Skip to main content

​
Understand Cloud Categorisation Feeds and Updates

SafeSquid categorises websites and refreshes signature databases using cloud services, scheduled updates, and local caches. Categories and signature tags feed Access Profiles, filters, and Detailed logs.
Valid Subscription is required for cloud signature downloads and for Application Signatures / SSqore processing on each connection. Check Support → License Details when feeds stop updating.

​
Pieces

  • SSqore — CCS URL categorisation during request profiling. Globals: Enabled (Heuristic is stored but unused in the current build).
  • Categorize Web-Sites — Local category overrides you maintain. Takes precedence over cloud results for matching hosts on the hot path.
  • Local override wins outright — for a host the local editor explicitly covers, the two categorisation sources are not merged. The local override simply wins, even if the cloud disagrees.
  • Application Signatures — Vendor applications4 database plus custom rules. Downloaded on UPDATE schedule; skipped when subscription expired.
  • Content Signatures — Vendor content4.xml plus libmagic MIME database under /var/lib/safesquid/content_signatures/.
  • Detects the actual file type of a response or upload body, independent of what its filename or declared content type claims.
  • DNS_CAT_ZONE — In startup.ini (default .c.ssquid.in). Set to . to disable DNS categorisation zone use.
  • UPDATE_INTVL / UPDATE_RETRY_DELAY — How often the appliance fetches signature and feed updates (startup.ini).

​
Update cycle (overview)

  1. Background hooks on the UPDATE schedule call signature updaters (update_application_signatures, update_content_signatures, and related).
  2. Downloaded files land under /var/lib/safesquid/ (application_signatures, content_signatures, ssqore cache, and similar).
  3. Config reload or init hooks merge vendor data with custom dev XML from the Web UI.
  4. Per-request labelling runs in the pipeline: SSqore and local category editor for website categories; Application Signatures for application tags.
Custom rules and local category overrides layer on top of the vendor data at the merge step — they never replace it. Custom Application Signature rules, custom Content Signature rules, and local category overrides all layer on top of the vendor data. They do not replace it.

​
Offline behaviour

When cloud lookups or downloads fail, SafeSquid relies on the last loaded on-disk databases and SSqore cache entries. New hosts may receive no categories until connectivity returns. Enable CATEGORY log level and check module load status (location to be confirmed).
  • Local overrides in Categorize Web-Sites are entirely unaffected by an outage. They never depend on cloud connectivity in the first place.
  • Custom Application Signature and Content Signature rules keep working too during an outage: only the vendor database refresh depends on connectivity, not the matching of rules already loaded.
  • Previously-seen hosts keep working exactly as before, from the last successful update.
This matters directly for policy: a DENY rule that depends on Categories matching a specific cloud category simply will not fire for an uncategorised new host during an outage. The request is not automatically blocked because categorisation failed, it is only left uncategorised, and whatever the rest of policy says about uncategorised traffic applies to it instead.

​
Examples

​
Block Social Networking by cloud category

  1. Enable SSqore; confirm subscription valid.
  2. In Access Profiles Secondary Policies, DENY when Categories matches the SSqore name for social sites (exact string from Detailed logs).
Result: categorized social hosts are blocked; uncategorized hosts may pass until CCS returns a category.

​
Override one miscategorised partner

  1. Use Categorize Web-Sites to assign Business-Partners to partner.example.com.
  2. Allow that category in Access Profiles for trusted users.
Result: local override applies even if SSqore still lists a different cloud category.

​
How to verify

  1. Module load status — application/content signature load times and errors. Location in the console to be confirmed.
  2. Detailed logs — categories and application_signatures columns on test URLs.
  3. Native logs with CATEGORY enabled for SSqore lines.
  1. If categorisation looks stale or wrong, check module load status for the last successful update time before assuming a policy problem. A feed that has not refreshed in a long time behaves very differently from a misconfigured policy. The two are easy to confuse.

​
Next steps