56 lines
2.5 KiB
Markdown
56 lines
2.5 KiB
Markdown
# Security & anti-abuse (services)
|
|
|
|
echo services runs a native anti-abuse engine in its core. It observes network activity, scores it
|
|
against configurable detectors, and can act (kill / ban) — or, by default, only report. It is
|
|
separate from the daemon's [layered anti-abuse](/docs/security).
|
|
|
|
> **Arm it carefully.** `report_only` defaults to **true** (detect and alert only). Before setting it
|
|
> false, make sure `exempt_ips` covers loopback and your trusted hosts — otherwise an over-eager
|
|
> detector could ban your own services or bots.
|
|
|
|
## [security] — engine core
|
|
|
|
| Key | Description |
|
|
| --- | --- |
|
|
| `enabled` | Master switch |
|
|
| `report_only` | Detect & alert only, never kill/ban (default **true**) |
|
|
| `exempt_ips` | IP masks exempt from enforcement (defaults to loopback) |
|
|
| `exempt_opers` / `exempt_accounts` / `exempt_voice` | Exempt operators (default on) / logged-in accounts (off) / voiced users (on) |
|
|
| `announce_permit` / `announce_life` | Rate limit on abuse announcements |
|
|
| `cascade_permit` / `cascade_life` | Correlated-event (cascade) detection thresholds |
|
|
| `netsplit_grace` | Grace period after a netsplit before enforcing |
|
|
|
|
The OperServ [`DEFCON`](/docs/operserv) command raises the network defence level on top of this.
|
|
|
|
## [security.connect] — connection floods
|
|
|
|
`enabled`, `flood_permit` / `flood_life` (connects per source in a window), `range_permit` /
|
|
`range_life` (per IP range), `ban_duration`.
|
|
|
|
## [security.behavior] — behavioural abuse
|
|
|
|
Nick flooding, join/part cycling, mass-join, quit floods, and channel crawling:
|
|
`nick_permit`/`nick_life`, `cycle_permit`/`cycle_life`, `joinpart_permit`/`joinpart_life`/`joinpart_grace`,
|
|
`massjoin_permit`/`massjoin_life`, `quit_permit`/`quit_life`/`quit_reasons`, `crawl_permit`/`crawl_life`,
|
|
`ban_duration`.
|
|
|
|
## [security.content] — message content
|
|
|
|
Highlight spam, bad Unicode, and repeats:
|
|
`highlight_nicks`/`highlight_min_len`/`highlight_permit`/`highlight_life`,
|
|
`badunicode_score`/`badunicode_min`/`badunicode_permit`/`badunicode_life`,
|
|
`repeat_min`/`repeat_permit`/`repeat_life`, `ban_duration`.
|
|
|
|
## [security.auth] — auth abuse
|
|
|
|
Login and registration flooding, ban evasion: `fail_permit`/`fail_life`,
|
|
`register_permit`/`register_life`, `evade_ttl`, `ban_duration`.
|
|
|
|
## [[security.pattern]] — custom connect masks (repeatable)
|
|
|
|
`mask`, `field` (which connection field to match), `regex` (treat the mask as a regex), `reason`,
|
|
`ban` (duration).
|
|
|
|
## [security.mxbl] — email MX/IP blocklist
|
|
|
|
Screens registration email domains: `enabled`, `resolver`, `mx_globs`, `ip_cidrs`, `timeout_ms`.
|