ddos.conf

##### 7/21/2012 - Colin Mollenhour (colin@mollenhour.com)
#####   - Added WARN_LIMIT feature
#####   - Added LOG_FILE feature

##### Paths of the script and other files
PROGDIR="/usr/local/ddos"
PROG="$PROGDIR/ddos.sh"
IGNORE_IP_LIST="$PROGDIR/ignore"
CRON="/etc/cron.d/ddos.cron"
APF="/etc/apf/apf"
IPT="/sbin/iptables"

##### frequency in minutes for running the script
##### Caution: Every time this setting is changed, run the script with --cron
#####          option so that the new frequency takes effect
FREQ=1

##### How many connections define a bad IP? Indicate that below.
BAN_LIMIT=150

##### How many connections to warn about? No effect if greater or equal to BAN_LIMIT
WARN_LIMIT=70

##### APF_BAN=1 (Make sure your APF version is atleast 0.96)
##### APF_BAN=0 (Uses iptables for banning ips instead of APF)
APF_BAN=0

##### KILL=0 (Bad IPs are'nt banned, good for interactive execution of script)
##### KILL=1 (Recommended setting)
KILL=1

##### Specify a file to log bans/warns to
LOG_FILE="$PROGDIR/ddos.log"

##### An email is sent to the following address when an IP is banned.
##### Blank would suppress sending of mails
EMAIL_TO=""

##### Run a custom command after an IP has been banned
##### Leave blank to skip
AFTER_BAN=""

##### Number of seconds the banned ip should remain in blacklist.
BAN_PERIOD=600