[DEFAULT]
|
# 24h + 5min
|
# Time to keep banned a bad ip
|
watch_while = 86700
|
# Max tries before being bannes
|
maxtries = 3
|
# pf table to keep bad IP.
|
# remember to clean the table with this command in a cron job :
|
# pfctl -t vilain_bruteforce -T expire 86400
|
vilain_table = vilain_bruteforce
|
|
### Guardians
|
#[name of the guardian]
|
#logfile = /file/to/watch
|
#regex = regex that return the bad guy IP
|
|
[ssh]
|
logfile = /var/log/authlog
|
regex = .* Failed .* from ([\S]+) .*
|
|
[ssh2]
|
logfile = /var/log/authlog
|
regex = .* Connection closed by ([\S]+) .*
|
