Loading
Integrate ConfigServer Security & Firewall with SikkerAPI for two-way threat intelligence. Pull the community blacklist to pre-emptively block known malicious IPs via csf.blocklists, and automatically report attacks detected by CSF back to the threat database via BLOCK_REPORT. Unlike other blocklist providers, SikkerAPI is powered by first-party honeypot data across 16 protocols with advanced filtering by country, ASN, protocol, and severity.
Add one line to /etc/csf/csf.blocklists to pre-emptively block known malicious IPs. CSF refreshes the list automatically at the interval you specify. The plaintext=true parameter returns one IP per line — the format CSF expects. See the Blacklist API for the full endpoint reference.
When CSF blocks an IP, it can automatically report the attack to SikkerAPI using the BLOCK_REPORT feature. The report script maps CSF triggers (like LF_SSHD) to SikkerAPI categories and submits them via the Report API. Only the IP, category, and protocol are sent — no log data leaves your server.
The report script automatically maps CSF trigger names to SikkerAPI categories and protocols. Unrecognized triggers default to other with no protocol.
Customize your blocklist URL with query parameters to filter by country, protocol, severity, ASN, and IP version. All parameters are optional. See the Blacklist API for the full parameter reference and response format.
Blocklist requests and report submissions have separate daily quotas. Daily refreshes (86400s interval) stay well within limits for all tiers. If the report quota is exhausted, CSF still blocks the IP locally — only the report to SikkerAPI is skipped. Multiple servers should use separate API keys or upgrade your tier.
After setup, verify both the blocklist and reporting are working. Reported IPs appear in the IP Check response under the contributor section.
Common issues and how to resolve them. You can always test the report script manually to isolate whether the issue is with CSF configuration or API connectivity.
The report script at /usr/local/bin/sikkerapi-csf-report reads your API key from /etc/csf/sikkerapi.key (or the SIKKERAPI_KEY environment variable), maps the CSF trigger to a category, and submits the report with a 10-second timeout. Logs all activity to syslog under the sikkerapi tag.