Auto-Reporting LFD Block Reports to Abuse IP DB v2

Due to popular demand, I have upgraded my initial LFD reporting script to use the IP Abuse DB v2 APIs. This post covers the new script and how it can be used. Please read my previous post to understand the background of the script.

Prerequisites

• CSF / LFD plugin installed and configured
• AbuseIPDB Account
• AbuseIPDB APIv2 Key

The PHP Script

The PHP script is designed to be called from the command line. It has been updated to use v2 of the Abuse IP DB API.

The above script captures the arguments sent by LFD in the command line, which includes the remote IP, a message that contains the reason for the IP block and relevant log messages (among other information). The full argument list is as follows:

ARG 1 = IP Address # The IP address or CIDR being blocked
ARG 2 = ports # Port, comma separated list or * for all ports
ARG 3 = permanent # 0=temporary block, 1=permanent block
ARG 4 = inout # Direction of block: in, out or inout
ARG 5 = timeout # If a temporary block, TTL in seconds, otherwise 0 
ARG 6 = message # Message containing reason for block
ARG 7 = logs # The logs lines that triggered the block (will contain                         # line feeds between each log line)
ARG 8 = trigger # The configuration settings triggered 

The script then check if the IP has already been reported by your account (lines 87-97). If the IP hasn’t been reported, a new report is created on AbuseIPDB (line 102). The above script only checks reports from the last day (line 88, maxAgeInDays=1).

The verbose flag (line 88) is used in the API to return additional information on each report, including the AbuseIPDB User ID who created the report. This is used to make sure you don’t report the same IP more than once in 24 hour period.

I stored the script in /root/lfd-v2.php and added the relevant execution permissions using chmod 755 lfd-v2.php.

Thanks to line 1 in the above code, you can simply run lfd-v2.php in the command line and it will trigger the PHP code (without the need for the php prefix).

Configuring CSF / LFD

Once the script was ready, I updated the CSF configuration to trigger the script:

1. Edit /etc/csf/csf.conf using your favourite editor
2. Find the line starting with BLOCK_REPORT
3. Update the line so it reads: BLOCK_REPORT = "/root/lfd-v2.php"
4. Restart lfd using service lfd restart or using the web interface

Testing

To test the script, you can either trigger the PHP script manually or wait for a block event to occur. To test manually, you can run the following command line:

/root/lfd-v2.php "REMOTE_IP" "PORTS" "1" "*" "*" "blocked REMOTE_IP for SSH brute force" "sshd"

The above command line mimics what LFD would send to the script when a block has occurred. If successful, the command line will display the output of the script, including the IP that was reported:

If the script reports the confidence score, the IP was correctly reported, and will therefore appear on the website:

Firewall, Hacking, IP Abuse, Security