###########################################################################

# $Id$

###########################################################################

# You can put comments anywhere you want to.  They are effective for the

# rest of the line.

# this is in the format of <name> = <value>.  Whitespace at the beginning

# and end of the lines is removed.  Whitespace before and after the = sign

# is removed.  Everything is case *insensitive*.

# Yes = True  = On  = 1

# No  = False = Off = 0

Title = "SSHD"

# Which logfile group...

LogFile = secure

LogFile = messages

# Only give lines pertaining to the sshd service...

*OnlyService = sshd

*RemoveHeaders

# Variable $sshd_ignore_host is used to filter out hosts that login

# successfully.  This commented-out example filters out reserved local

# addresses (IETF RFC 1918 and RFC 3330).

#$sshd_ignore_host="^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\."

# The refused connections report lists every ip that is refused even if

# it was only refused 1 or 2 times.  In a case like that I don't care

# to see the information.  It is just noise.  I want to know when a

# a connection has been refused 10, 20, 30 times because that is an

# indication of an attack or a problem.

#   Set this variable to a positive integer to trim out the lower count

# refused connections from the report. i.e. 10 would not show any hosts

# with less than 10 refusals.

#   This has no effect if the $Detail variable is greater than 5.

#$refused_connections_threshold = 10

########################################################

# This was written and is maintained by:

#    Kirk Bauer <kirk@kaybee.org>

#

# Please send all comments, suggestions, bug reports,

#    etc, to kirk@kaybee.org.

########################################################

# vi: shiftwidth=3 tabstop=3 et