. Must be in quotes (")! | working |
| --jail-name= | -j[j] | Useful when importing single jails; sets the name for the jail. | working |

## Comment variables
| Variable | Function | Status |
|---------------|-------------------------------------------------------------------------------|---------------|
| {0} | Prints the jail name in the comment. | working |
| {1} | Prints the report time in the comment. | ((planned)) |

# Usage

Getting started with fail2abuseipdb is simple. Install the file to /usr/bin (or where ever in your PATH) and call it as follows.

**Please not at the time of writing, ONLY reading from files works!**

## Reading from files
```bash
# Single jail

fail2ban-client get myjail banned >/tmp/myjail.txt
fail2abuseipdb -f/tmp/myjail.txt -jmyjail -c"Was banned for fcking w/ my shit. Fail2ban jail: {0}" >/tmp/myjail.csv

# ALL THE JAILS
fail2ban-client banned >/tmp/alljails.txt
fail2abuseipdb -f/tmp/alljails.txt -c"Brute-force attack against {0}" >/tmp/alljails.csv
```

## Reading from stdin (*WIP*)
```bash
# Single jail

fail2ban-client get myjail banned | fail2abuseipdb -s -jmyjail -c"Was banned for fcking w/ my shit. Fail2ban jail: {0}" >/tmp/myjail.csv

# ALL THE JAILS
fail2ban-client banned | fail2abuseipdb -s -c"Brute-force attack against {0}" >/tmp/alljails.csv
```

# Changelog

**v0.1.0b**

- Initial release
- Very much still a beta release, **but it works**!

0 comments on commit f37c1b5

Please sign in to comment.