Guardian Paket angefangen, zum Testen muss Snort funktionieren ...

[people/pmueller/ipfire-2.x.git] / config / guardian / guardian.conf

diff --git a/config/guardian/guardian.conf b/config/guardian/guardian.conf
new file mode 100644 (file)
index 0000000..9181496
--- /dev/null
+++ b/config/guardian/guardian.conf
@@ -0,0 +1,33 @@
+# The machines IP address that is visable to the internet
+# If this is left undefined, then guardian will attempt to get the information
+# from ifconfig, as long as it has an interface to use. This would be useful
+# for people on ppp links, or dhcp machines, or if you are lazy :)
+# HostIpAddr       
+
+# Here we define the interface which we will use to guess the IP address, and
+# block incoming offending packets. This is the only option that is required
+# for guardian to run. If the rest are undefined, guardian will use the default.
+Interface       ppp0
+
+# The last octet of the ip address, which gives us the gateway address.
+HostGatewayByte  1
+
+# Guardian's log file
+LogFile         /var/log/guardian/guardian.log
+
+# Snort's alert file. This can be the snort.alert file, or a syslog file
+# There might be some snort alerts that get logged to syslog which guardian 
+# might not see.. 
+AlertFile       /var/log/snort/alert
+
+# The list of ip addresses to ignore
+IgnoreFile      /var/ipfire/guardian.ignore
+
+# This is a list of IP addresses on the current host, in case there is more
+# than one. If this file doesn't exist, then it will assume you want to run
+# with the default setup (machine's ip address, and broadcast/network). 
+TargetFile      /var/ipfire/guardian.target
+
+# The time in seconds to keep a host blocked. If undefined, it defaults to 
+# 99999999, which basicly disables the feature. 
+TimeLimit      86400