{
  "interval": "30s",
  "audit_interval": "1h",
  "state_path": "/var/lib/banhack233/state.json",
  "dry_run": true,
  "start_at_end": true,
  "ignore_ips": [
    "127.0.0.1",
    "::1"
  ],
  "rules": [
    {
      "name": "ssh-auth-failure",
      "log_paths": [
        "/var/log/auth.log",
        "/var/log/secure"
      ],
      "patterns": [
        "Failed password for(?: invalid user)? (?P<user>\\S+) from <HOST>"
      ],
      "reset_patterns": [
        "Accepted (?:password|publickey|keyboard-interactive) for (?P<user>\\S+) from <HOST>"
      ],
      "max_attempts": 5,
      "find_time": "10m",
      "ban_time": "1h",
      "action": "auto",
      "count_by_user": true,
      "success_grace": "10m"
    }
  ],
  "hardening": {
    "ssh": {
      "enabled": true,
      "password_authentication": true,
      "permit_root_login": "yes",
      "allowed_users": [],
      "max_auth_tries": 3,
      "login_grace_time": "20s",
      "client_alive_interval": 300,
      "client_alive_count_max": 2,
      "disable_empty_passwords": true,
      "disable_challenge_response": true
    }
  },
  "logging": {
    "enabled": true,
    "path": "/var/lib/banhack233/banhack233.log",
    "max_size_mb": 10,
    "max_age_days": 30
  },
  "geoip": {
    "enabled": true,
    "db_path": "/var/lib/banhack233/ip2region_v4.xdb"
  },
  "malware": {
    "enabled": true,
    "direct_kill": false,
    "report_dir": "/var/lib/banhack233/reports",
    "report_keep": 50
  },
  "notifications": {
    "console": true,
    "audit": false,
    "batch": {
      "enabled": true,
      "interval": "60s",
      "max_items": 20
    },
    "feishu": {
      "enabled": false,
      "url": "https://open.feishu.cn/open-apis/bot/v2/hook/xxx",
      "secret": "your-feishu-sign-secret",
      "location_language": "zh-CN"
    },
    "discord": {
      "enabled": false,
      "url": "https://discord.com/api/webhooks/xxx/yyy"
    },
    "slack": {
      "enabled": false,
      "url": "https://hooks.slack.com/services/xxx/yyy/zzz"
    },
    "webhooks": [
      {
        "name": "custom-json",
        "enabled": false,
        "url": "https://example.com/webhook",
        "format": "json",
        "headers": {
          "Authorization": "Bearer token"
        }
      }
    ],
    "email": {
      "enabled": false,
      "from": "alerts@example.com",
      "to": "admin@example.com",
      "password": "smtp-authorization-code",
      "smtp_host": "smtp.example.com",
      "smtp_port": 465
    },
    "telegram": {
      "enabled": false,
      "bot_token_env": "BANHACK233_TELEGRAM_BOT_TOKEN",
      "chat_id": ""
    },
    "language": "zh-CN",
    "timezone": "Local"
  },
  "ssh_ports": [
    22
  ]
}