startup.ini tunables

Many appliance behaviours are set in /opt/safesquid/startup.ini (defaults in /opt/safesquid/default/startup.ini). These values are loaded before SafeSquid starts. They are not edited in Web UI sections from sectionMaster.xml. After edits, restart SafeSquid (/etc/init.d/safesquid restart). Path layout comes from /opt/safesquid/setup.ini.

​

Listen and identity

• LISTEN_IP / LISTEN_PORT — Default bind address and port if no Network settings Listen entry is enabled. See Network settings.
• HOSTNAME / DOMAIN — Appliance hostname and domain.

​

Threads, memory, sockets

• MAXTHREADS, MAX_FDS (about 4× threads), STACKSIZE, OVERLOAD_FACTOR
• SOCKET_TIMEOUT, THREAD_TIMEOUT, MAX_CONCURRENT
• HEAP_MEM, SOCK_MEM — lower if the host is memory-starved
• SEND_SOCKET_BUFFERS, RECEIVE_SOCKET_BUFFERS — 0 = no artificial limit
• TCP_KEEPIDLE_TIME, TCP_KEEPINTVL_TIME, TCP_KEEPCNT_COUNTS, CLIENT_DEFER_ACCEPT

​

CPU placement

• LISTEN_CPUS — Cores reserved for accepting clients (default 0,1)
• CPU_RESERVATION — Reservation strategy (default 1)

​

Authentication cache

PASSWORD_CACHE_SIZE and PASSWORD_CACHE_EXPIRE_TIME — see Authentication.

​

Logging

LOG_LEVEL, LOG_SIZE_LIMIT, PROCESS_OLD_LOGS, DATE_TIME_FORMAT, and optional NATIVE_UDP_* / EXTENDED_UDP_* / CONFIG_UDP_* — see Logging.

​

Master sync

• MASTER_IP / MASTER_PORT — Master appliance for configuration sync
• NEVER_SYNC / ALWAYS_SYNC — Comma-separated section names that must never / always sync (default NEVER_SYNC=cache)
• SYNCTIME — Sync interval toward the master

​

Updates and HTTPS

• UPDATE_INTVL, UPDATE_RETRY_DELAY
• FORCE_SNI — use SNI for client certs in HTTPS Inspection
• USE_SESSION_TICKETS
• CLIENT_CIPHERS_LIST / SERVER_CIPHERS_LIST (TLS ≤ 1.2)
• CLIENT_CIPHERS_SUITE / SERVER_CIPHERS_SUITE (TLS 1.3)

​

Categorisation and identity side channels

• DNS_CAT_ZONE — DNS categorisation zone (default .c.ssquid.in). Set to . to disable.
• USER_IP_DB_FILE — SQLite map of IP → username (for example VPN clients)
• OPENVPN_CLIENT_HEAD — OpenVPN client head file path when that integration is used
• IPV6_DETECT_SITE — FQDN:PORT used to test IPv6 reachability

​

Reporting database

REAL_TIME_DB_WRITE, STATEMENT_COUNT, MAX_MAIL_THRESHOLD, MIN_MAIL_THRESHOLD, KEEP_DATA.

​

Debugging

MALLOC_CHECKING — glibc MALLOC_CHECK_ mode (see comments in the default file).

​

See also

• Daemon and service
• Logging
• Authentication
• HTTPS Inspection
• Cloud / categorisation feeds
• Subscription

CLI: man safesquid-startup