# You can put comments anywhere you want to.  They are effective for the
# rest of the line.

# this is in the format of <name> = <value>.  Whitespace at the beginning
# and end of the lines is removed.  Whitespace before and after the = sign
# is removed.  Everything is case *insensitive*.

# Yes = True  = On  = 1
# No  = False = Off = 0

Title = "Dropbear"

# Which logfile group...
LogFile = secure
LogFile = messages

# Only give lines pertaining to the dropbear service...
*OnlyService = dropbear
*RemoveHeaders

# Variable $ignore_host is used to filter out hosts that login
# successfully.  This commented-out example filters out reserved local
# addresses (IETF RFC 1918 and RFC 3330).
#$ignore_host="^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\."

# The refused connections report lists every ip that is refused even if
# it was only refused 1 or 2 times.  In a case like that I don't care
# to see the information.  It is just noise.  I want to know when a
# a connection has been refused 10, 20, 30 times because that is an
# indication of an attack or a problem.
#   Set this variable to a positive integer to trim out the lower count
# refused connections from the report. i.e. 10 would not show any hosts
# with less than 10 refusals.
#   This has no effect if the $Detail variable is greater than 5.
#$refused_connections_threshold = 10

# Setting the $illegal_users_threshold variable limits the listing of
# "Illegal Users" from those IP addresses that have more than the
# specified threshold
#$illegal_users_threshold = 4

# Set to No to disable IP lookups
$ip_lookup = Yes

# vi: shiftwidth=3 tabstop=3 et