[PATCH 1/2] sources: Replacement of Feodo Recommended Tracker list to ipblocklist sources file

[PATCH 1/2] sources: Replacement of Feodo Recommended Tracker list to ipblocklist sources file

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 2330 bytes --]

- FEODO_RECOMMENDED list is still being updated but the number of events can be very
   low. However as it is still active then it has been added back in as discussed in
   the Dev Conf Call on Nov 4th.
- FEODO_IP list covers any IP that has been detected as a botnet in the last 30 days.
   This could lead to false positives if the botnet has been fixed within one day of
   being detected. So it was agreed that this list would stay removed.
- FEODO_AGGRESSIVE list contains all IP's that havce ever been detected as botnets since
   the list was started. It is not intended to be used for blocking as it would have a
   huge false positive effect. This list will also stay removed as it should not have
   been included originally.
- This patch set adds back in the FEODO_RECOMMENDED list into the sources file and in the
   associated patch for the update.sh file removes the lines that removed the files
   related to FEODO_RECOMMENDED.

Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
 config/ipblocklist/sources | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index c2fc40d5b..158c8bc20 100644
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -61,6 +61,12 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
                                     'parser'   => 'dshield',
                                     'rate'     => '1h',
                                     'category' => 'attacker' },
+             'FEODO_RECOMMENDED'=> {'name'     => 'Feodo Trojan IP Blocklist (Recommended)',
+                                    'url'      => 'https://feodotracker.abuse.ch/downloads/ipblocklist_recommended.txt',
+                                    'info'     => 'https://feodotracker.abuse.ch/blocklist',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '5m',
+                                    'category' => 'c and c' },
              'CIARMY'          => { 'name'     => 'The CINS Army List',
                                     'url'      => 'https://cinsscore.com/list/ci-badguys.txt',
                                     'info'     => 'https://cinsscore.com/#list',
-- 
2.47.1

[PATCH 2/2] update.sh: Remove the lines related to FEODO_RECOMMENDED

[Adolf Belka]

[-- Attachment #1: Type: text/plain, Size: 1459 bytes --]

- This removes the lines related to removing any time entries in the modified file for
   FEODO_RECOMMENDED.
- This also removes the lines realted to removing the blocklists for the
   FEODO_RECOMMENDED sources from the /var/lib/ipblocklist directory.
- This patch will ensure that FEODO_RECOMMENDED stays in place if it was being used.

Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org>
---
 config/rootfiles/core/191/update.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/config/rootfiles/core/191/update.sh b/config/rootfiles/core/191/update.sh
index f1c254611..366239bdd 100644
--- a/config/rootfiles/core/191/update.sh
+++ b/config/rootfiles/core/191/update.sh
@@ -36,14 +36,10 @@ done
 # Extract files
 extract_files
 
-# Remove any entry for FEODO_RECOMMENDED, FEODO_IP or FEODO_AGGRESSIVE from the ipblocklist
+# Remove any entry for FEODO_IP or FEODO_AGGRESSIVE from the ipblocklist
 # modified file and the associated ipblocklist files from the /var/lib/ipblocklist directory
-sed -i '/FEODO_RECOMMENDED=/d' /var/ipfire/ipblocklist/modified
 sed -i '/FEODO_IP=/d' /var/ipfire/ipblocklist/modified
 sed -i '/FEODO_AGGRESSIVE=/d' /var/ipfire/ipblocklist/modified
-if [ -e /var/lib/ipblocklist/FEODO_RECOMMENDED.conf ]; then
-	rm /var/lib/ipblocklist/FEODO_RECOMMENDED.conf
-fi
 if [ -e /var/lib/ipblocklist/FEODO_IP.conf ]; then
 	rm /var/lib/ipblocklist/FEODO_IP.conf
 fi
-- 
2.47.1