v1.1.1 - Installer config placement fix

Fail2Ban_AbuseIPDB v1.1.1

Bug-fix release for the installer configuration handling.

Fixed

• api_key_file placement on upgrade. Upgrading a configuration that did
  not yet contain api_key_file appended the line to the end of the file
  (inside [category_map]) instead of [abuseipdb]. The installer now inserts
  it at the end of the [abuseipdb] section and replaces an existing line in
  place. Config parsing and the default key path were unaffected, but a custom
  --key-file path could be ignored by the reporter in that edge case.
• Re-running the installer over such a configuration repairs it (the stray line
  is removed and the correct one is written into [abuseipdb]).

Upgrade

sudo abuseipdb-upgrade --check     # 10 = update available
sudo abuseipdb-upgrade --upgrade   # verifies SHA-256, keeps key/config/queue/jails

Key file, configuration, queue and jail list are preserved as in v1.1.0.

v1.1.0 - API key file & self-update

Fail2Ban_AbuseIPDB v1.1.0

Key management and self-update: the project can now update itself from GitHub
without ever losing the AbuseIPDB API key.

Highlights

• API key in its own file - /etc/abuseipdb/.abuseipdb.key (mode 600),
  separate from reporter.conf, the code and the release tarball. Re-installs
  and self-updates keep an existing key file untouched.
• First-run wizard - if no key is configured, an interactive run asks for it
  once, validates it and saves it to the key file. Non-interactive runs
  (systemd/cron) fail with an actionable message instead of hanging.
• Migration - a legacy api_key in reporter.conf is moved into the key
  file automatically (or with abuseipdb-report --migrate-key), and the config
  line is blanked.
• Self-update - abuseipdb-upgrade --check compares the installed version
  with updater.json on GitHub (exit 10 = update available).
  abuseipdb-upgrade --upgrade downloads the release tarball, requires and
  verifies its SHA-256, extracts it with a traversal/link-safe extractor,
  snapshots the key file and runs the bundled installer. On failure the key is
  restored; the config, queue and jail list are preserved.
• Optional weekly check - install.sh --with-update-check installs a
  systemd timer (or cron job) that only reports availability; it never installs
  in the background.
• Safer upgrades - the installer detects the already configured jails on
  upgrade, keeps reporter.conf, the queue database and the key file, and still
  backs up every replaced file under /var/backups/fail2ban-abuseipdb/.
• Self-advertising footer from v1.0.0 stays: every report ends with
  Reported via Fail2Ban_AbuseIPDB Monitor: https://github.com/paulmann/Fail2Ban_AbuseIPDB
  (configurable with attribution = no).

Install / upgrade

git clone https://github.com/paulmann/Fail2Ban_AbuseIPDB.git
cd Fail2Ban_AbuseIPDB
sudo ./install.sh            # asks for the API key once on a terminal

# existing installations:
sudo abuseipdb-upgrade --check
sudo abuseipdb-upgrade --upgrade

Full documentation: README,
INSTALL,
UPDATE,
CONFIGURATION.

v1.0.0 - Initial public release

Fail2Ban_AbuseIPDB v1.0.0

The first public release: an asynchronous fail2ban → AbuseIPDB reporter.

Why

The stock AbuseIPDB action runs curl inside the fail2ban ban action. A slow
API, a rate limit, a revoked key or an attacker-controlled URL in <matches>
all become problems of the ban path - which is supposed to be instant and
local. v1.0.0 separates the two: bans are queued in SQLite and reported by a
scheduled worker.

Highlights

• Fail2ban action abuseipdb-async with norestored = 1 - no duplicate
  reports after a fail2ban restart.
• Durable local queue (SQLite, WAL) with deduplication of repeated bans.
• Scheduled worker - systemd timer every 16 minutes, or cron; missed runs are
  caught up after downtime.
• Evidence-backed comments - attack type, time window, ban duration, failure
  counts, generic patterns and the attacker's own request URLs, read from
  fail2ban's own database. No log scraping, no shell interpolation.
• Correct AbuseIPDB categories per jail; SQL-injection attempts add category
  16 automatically.
• Privacy by design - no attempted usernames, no mail content, no client
  domains in reports.
• Self-advertising footer - every report ends with a configurable credit
  (Reported via Fail2Ban_AbuseIPDB Monitor: ...), appended after truncation
  so it is always visible; disable it with attribution = no.
• Rate-limit aware - one report per IP per 20 minutes, 900/day, 25/run.
• Production installer - backups, fail2ban-client -t gate, staging mode,
  idempotent upgrade, state-driven uninstall and --purge.
• Zero dependencies - Python standard library only.
• Tested - 57 unit tests, an end-to-end integration test against a mock API,
  shellcheck and a staged install/uninstall job in CI.

Requirements

Linux, Python 3.9+, Fail2Ban 0.10+, root, and a free
AbuseIPDB API key.

Install

git clone https://github.com/paulmann/Fail2Ban_AbuseIPDB.git
cd Fail2Ban_AbuseIPDB
sudo ./install.sh --api-key "YOUR_ABUSEIPDB_API_KEY" \
  --jails "sshd nginx-attack-scan nginx-wp-login proftpd"

Full documentation: README.md,
docs/INSTALL.md,
docs/CONFIGURATION.md.