haraka-plugin-log-reader

extracts matching log entries from the haraka log file

Install

cd /my/haraka/config/dir
npm install haraka-plugin-log-reader

Enable

Add log-reader to haraka/config/plugins file.

Usage

When enabled, this plugin registers these URL routes in Haraka's http server:

• /logs/:uuid
• /karma/rules (disabled by default)

/logs/:uuid returns the log lines for a connection, rendered as HTML (including the Policy Rules and Steps to Resolve sections, built server-side from karma.ini).

/karma/rules returns the raw list of Haraka rules in use as JSON, for an external http client. Because it discloses your spam-filter configuration to anyone who can reach the HTTP server, it is disabled by default. Set allow_rules_endpoint=true in log.reader.ini to enable it.

Example

Sorry we blocked your message:

Our filters mistook your server for a malicious computer attempting to send spam. To improve your mail servers reputation, please contact your IT helpdesk or Systems Administrator and ask them for help.

---

Policy Rules

• -7, DNS Blacklist (b.barracudacentral.org)
• -5, DNS Blacklist (zen.spamhaus.org)
• -3, DNS Blacklist (dnsbl-1.uceprotect.net)
• -3, DNS Blacklist (bl.spamcop.net)
• -3, ASN reputation is spam-only (asn_all_bad)
• -1, Geographic distance is unusual for ham (4000)
• -1, Geographic distance is unusual for ham (8000)
• -1, ASN reputation is bad (karma)

---

Steps to Resolve

• Disinfect your host/network

---

Raw Logs

4D0B74C5-6D41-4074-9E43-5EE9CC1B4973

[NOTICE] [core] connect ip=95.160.74.108 port=39005 local_ip=172.16.15.9 local_port=25
[INFO] [connect.p0f] os="Linux 2.4.x-2.6.x" link_type="Ethernet or modem" distance=7 total_conn=1
[INFO] [connect.fcrdns] ip=95.160.74.108 rdns="095160074108.gdansk.vectranet.pl" rdns_len=1 fcrdns="095160074108.gdansk.vectranet.pl" fcrdns_len=1 other_ips_len=0 invalid_tlds=0 generic_rdns=true
[INFO] [connect.asn] asn: 29314, org: Al. Zwyciestwa 253, 81-525 Gdynia, Poland
[INFO] [connect.geoip] EU, PL, Gdansk, 82, 8506km
[INFO] [dnsbl] fail:dnsbl-1.uceprotect.net, bl.spamcop.net, b.barracudacentral.org, zen.spamhaus.org, dnsbl.sorbs.net
[INFO] [connect.asn] asn: 29314, org: Al. Zwyciestwa 253, 81-525 Gdynia, Poland, asn_score: -4364, asn_connections: 4367, asn_good: 0, asn_bad: 4364, fail:karma, asn_all_bad
[INFO] [limit] no IP history from : karma
[INFO] [karma] score: -24, awards: 001,002,115,114,111,116,021,023
[NOTICE] [core] disconnect ip=95.160.74.108 rdns="095160074108.gdansk.vectranet.pl" helo="" relay=N early=N esmtp=N tls=N pipe=N errors=0 txns=0 rcpts=0/0/0 msgs=0/0/0 bytes=0 lr="" time=12.752