[INCLUDES]

before = paths-arch.conf

[DEFAULT]

# ignorecommand = /path/to/command <ip>
ignorecommand =

# "bantime" is the number of seconds that a host is banned.
bantime  = 10m

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 10m

# "maxretry" is the number of failures before a host get banned.
maxretry = 3

# "maxmatches" is the number of matches stored in ticket (resolvable via tag <matches> in actions).
maxmatches = %(maxretry)s

backend = auto
usedns = warn
logencoding = auto
enabled = false
mode = normal

filter = %(__name__)s[mode=%(mode)s]


#
# ACTIONS
#

destemail = [email protected]
sender = [email protected]

mta = mail
protocol = tcp
chain = <known/chain>
port = 0:65535

fail2ban_agent = Fail2Ban/%(fail2ban_version)s

#
# Action shortcuts. To be used to define action parameter

banaction = iptables-multiport
banaction_allports = iptables-allports

# The simplest action to take: ban only
action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

# custom action
action_cust = %(action_)s
            mail-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]

action = %(action_)s


#
# JAILS
#

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
enabled = true
port    = 31222
logpath = %(sshd_log)s
backend = %(sshd_backend)s
action = %(action_cust)s