# SPDX-License-Identifier: AGPL-3.0-only
#
# The ladder the ssh rule climbs. A first offence is six hours — sshd is
# nobody's door but the administrator's, and an address that failed
# three times in five minutes is not the administrator. One that comes
# back after its ban ran out has proved it means it, and climbs; the
# last rung repeats for ever. Quiet for thirty days after a ban ENDED
# (never after it started) and the next offence starts at the bottom.
#
# tighten: each past episode within decay also halves the hits the rule
# needs — the second visit convicts on 2 of 3, the third on 1. Remove
# the line to keep the thresholds fixed.
policy: ssh
durations: [6h, 24h, 7d]
ports: service
memory: 30d
tighten: 2x
