Security & anti-abuse (services)

echo services runs a native anti-abuse engine in its core. It observes network activity, scores it against configurable detectors, and can act (kill / ban) — or, by default, only report. It is separate from the daemon's layered anti-abuse.

Arm it carefully. report_only defaults to true (detect and alert only). Before setting it false, make sure exempt_ips covers loopback and your trusted hosts — otherwise an over-eager detector could ban your own services or bots.

[security] — engine core#

Key	Description
`enabled`	Master switch
`report_only`	Detect & alert only, never kill/ban (default true)
`exempt_ips`	IP masks exempt from enforcement (defaults to loopback)
`exempt_opers` / `exempt_accounts` / `exempt_voice`	Exempt operators (default on) / logged-in accounts (off) / voiced users (on)
`announce_permit` / `announce_life`	Rate limit on abuse announcements
`cascade_permit` / `cascade_life`	Correlated-event (cascade) detection thresholds
`netsplit_grace`	Grace period after a netsplit before enforcing

The OperServ DEFCON command raises the network defence level on top of this.

[security.connect] — connection floods#

enabled, flood_permit / flood_life (connects per source in a window), range_permit / range_life (per IP range), ban_duration.

[security.behavior] — behavioural abuse#

Nick flooding, join/part cycling, mass-join, quit floods, and channel crawling: nick_permit/nick_life, cycle_permit/cycle_life, joinpart_permit/joinpart_life/joinpart_grace, massjoin_permit/massjoin_life, quit_permit/quit_life/quit_reasons, crawl_permit/crawl_life, ban_duration.

[security.content] — message content#

Highlight spam, bad Unicode, and repeats: highlight_nicks/highlight_min_len/highlight_permit/highlight_life, badunicode_score/badunicode_min/badunicode_permit/badunicode_life, repeat_min/repeat_permit/repeat_life, ban_duration.

[security.auth] — auth abuse#

Login and registration flooding, ban evasion: fail_permit/fail_life, register_permit/register_life, evade_ttl, ban_duration.

[[security.pattern]] — custom connect masks (repeatable)#

mask, field (which connection field to match), regex (treat the mask as a regex), reason, ban (duration).

[security.mxbl] — email MX/IP blocklist#

Screens registration email domains: enabled, resolver, mx_globs, ip_cidrs, timeout_ms.