diff options
| author | info@mode42.com <info@mode42.com> | 2026-08-08 03:54:55 +0000 |
|---|---|---|
| committer | info@mode42.com <info@mode42.com> | 2026-08-08 03:54:55 +0000 |
| commit | 20cb29c2f8c5c87bc590896854a20b1473ceb358 (patch) | |
| tree | 2857f41513a56ad41af97b57362639298aa7f033 /docs/SECURITY.md | |
#2
Diffstat (limited to 'docs/SECURITY.md')
| -rw-r--r-- | docs/SECURITY.md | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/docs/SECURITY.md b/docs/SECURITY.md new file mode 100644 index 0000000..ed0b3f0 --- /dev/null +++ b/docs/SECURITY.md @@ -0,0 +1,38 @@ +# Security · HyBBX 2.8.0 + +Built-in `[security]` — network protection and abuse in one subsystem. + +## Layer matrix + +| Layer | What | Ban? | +|-------|------|------| +| **Soft limits** | RF pacing, message size, traffic shaping | **No** | +| **Abuse** | Brute-force, connection flood, excessive spam | **Yes** — short IP/CALLID cool-down | + +## Soft limit matrix + +| Area | Keys | Effect | +|------|------|--------| +| `[traffic]` | `baud`, `pace_output`, `line_width` | Output pacing | +| `[chat]` | `message_max` | Truncate oversized lines | +| `[mail]` | `max_messages`, `body_max` | Mailbox caps | +| AX.25 broadcast | fixed | Min 900 s auto cycle; 60 s between links | + +## Ban trigger matrix + +| Target | Event | Default threshold | +|--------|-------|-------------------| +| **IP** | `login_fail` | 5 / 10 min | +| **IP** | `link_auth_fail` | 5 / 10 min | +| **IP** | `rate_limit` | 30 / 60 s | +| **CALLID** | `link_auth_fail` | same as login | +| **CALLID** | `ban_callid=` config | immediate, permanent | + +CALLID = AX.25 callsign or HBX `link_id`. Optional `iptables`/`nftables` via `ban_backend`. + +## Related + +| Goal | Doc | +|------|-----| +| Manual `[security]` | [MANUAL.md](MANUAL.md) | +| Topology link auth | [TOPOLOGY.md](TOPOLOGY.md) | |