mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-09-13 03:45:11 +08:00
47 lines
2.3 KiB
Plaintext
47 lines
2.3 KiB
Plaintext
# AuthShield Configuration File
|
|
# Location: /etc/config/authshield
|
|
#
|
|
# This file configures AuthShield's intrusion prevention system for OpenWrt.
|
|
# AuthShield monitors failed login attempts for LuCI/rpcd and optionally Dropbear SSH,
|
|
# temporarily banning offending IPs and implementing circuit breaker protection.
|
|
#
|
|
# After modifying this file, reload the service:
|
|
# /etc/init.d/authshield reload
|
|
#
|
|
# Or configure via LuCI web interface at: System > AuthShield
|
|
|
|
config settings
|
|
# Main switch - disables all AuthShield functionality when set to '0'
|
|
option enabled '0'
|
|
|
|
# Basic ban settings
|
|
option threshold '5' # Failed attempts before IP ban
|
|
option window '10' # Time window in seconds for counting failures
|
|
option penalty '60' # Ban duration in seconds
|
|
option ports '80 443' # Protected ports (space-separated)
|
|
option watch_dropbear '0' # Monitor Dropbear SSH (0=no, 1=yes)
|
|
option ignore_private_ip '1' # Skip banning private/LAN IPs (0=no, 1=yes)
|
|
|
|
# Escalation settings (frequent offenders get longer bans)
|
|
option escalate_enable '1'
|
|
option escalate_threshold '5' # Number of bans within window to trigger escalation
|
|
option escalate_window '3600' # Escalation window (1 hour)
|
|
option escalate_penalty '86400' # Escalation ban duration (24 hours)
|
|
|
|
# Global rule settings (long-term tracking across all attempts)
|
|
option global_enable '1'
|
|
option global_threshold '60' # Failures within window that trigger global ban
|
|
option global_window '43200' # Global window (12 hours)
|
|
option global_penalty '86400' # Global ban duration (24 hours)
|
|
|
|
# Circuit breaker settings (blocks WAN access during mass attacks)
|
|
option circuit_enable '1'
|
|
option circuit_threshold '120' # Total failures across all IPs to trigger lockdown
|
|
option circuit_window '43200' # Circuit window (12 hours) - also acts as "memory"
|
|
option circuit_penalty '3600' # WAN block duration (1 hour) - unlocks automatically via nftables timeout
|
|
|
|
# Note: Circuit breaker automatically unlocks after circuit_penalty seconds.
|
|
# The circuit_window acts as a "memory" - if attackers resume attempts after unlock,
|
|
# and total failures still exceed circuit_threshold, the circuit will immediately re-lock.
|
|
# This provides extended protection without requiring manual intervention.
|