Install on a Managed Linux Host

Use the Linux server path only when the organization already owns the operating system lifecycle, hardening baseline, monitoring, backup, and rollback. For new deployments, the SafeSquid Appliance Builder is the standard path because it provides a repeatable appliance build and supporting services.

Use this method when

Use an existing Linux host when:

The host is dedicated to SafeSquid or the security exception is approved.
The OS version, packages, services, and hardening baseline are managed.
Operations can install dependencies and troubleshoot service failures.
Backup and rollback are already defined.

Do not use this method as a shortcut around appliance planning. A poorly managed host creates unstable inspection, missing logs, and difficult incident response.

Validate prerequisites

Confirm:

Root or approved sudo access is available.
The host has static IP, DNS, gateway, and NTP configuration.
Required outbound paths are reachable.
Required packages and libraries can be installed.
No local service conflicts with the approved SafeSquid proxy port.
Activation key and rollback plan are available.

Prepare the host

Record OS details:

uname -a
cat /etc/os-release

Update package metadata according to the organization’s change process:

sudo apt update

Check disk and memory:

df -h
free -m

Expected result: disk and memory match the sizing plan, with enough free space for logs, reports, updates, and support bundles.

Debian and Ubuntu
RHEL family

Use the organization’s approved package repositories and change window:

sudo apt update
sudo apt install -y bind9 monit

Confirm that local hardening does not block SafeSquid, Monit, or BIND9 service management.

Use the organization’s approved repository and package names for the target distribution:

sudo dnf makecache
sudo dnf install -y bind monit

Confirm SELinux, firewalld, and local hardening rules before starting SafeSquid.

Install build and runtime dependencies

SafeSquid links against these libraries. Install them before running the installer, using the organization’s approved repositories.

Debian and Ubuntu
RHEL, CentOS, Rocky
SUSE and openSUSE

sudo apt update
sudo apt install -y wget tar libssl-dev libpcre3 libpcre3-dev zlib1g-dev \
  build-essential libc6 libgcc-s1 libstdc++6

sudo yum install -y wget tar openssl-devel pcre-devel zlib-devel \
  gcc gcc-c++ make glibc libgcc libstdc++

sudo zypper install -y wget tar libopenssl-devel pcre-devel zlib-devel \
  gcc gcc-c++ make glibc libgcc_s1 libstdc++6

Package names drift between releases. If one is not found, locate the equivalent for your distribution rather than skipping it — a missing library surfaces later as a service that installs cleanly and then refuses to start.

Prepare directories, firewall, SELinux, and time

Create the data directories so the installer writes into a known layout, and so you can mount dedicated volumes underneath them:

sudo mkdir -p /var/log/safesquid /var/lib/safesquid /var/db/safesquid

Open the proxy and management ports using whichever firewall the host runs. Restrict the source scope in the same change, as described in Deployment Checklist:

# firewalld (RHEL family)
sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --add-port=8443/tcp
sudo firewall-cmd --reload

# ufw (Debian, Ubuntu)
sudo ufw allow 8080/tcp
sudo ufw allow 8443/tcp
sudo ufw reload

# iptables
sudo iptables -A INPUT -p tcp --dport 8080 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
sudo iptables-save

Set SELinux to permissive for the setup window on RHEL-family hosts, then write a targeted policy once the deployment is stable:

sudo setenforce 0

Confirm time synchronisation. SSL certificate validation and log correlation both depend on it:

timedatectl status

Expected result: NTP synchronisation is active. If it is not, enable it before continuing:

sudo systemctl enable --now systemd-timesyncd

Install SafeSquid

Use the approved SafeSquid package or TAR source for the target release. Preserve the source URL, checksum if provided, and install date in the change record.

Download, extract, and run the installer

Retrieve and unpack the package:

cd /usr/local/src
wget http://downloads.safesquid.net/appliance/binary/safesquid_latest.tar.gz
tar -zxvf safesquid_latest.tar.gz

Expected result: a _mkappliance directory is extracted, containing the installation scripts.Run the installer from the directory you extracted into:

sudo _mkappliance/installation/setup.sh

The installer checks dependencies, creates the safesquid system user and group, installs binaries under /opt/safesquid/, writes init and systemd service units, and places default configuration under /etc/safesquid/.Confirm every linked library resolved:

ldd /opt/safesquid/bin/safesquid

Expected result: no line reads not found. Any that does names a package still to install — resolve it before starting the service, because the failure otherwise appears at runtime as an immediate exit rather than a missing dependency.If the installer itself fails, the usual causes are a missing library, running without sudo, or insufficient free space. Check the terminal output first, then df -h.

What the installer's post-install automation does

On a Debian-based system, setup.sh above carries out the whole post-install sequence on its own. In order, it:

Suspends any existing process-monitoring service for the duration of the install.
Detects the distribution family, to decide which remaining steps apply.
Creates the service account SafeSquid runs as (not root).
Removes leftovers from a previous installation on the same machine, if one existed.
Installs the supporting packages SafeSquid depends on.
Stops the service if it is already running (relevant on a re-install or upgrade).
Configures a local DNS resolver tuned for appliance use, with IPv6 disabled and the zone data DNS Blacklist depends on already in place.
Copies the appliance file tree into place.
Stands up a local DNS blacklist server bound only to loopback.
Enables and starts the service.

On a Red Hat-based system only the dependency-package installation step runs automatically. The DNS resolver and DNS Blacklist setup is not configured for you and must be done separately. If DNS Blacklist does not appear to resolve anything, confirm the local resolver and blacklist server were actually set up — on a RHEL-family install this is a manual step, not an assumption.Two reasons some features need no extra setup on this path: the Kerberos and SASL components are installed by that step, which is why Kerberos/SSO and LDAP authentication need no extra package installation; and the OCR components are installed there too, which is why DLP and Image analyzer can score text in images without extra setup. If Kerberos/SSO or LDAP authentication misbehaves, confirm you are on the fully-automated Debian-based path.

After extracting or installing the package, start SafeSquid:

sudo systemctl start safesquid

If the platform uses the legacy service script, use the approved service command for that build:

sudo /etc/init.d/safesquid start

Verify service health

Check service state:

systemctl status safesquid --no-pager

Check listener state:

ss -lntp | grep ':8080'

Check access-log creation after a pilot request:

tail -20 /var/log/safesquid/access/extended.log

Expected result: SafeSquid runs, listens on the approved port, and records pilot traffic.

Configure supporting services

Monit process monitoring

Monit helps operators detect and restart failed services when it is part of the approved operations baseline. Confirm Monit is installed, enabled, and configured to monitor SafeSquid before relying on UI-triggered restarts or unattended recovery.

systemctl status monit --no-pager
systemctl enable monit
systemctl restart monit

Expected result: Monit runs, starts after reboot, and its configuration is included in the deployment record.

BIND9 local DNS service

BIND9 is commonly used as the local DNS service on SafeSquid appliance-style deployments. On managed Linux hosts, confirm whether local DNS is required or whether enterprise resolvers will be used directly.

systemctl status bind9 --no-pager
named-checkconf
nslookup example.com 127.0.0.1

Expected result: BIND9 runs when required, configuration syntax passes, and local resolution succeeds. If the distribution uses a different service name, use the approved equivalent and record it.

Harden before rollout

Before routing users:

Restrict proxy access to approved client networks.
Restrict management access to approved administrators.
Enable log forwarding or retention.
Confirm OS patching and backup ownership.
Confirm Root CA rollout path.
Document service restart and rollback steps.

Change the default administrator password

Change the shipped administrator password before the host is reachable from any client network.

Open the management interface at https://SERVER-IP:8443/ from an approved administrator network.
Go to System and open User Management.
Change the password on the administrator account.

Record that the change was made in the deployment evidence. A proxy carrying all corporate web traffic on a default credential is a direct compromise path.

Configure log rotation

Without rotation, SafeSquid logs grow until the volume fills and evidence is silently truncated. Create /etc/logrotate.d/safesquid:

/var/log/safesquid/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        /etc/init.d/safesquid reload > /dev/null
    endscript
}

Adjust rotate to the retention target agreed in Log-Retention Planning, and use the service reload command appropriate to your build. Test the configuration before relying on it:

sudo logrotate -d /etc/logrotate.d/safesquid

Expected result: the dry run reports the files it would rotate, with no configuration errors.

Capture deployment evidence

Store:

OS release and kernel details.
Package or TAR source.
Install date and operator.
Service status output.
Listener check.
Pilot access-log sample.
Firewall and management-access approval.
Rollback or rebuild procedure.

Troubleshoot installation

Symptom	Likely cause	Fix
Package installation fails	Dependency or repository issue	Resolve package source and dependency errors before retrying
Service does not start	Port conflict or incomplete install	Check service logs and confirm no service owns the proxy port
Listener is missing	SafeSquid is stopped or bound differently	Verify service status and configured listener
No traffic is logged	Client bypasses proxy	Configure explicit proxy on a pilot client and retest
`ldd` reports a library as `not found`	A system dependency is missing	Install the package providing that library with the host’s package manager, then recheck
Logs show permission denied, but file ownership looks correct	SELinux is enforcing and blocking SafeSquid	Set permissive mode for the setup window with `sudo setenforce 0`, then author a targeted policy

Next steps

Access the Interface - open http://safesquid.cfg/ safely.
Activate Your License - upload the activation key and run smoke tests.
Connect Your Client - route pilot traffic.

Plan and prepare

Install SafeSquid

Deploy locally

Deploy on cloud

Connect clients

Activate your license

Deployment modes

Scaling and high availability

Backup and disaster recovery

Performance and capacity

Validate the deployment

Upgrade SafeSquid

Linux Server Install

Install on a Managed Linux Host

Use this method when

Validate prerequisites

Prepare the host

Install SafeSquid

Verify service health

Configure supporting services

Harden before rollout

Capture deployment evidence

Troubleshoot installation

Next steps

​Install on a Managed Linux Host

​Use this method when

​Validate prerequisites

​Prepare the host

​Install SafeSquid

​Verify service health

​Configure supporting services

​Harden before rollout

​Capture deployment evidence

​Troubleshoot installation

​Next steps

Install on a Managed Linux Host

Use this method when

Validate prerequisites

Prepare the host

Install SafeSquid

Verify service health

Configure supporting services

Harden before rollout

Capture deployment evidence

Troubleshoot installation

Next steps