After upgrading my server to a better spec and moving to new data center, I found that the server was getting attacked by botnets trying to brute-force logins and port scanning. Using the ConfigServer Security & Firewall plugin (CSF) on my server I was able to automatically block attackers, but I wanted to go a step further: to report the IPs to the AbuseIPDB.
To achieve this, I wrote a PHP script that can be triggered by by the Login Failure Daemon (LFD) that comes with CSF, which then reports the abusive IPs to AbuseIPDB using their API.
The PHP Script
I first started by writing a PHP script that could be called from the command line:
The above script captures the arguments sent by LFD in the command line, which includes the remote IP, a message that contains the reason for the IP block and relevant log messages (among other information). The full argument list is as follows:
ARG 1 = IP Address # The IP address or CIDR being blocked ARG 2 = ports # Port, comma separated list or * for all ports ARG 3 = permanent # 0=temporary block, 1=permanent block ARG 4 = inout # Direction of block: in, out or inout ARG 5 = timeout # If a temporary block, TTL in seconds, otherwise 0 ARG 6 = message # Message containing reason for block ARG 7 = logs # The logs lines that triggered the block (will contain # line feeds between each log line) ARG 8 = trigger # The configuration settings triggered
The script then check if the IP has already been reported by your account (lines 44-60). If the IP hasn’t been reported, a new report is created on AbuseIPDB (line 65). The above script only checks reports from the last 10 days (line 46,
verbose flag (line 46) is used in the API to return additional information on each report, including the AbuseIPDB User ID who created the report. This is used to make sure you don’t report the same IP more than once in a 10 day period.
I stored the script in
/root/lfd.php and added the relevant execution permissions using
chmod 755 lfd.php.
Thanks to line 1 in the above code, you can simply run
lfd.php in the command line and it will trigger the PHP code (without the need for the
Configuring CSF / LFD
Once the script was ready, I updated the CSF configuration to trigger the script:
/etc/csf/csf.confusing your favourite editor
- Find the line starting with
- Update the line so it reads:
BLOCK_REPORT = "/root/lfd.php"
service lfd restartor using the web interface
To test the script, you can either trigger the PHP script manually or wait for a block event to occur. To test manually, you can run the following command line:
/root/lfd.php "REMOTE_IP" "PORTS" "1" "*" "*" "blocked REMOTE_IP for SSH brute force" "sshd"
The above command line mimics what LFD would send to the script when a block has occurred. If successful, the command line will display the output of the script, including the IP that was reported:
If the AbuseIPDB API reports
success in the output, you will be able to see the corresponding report on the website:
As a result of this script running for a few days (and with some manual reporting before the script was setup), I’ve been able to report over a hundred IPs: