From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4bm2wz4Fk8z30NY for ; Mon, 21 Jul 2025 14:34:59 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) client-signature RSA-PSS (4096 bits)) (Client CN "mail01.haj.ipfire.org", Issuer "R11" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4bm2ww0StKz2ybf for ; Mon, 21 Jul 2025 14:34:56 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4bm2wv2L1szkM; Mon, 21 Jul 2025 14:34:55 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1753108495; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=4cr0jlxa33OcUYoSn4LZdEfN8yJmwiMokUv/0rF+v40=; b=076FcdkL3qcBrZQc7AFj2TfmbRkrlYqvZSaN0vHgCpupSGE7U971+05OQWtnDYrhPJW9Sj SIV9JLSx4LK08yBQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1753108495; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=4cr0jlxa33OcUYoSn4LZdEfN8yJmwiMokUv/0rF+v40=; b=tijh5YG3fgrlS8CQ6YzdtSZAkzF2eCieOGytORR2lSC6nxfGCOEdyB3cN5dPJJTmX2mHxY pnPzdohF6kgfsGwPSefpPyfmJN4cfcyvqQaHowG4WBJeDopz6rzWmUpRm3zL9bcG8C5zIo a8p/1jq/pIf/OQLSqWSa5rGsx1nxT9jjcMs7x59h12s3x/jEkc5a/FB5a4ZScTDYbLawmr z07HEvedNCPcTEORha3lHzIQ7+xEq/GbGHZURnjEkGG5Y7U2+V1TH+iLa4dEcpNw7doRGN lGBsa8wj16nl1cGwG27Oy+Qj4E+DHPdGNRpGiUs6s9tjUrjA7OMv9IaocEdl+g== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] ruleset-sources: Remove the abuse.ch SSL list from the suricata sources Date: Mon, 21 Jul 2025 16:34:52 +0200 Message-ID: <20250721143452.3384666-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit - The abuse.ch ssl suricata list has stopped being updated since 2025-06-25 - Looking at all of the abuse.ch lists, none of them are being updated anymore so abuse.ch becoming part of spamhaus looks to have stopped all work on free versions of the lists - This change modifies the abuse.ch entry so that it no longer can be installed but also if already installed it will remove it. - The patch has also made a few minor typo corrections in comments. Signed-off-by: Adolf Belka --- config/suricata/ruleset-sources | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources index 4e9ea5fa9..b843d3e49 100644 --- a/config/suricata/ruleset-sources +++ b/config/suricata/ruleset-sources @@ -27,7 +27,7 @@ our %Providers = ( dl_type => "archive", }, - # Ruleset for registered sourcefire users with a valid subsription. + # Ruleset for registered sourcefire users with a valid subscription. subscripted => { summary => "Talos VRT rules with subscription", website => "https://www.snort.org", @@ -47,7 +47,7 @@ our %Providers = ( dl_type => "archive", }, - # Emerging threads community rules. + # Emerging threats community rules. emerging => { summary => "Emergingthreats.net Community Rules", website => "https://emergingthreats.net/", @@ -57,7 +57,7 @@ our %Providers = ( dl_type => "archive", }, - # Emerging threads Pro rules. + # Emerging threats Pro rules. emerging_pro => { summary => "Emergingthreats.net Pro Rules", website => "https://emergingthreats.net/", @@ -72,9 +72,6 @@ our %Providers = ( summary => "Abuse.ch SSLBL Blacklist Rules", website => "https://sslbl.abuse.ch/", tr_string => "sslbl blacklist rules", - requires_subscription => "False", - dl_url => "https://sslbl.abuse.ch/blacklist/sslblacklist.rules", - dl_type => "plain", }, # Etnetera Aggressive Blacklist. -- 2.50.1