# Security & anti-abuse (services)

echo services runs a native anti-abuse engine in its core. It observes network activity, scores it
against configurable detectors, and can act (kill / ban) — or, by default, only report. It is
separate from the daemon's [layered anti-abuse](/docs/security).

> **Arm it carefully.** `report_only` defaults to **true** (detect and alert only). Before setting it
> false, make sure `exempt_ips` covers loopback and your trusted hosts — otherwise an over-eager
> detector could ban your own services or bots.

## [security] — engine core

| Key | Description |
| --- | --- |
| `enabled` | Master switch |
| `report_only` | Detect & alert only, never kill/ban (default **true**) |
| `exempt_ips` | IP masks exempt from enforcement (defaults to loopback) |
| `exempt_opers` / `exempt_accounts` / `exempt_voice` | Exempt operators (default on) / logged-in accounts (off) / voiced users (on) |
| `announce_permit` / `announce_life` | Rate limit on abuse announcements |
| `cascade_permit` / `cascade_life` | Correlated-event (cascade) detection thresholds |
| `netsplit_grace` | Grace period after a netsplit before enforcing |

The OperServ [`DEFCON`](/docs/operserv) command raises the network defence level on top of this.

## [security.connect] — connection floods

`enabled`, `flood_permit` / `flood_life` (connects per source in a window), `range_permit` /
`range_life` (per IP range), `ban_duration`.

## [security.behavior] — behavioural abuse

Nick flooding, join/part cycling, mass-join, quit floods, and channel crawling:
`nick_permit`/`nick_life`, `cycle_permit`/`cycle_life`, `joinpart_permit`/`joinpart_life`/`joinpart_grace`,
`massjoin_permit`/`massjoin_life`, `quit_permit`/`quit_life`/`quit_reasons`, `crawl_permit`/`crawl_life`,
`ban_duration`.

## [security.content] — message content

Highlight spam, bad Unicode, and repeats:
`highlight_nicks`/`highlight_min_len`/`highlight_permit`/`highlight_life`,
`badunicode_score`/`badunicode_min`/`badunicode_permit`/`badunicode_life`,
`repeat_min`/`repeat_permit`/`repeat_life`, `ban_duration`.

## [security.auth] — auth abuse

Login and registration flooding, ban evasion: `fail_permit`/`fail_life`,
`register_permit`/`register_life`, `evade_ttl`, `ban_duration`.

## [[security.pattern]] — custom connect masks (repeatable)

`mask`, `field` (which connection field to match), `regex` (treat the mask as a regex), `reason`,
`ban` (duration).

## [security.mxbl] — email MX/IP blocklist

Screens registration email domains: `enabled`, `resolver`, `mx_globs`, `ip_cidrs`, `timeout_ms`.