[DEFAULT]
# 24h + 5min
# Time to keep banned a bad ip
watch_while = 86700 
# Max tries before being bannes
maxtries = 3
# pf table to keep bad IP.
# remember to clean the table with this command in a cron job :
#     pfctl -t vilain_bruteforce -T expire 86400
vilain_table = vilain_bruteforce

### Guardians
#[name of the guardian]
#logfile = /file/to/watch
#regex = regex that return the bad guy IP

[ssh]
logfile = /var/log/authlog
regex = .* Failed .* from ([\S]+) .*

[ssh2]
logfile = /var/log/authlog
regex = .* Connection closed by ([\S]+) .*