Due to popular demand, I have upgraded my initial LFD reporting script to use the IP Abuse DB v2 APIs. This post covers the new script and how it can be used. Please read my previous post to understand the background of the script.
The PHP Script
The PHP script is designed to be called from the command line. It has been updated to use v2 of the Abuse IP DB API.
The above script captures the arguments sent by LFD in the command line, which includes the remote IP, a message that contains the reason for the IP block and relevant log messages (among other information). The full argument list is as follows:
ARG 1 = IP Address # The IP address or CIDR being blocked
ARG 2 = ports # Port, comma separated list or * for all ports
ARG 3 = permanent # 0=temporary block, 1=permanent block
ARG 4 = inout # Direction of block: in, out or inout
ARG 5 = timeout # If a temporary block, TTL in seconds, otherwise 0
ARG 6 = message # Message containing reason for block
ARG 7 = logs # The logs lines that triggered the block (will contain # line feeds between each log line)
ARG 8 = trigger # The configuration settings triggered
The script then check if the IP has already been reported by your account (lines 87-97). If the IP hasn’t been reported, a new report is created on AbuseIPDB (line 102). The above script only checks reports from the last day (line 88,
verbose flag (line 88) is used in the API to return additional information on each report, including the AbuseIPDB User ID who created the report. This is used to make sure you don’t report the same IP more than once in 24 hour period.
I stored the script in
/root/lfd-v2.php and added the relevant execution permissions using
chmod 755 lfd-v2.php.
Thanks to line 1 in the above code, you can simply run
lfd-v2.php in the command line and it will trigger the PHP code (without the need for the
Configuring CSF / LFD
Once the script was ready, I updated the CSF configuration to trigger the script:
/etc/csf/csf.confusing your favourite editor
- Find the line starting with
- Update the line so it reads:
BLOCK_REPORT = "/root/lfd-v2.php"
service lfd restartor using the web interface
To test the script, you can either trigger the PHP script manually or wait for a block event to occur. To test manually, you can run the following command line:
/root/lfd-v2.php "REMOTE_IP" "PORTS" "1" "*" "*" "blocked REMOTE_IP for SSH brute force" "sshd"
The above command line mimics what LFD would send to the script when a block has occurred. If successful, the command line will display the output of the script, including the IP that was reported:
If the script reports the confidence score, the IP was correctly reported, and will therefore appear on the website: