| | |
|---|
| | | [DEFAULT] |
|---|
| | | # 24h + 5min |
|---|
| | | # Time to keep banned a bad ip |
|---|
| | | watch_while = 86700 |
|---|
| | | # Duration (in sec) to keep banned a bad ip, reduce value if too much memory consumption |
|---|
| | | watch_while = 3602 |
|---|
| | | # Max tries before being banned |
|---|
| | | maxtries = 3 |
|---|
| | | # pf table to keep bad IP. |
|---|
| | |
|---|
| | | |
|---|
| | | ### Ip ignored ### |
|---|
| | | [ignoreip] |
|---|
| | | ip1 = 92.150.160.157 |
|---|
| | | ip2 = 92.150.160.156 |
|---|
| | | ip1 = 127.0.0.1 |
|---|
| | | |
|---|
| | | ### Guardians |
|---|
| | | #[name of the guardian] |
|---|
| | |
|---|
| | | logfile = /var/log/authlog |
|---|
| | | regex = .* Connection closed by ([\S]+) .* |
|---|
| | | |
|---|
| | | [ssh3] |
|---|
| | | logfile = /var/log/authlog |
|---|
| | | regex = .* Invalid user \w+ ([\S]+) .* |
|---|
| | | #[ssh3] |
|---|
| | | #logfile = /var/log/authlog |
|---|
| | | #regex = .* Invalid user \w+ from ([\S]+) .* |
|---|
| | | |
|---|
| | | [ssh4] |
|---|
| | | logfile = /var/log/authlog |
|---|
| | |
|---|
| | | [smtp] |
|---|
| | | logfile = /var/log/maillog |
|---|
| | | regex = .* event=failed-command address=([\S]+) .* |
|---|
| | | maxtries = 2 |
|---|
| | | |
|---|
| | | [dovecot] |
|---|
| | | logfile = /var/log/maillog |
|---|
| | | regex = .*auth failed.*rip=([\S]+),.* |
|---|
| | | maxtries = 2 |
|---|
| | | |
|---|
| | | [wordpress] |
|---|
| | | # don't use if you have wordpress |
|---|
| | | logfile = /var/www/logs/access.log |
|---|
| | | regex = (?:\S+\s){1}(\S+).*wp-login.php.* |
|---|
| | | maxtries = 1 |
|---|
| | | |
|---|
| | | # Nextcloud: login page |
|---|
| | | # Nextcloud 12 brings protection against brute-force attacks |
|---|
