config.ini

[general]

[local]
# What named set gets used for local bans?
set-name = inet filter localban
# What file gets watched for auth failures?
file = /var/log/auth.log
# Which redis db number should be used?
db = 2
# How long after a failed attempt is an IP tracked/banned?
timeout = 90909
# How many failures before an IP is banned?
limit = 5

[net]
# What named set gets used for net bans?
set-name = inet filter netban
# Where is the Elasticsearch instance?
elastic-host = 10.0.0.25:9200
# What index pattern do we query in Elastic?
elastic-index = syslog-*
# Across how many days are the top networks aggregated? (In Elasticsearch timespan format.)
distance = 7d
# How many different IPs before a network is banned?
limit = 10
# What field aggregates a network?
aggregate = asn.asn
# What field do we count?
cardinality = asn.ip
# What terms field contains the value to filter for?
filter-field = ssh_action
# What value in the filter-field indicates a failure?
filter-term = Failed
# How many buckets do we pull from Elastic?
buckets = 10
# How often do we refresh the list of nets from Elastic? (seconds)
interval = 3600
# If the Elastic query fails, how long before we try again? (seconds)
retry-interval = 600