Skip to main content
Many appliance behaviours are set in /opt/safesquid/startup.ini (defaults in /opt/safesquid/default/startup.ini). These values are loaded before SafeSquid starts. They are not edited in Web UI sections from sectionMaster.xml. After edits, restart SafeSquid (/etc/init.d/safesquid restart). Path layout comes from /opt/safesquid/setup.ini.
Two layers: Web UI / sectionMaster = policy XML. startup.ini = process and host tunables (listen, threads, logs, TLS, sync, DNS categorisation zone, and similar). Every value here is read once, at process start — there is no partial-reload path; a config sync from a master, or a Web UI policy save, does not touch or re-read this file. An unrecognised key is silently ignored rather than rejected — consult the shipped default file if unsure a key is spelled correctly.

​
Listen and identity

  • LISTEN_IP / LISTEN_PORT — Default bind address and port if no Network settings Listen entry is enabled. See Network settings. Once you add and enable a real Listen entry that entry is used and this fallback becomes irrelevant — but it is never actively disabled, so if every Listen entry is later disabled or removed, the appliance silently falls back to these defaults again rather than refusing to bind at all.
  • HOSTNAME / DOMAIN — Appliance hostname and domain.

​
Threads, memory, sockets

  • MAXTHREADS, MAX_FDS (about 4× threads — sized at that ratio because each connection can hold more than one descriptor at once, such as a client socket, an origin socket, and a cache file), STACKSIZE, OVERLOAD_FACTOR
  • SOCKET_TIMEOUT, THREAD_TIMEOUT
  • MAX_CONCURRENT — a global concurrent-connection ceiling for the whole process, distinct from the per-user, per-client-IP ceiling set by MAX Concurrent Connections on an individual Access restrictions entry.
  • HEAP_MEM, SOCK_MEM — lower if the host is memory-starved
  • SEND_SOCKET_BUFFERS, RECEIVE_SOCKET_BUFFERS — 0 = no artificial limit
  • TCP_KEEPIDLE_TIME, TCP_KEEPINTVL_TIME, TCP_KEEPCNT_COUNTS
  • CLIENT_DEFER_ACCEPT — defers accepting a client connection until data has actually arrived, reducing wasted thread time on connections that open and immediately go idle.

​
CPU placement

  • LISTEN_CPUS — Cores reserved for accepting clients (default 0,1)
  • CPU_RESERVATION — Reservation strategy (default 1)

​
Authentication cache

PASSWORD_CACHE_SIZE and PASSWORD_CACHE_EXPIRE_TIME — see Authentication.

​
Logging

LOG_LEVEL, LOG_SIZE_LIMIT, PROCESS_OLD_LOGS, DATE_TIME_FORMAT, and optional NATIVE_UDP_* / EXTENDED_UDP_* / CONFIG_UDP_* — see Logging.

​
Master sync

  • MASTER_IP / MASTER_PORT — Master appliance for configuration sync
  • NEVER_SYNC / ALWAYS_SYNC — Comma-separated section names that must never / always sync (default NEVER_SYNC=cache)
  • SYNCTIME — Sync interval toward the master

​
Updates and HTTPS

  • UPDATE_INTVL, UPDATE_RETRY_DELAY
  • FORCE_SNI — use SNI for client certs in HTTPS Inspection
  • USE_SESSION_TICKETS
  • CLIENT_CIPHERS_LIST / SERVER_CIPHERS_LIST (TLS ≤ 1.2)
  • CLIENT_CIPHERS_SUITE / SERVER_CIPHERS_SUITE (TLS 1.3)

​
Categorisation and identity side channels

  • DNS_CAT_ZONE — DNS categorisation zone (default .c.ssquid.in). Set to . to disable.
  • USER_IP_DB_FILE — SQLite map of IP → username (for example VPN clients)
  • OPENVPN_CLIENT_HEAD — OpenVPN client head file path when that integration is used
  • IPV6_DETECT_SITE — FQDN:PORT used to test IPv6 reachability

​
Reporting database

REAL_TIME_DB_WRITE, STATEMENT_COUNT, MAX_MAIL_THRESHOLD, MIN_MAIL_THRESHOLD, KEEP_DATA.

​
Debugging

MALLOC_CHECKING — glibc MALLOC_CHECK_ mode (see comments in the default file).

​
Examples

​
Fitting resource limits to a smaller host

On a lower-memory appliance, lower HEAP_MEM and SOCK_MEM alongside MAXTHREADS and MAX_FDS (keeping MAX_FDS at roughly four times MAXTHREADS), restart, then watch Dashboard and Statistics under load to confirm the appliance stays responsive.

​
Disabling DNS categorisation temporarily

If the DNS categorisation zone is unreachable and producing errors rather than degrading gracefully, set DNS_CAT_ZONE=. and restart to disable that path while resolving the underlying DNS issue; other categorisation sources such as SSqore and local category overrides continue to function.

​
How to verify

  1. After any edit, restart the service, then confirm the appliance is actually running the new configuration — a misspelled tunable is silently ignored, which looks identical from the outside to the tunable simply not mattering.
  2. For listen-related changes, confirm with a direct connection test rather than trusting the Web UI Network settings page alone — that page shows configured Listen entries, not the process’s actual fallback behavior when none are enabled.
  3. For master sync changes, confirm on the replica that a policy change made on the master actually arrives within the configured sync interval, and that any section in NEVER_SYNC genuinely does not change.
  4. Revert any temporary diagnostic change and restart again once the investigation is complete.

​
See also