# The interface to listen
$params["iface"] = "eth0"

# logfile to look for authenticated IPs
# Authlog format is simple: 1 IP address per line. Our script will "tail -f" on the logfile
# Example on how to get such a logfile out of Apache:
#   SecRule REQUEST_URI "^/auth/login.do" "phase:5,log,auditlog,pass,chain"
#   SecRule RESPONSE_HEADERS:Location "/app/app.do$" "setenv:doauthlog=true"
#   CustomLog		/tmp/auth.log "%h" env=doauthlog
$params["auth-log"] = "/tmp/auth.log" 

# The ports to monitor (space separated)
$params["ports"] = "80 443"

# tcpdump commando
$params["tcpdump_cmd_base"] = "/usr/sbin/tcpdump -q -l -n -i #{$params['iface']} \'__PORTS__ and tcp[13] & 2 != 0 and tcp[13] & 16 != 0\' 2>/dev/null"

# netstat commando
$params["netstat_cmd_base"] = "/bin/netstat -n --tcp | egrep '__PORTS__.*(SYN_RECV|ESTABLISHED)'"

# Timeout limits
$params["basetimeout"] = 5
$params["timeoutconditions"] = <<EOF
port:443 40
port:80 10
auth:auth 50
auth:auth port:443 60
country:CH 70
country:CH auth:auth 80
country:CH auth:auth port:443 90
EOF

# Connection limits
$params["basemaxconnection"] = 10
$params["maxconnectionconditions"] = <<EOF
country:CH 40
auth:auth 50
country:CH auth:auth 80
EOF

# Time to sleep after every netstat call in secs
# Sane values are 5 or 10 or even 60
# Low values lead to more CPU usage
$params["sleeptime"] = 5

# Path to GeoIP DB
$params["geoip-db"] = "/usr/share/GeoIP/GeoIP.dat"  

# Ignore-IP regex
$params["ignore-ip-regex"] = /^(194.41|172.[12]7|172.[23]1|127.0.0.1)/


