| # Port for Aardvark to listen on |
| port: 1729 |
| |
| # Which backend to proxy to if request is kosher |
| proxy_url: "http://localhost:8080/" |
| |
| # Default IP forward header from httpd |
| ipheader: x-forwarded-for |
| |
| # This is the text of the 403 response if a request is blocked |
| spam_response: "Your request has been blocked. If you feel this is in error, please let us know at: abuse@infra.apache.org. Be sure to include your IP address so we know what to look for." |
| |
| # Debug prints for ...debug. disabled by default |
| debug: false |
| |
| # Enable persistent storage of offenders |
| persistence: true |
| |
| # Suppress repeat offenders from syslog. setting `debug: true` overrides this. |
| suppress_repeats: true |
| |
| # This is where we save the bad requests, for further perusal. Only one request per IP is saved (the first) |
| savedata: /tmp/aardvark |
| |
| ############################## |
| # The actual spam scan rules # |
| ############################## |
| |
| # When using the naïve spam corpus for form data, this threshold causes a block. |
| # 0 is considered perfectly sane ham, 50 is bordering on spam, 100 is definitely spam |
| enable_naive_scan: true |
| naive_spam_threshold: 85 |
| |
| # These automatically cause a ban |
| spamurls: |
| - "/jira/rest/api/.+/issue/AAR-\\d+/comment" |
| |
| # Don't run spam check here... |
| ignoreurls: |
| - "AttachTemporaryFile" |
| |
| # Match any of these to banninate |
| postmatches: |
| - "mobilestrikehacktools" |
| - "monsterlegendshackx" |
| - "router customer service" |
| - "router customer support" |
| - "customer service number" |
| - "customer care phone" |
| - "\\b(https?[:/%32AF]*\\S*essay\\S*)\\b" |
| - "escorts" |
| - "solitairetimes" |
| - "myspades" |
| - "myeuchre" |
| - "ringtone" |
| - "keywords INNER JOIN keyworddefs ON keywords.keywordid" |
| - "\\b(https?[:/%32AF]*[^/\\s]*resume\\S*)\\b" |
| - "\\b(https?[:/%32AF]*\\S*800support\\S*)\\b" |
| - "drzafarsaifi" |
| - "\\b(https?[:/%32AF]*\\S*dissertation\\S*)\\b" |
| - "\\b(https?[:/%32AF]*[^/\\s]*assignment\\S*)\\b" |
| - "\\b(https?[:/%32AF]*[^/\\s]*dumps\\S*)\\b" |
| - "\\b(https?[:/%32AF]*[^/\\s]*lead\\S*)\\b" |
| - "\\b(https?[:/%32AF]*\\S*poker\\S*)\\b" |
| - "assignmenthelp" |
| - "paperwriting" |
| - "bestdiss" |
| - "besttempmail" |
| - "eventeca" |
| - "ngaydem" |
| - "moneyprinters" |
| - "free[- ]watch.+?listen" |
| - "https://tvvslivenba.co/" |
| - "certsexpert" |
| - "online bank" |
| - "bank online" |
| - "online deposit" |
| - "deposit online" |
| - "deposit bank" |
| - "bank deposit" |
| - "casino" |
| - "money back" |
| - "% discount" |
| - "Full Movie Online" |
| - "sevenmentor" |
| - "streamsable" |
| |
| # Match multiple of these to ban |
| multimatch: |
| auxiliary: |
| - "p.?h.?o.?n.?e" |
| - "s.?u.?p.?p.?o.?r.?t" |
| required: |
| - "(1[-.\\s]+\\d\\d\\d[-.\\s]+\\d\\d\\d[-.\\s]+\\d\\d\\d\\d)" |
