From 20cb29c2f8c5c87bc590896854a20b1473ceb358 Mon Sep 17 00:00:00 2001 From: "info@mode42.com" Date: Sat, 8 Aug 2026 03:54:55 +0000 Subject: #2 --- docs/SECURITY.md | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 docs/SECURITY.md (limited to 'docs/SECURITY.md') diff --git a/docs/SECURITY.md b/docs/SECURITY.md new file mode 100644 index 0000000..ed0b3f0 --- /dev/null +++ b/docs/SECURITY.md @@ -0,0 +1,38 @@ +# Security · HyBBX 2.8.0 + +Built-in `[security]` — network protection and abuse in one subsystem. + +## Layer matrix + +| Layer | What | Ban? | +|-------|------|------| +| **Soft limits** | RF pacing, message size, traffic shaping | **No** | +| **Abuse** | Brute-force, connection flood, excessive spam | **Yes** — short IP/CALLID cool-down | + +## Soft limit matrix + +| Area | Keys | Effect | +|------|------|--------| +| `[traffic]` | `baud`, `pace_output`, `line_width` | Output pacing | +| `[chat]` | `message_max` | Truncate oversized lines | +| `[mail]` | `max_messages`, `body_max` | Mailbox caps | +| AX.25 broadcast | fixed | Min 900 s auto cycle; 60 s between links | + +## Ban trigger matrix + +| Target | Event | Default threshold | +|--------|-------|-------------------| +| **IP** | `login_fail` | 5 / 10 min | +| **IP** | `link_auth_fail` | 5 / 10 min | +| **IP** | `rate_limit` | 30 / 60 s | +| **CALLID** | `link_auth_fail` | same as login | +| **CALLID** | `ban_callid=` config | immediate, permanent | + +CALLID = AX.25 callsign or HBX `link_id`. Optional `iptables`/`nftables` via `ban_backend`. + +## Related + +| Goal | Doc | +|------|-----| +| Manual `[security]` | [MANUAL.md](MANUAL.md) | +| Topology link auth | [TOPOLOGY.md](TOPOLOGY.md) | -- cgit v1.3.1