Auto-Reporting LFD Block Reports to Abuse IP DB

UPDATE: This script has been updated to use v2 APIs. Please see the updated version here.

After upgrading my server to a better spec and moving to new data center, I found that the server was getting attacked by botnets trying to brute-force logins and port scanning. Using the ConfigServer Security & Firewall plugin (CSF) on my server I was able to automatically block attackers, but I wanted to go a step further: to report the IPs to the AbuseIPDB.

To achieve this, I wrote a PHP script that can be triggered by by the Login Failure Daemon (LFD) that comes with CSF, which then reports the abusive IPs to AbuseIPDB using their API.

Prerequisites

• CSF / LFD plugin installed and configured
• AbuseIPDB Account
• AbuseIPDB API Key

The PHP Script

I first started by writing a PHP script that could be called from the command line:

The above script captures the arguments sent by LFD in the command line, which includes the remote IP, a message that contains the reason for the IP block and relevant log messages (among other information). The full argument list is as follows:

ARG 1 = IP Address	# The IP address or CIDR being blocked
ARG 2 = ports		# Port, comma separated list or * for all ports
ARG 3 = permanent	# 0=temporary block, 1=permanent block
ARG 4 = inout		# Direction of block: in, out or inout
ARG 5 = timeout		# If a temporary block, TTL in seconds, otherwise 0
ARG 6 = message		# Message containing reason for block
ARG 7 = logs		# The logs lines that triggered the block (will contain
                        # line feeds between each log line)
ARG 8 = trigger		# The configuration settings triggered

The script then check if the IP has already been reported by your account (lines 44-60). If the IP hasn’t been reported, a new report is created on AbuseIPDB (line 65). The above script only checks reports from the last 10 days (line 46, days=10).

The verbose flag (line 46) is used in the API to return additional information on each report, including the AbuseIPDB User ID who created the report. This is used to make sure you don’t report the same IP more than once in a 10 day period.

I stored the script in /root/lfd.php and added the relevant execution permissions using chmod 755 lfd.php.

Thanks to line 1 in the above code, you can simply run lfd.php in the command line and it will trigger the PHP code (without the need for the php prefix).

Configuring CSF / LFD

Once the script was ready, I updated the CSF configuration to trigger the script:

1. Edit /etc/csf/csf.conf using your favourite editor
2. Find the line starting with BLOCK_REPORT
3. Update the line so it reads: BLOCK_REPORT = "/root/lfd.php"
4. Restart lfd using service lfd restart or using the web interface

Testing

To test the script, you can either trigger the PHP script manually or wait for a block event to occur. To test manually, you can run the following command line:

/root/lfd.php "REMOTE_IP" "PORTS" "1" "*" "*" "blocked REMOTE_IP for SSH brute force" "sshd"

The above command line mimics what LFD would send to the script when a block has occurred. If successful, the command line will display the output of the script, including the IP that was reported:

If the AbuseIPDB API reports success in the output, you will be able to see the corresponding report on the website:

As a result of this script running for a few days (and with some manual reporting before the script was setup), I’ve been able to report over a hundred IPs: