X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=config;h=59d4efeacfd1c7f595fffa77e9cc918640f175ff;hp=0afa1e127f3ea8ce09c22030e0904d3fe3bc37a9;hb=36416c0286f2e84d8c2e892b1adc3216fea50720;hpb=b40ce8d987a250f6ce14e506fc05bfa8e9e37f27 diff --git a/config b/config index 0afa1e12..59d4efea 100644 --- a/config +++ b/config @@ -1,6 +1,6 @@ # Sample Configuration File for Privoxy 3.0.29 # -# Copyright (C) 2001-2019 Privoxy Developers https://www.privoxy.org/ +# Copyright (C) 2001-2020 Privoxy Developers https://www.privoxy.org/ # ##################################################################### # # @@ -567,7 +567,7 @@ logfile logfile # # The available debug levels are: # -# debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. +# debug 1 # Log the destination for each request. See also debug 1024. # debug 2 # show each connection status # debug 4 # show I/O status # debug 8 # show header parsing @@ -609,7 +609,7 @@ logfile logfile # you read the log messages, you may even be able to solve the # problem on your own. # -#debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. +#debug 1 # Log the destination for each request. #debug 1024 # Log the destination for requests Privoxy didn't let through, and the reason why. #debug 4096 # Startup banner and warnings #debug 8192 # Non-fatal errors @@ -731,7 +731,11 @@ logfile logfile # result in DNS traffic. # # If the specified address isn't available on the system, or if -# the hostname can't be resolved, Privoxy will fail to start. +# the hostname can't be resolved, Privoxy will fail to start. On +# GNU/Linux, and other platforms that can listen on not yet +# assigned IP addresses, Privoxy will start and will listen on +# the specified address whenever the IP address is assigned to +# the system # # IPv6 addresses containing colons have to be quoted by # brackets. They can only be used if Privoxy has been compiled @@ -996,7 +1000,7 @@ enforce-blocks 0 # whole destination part are optional. # # If your system implements RFC 3493, then src_addr and dst_addr -# can be IPv6 addresses delimeted by brackets, port can be a +# can be IPv6 addresses delimited by brackets, port can be a # number or a service name, and src_masklen and dst_masklen can # be a number from 0 to 128. # @@ -1982,13 +1986,13 @@ socket-timeout 300 # Notes: # # Under high load incoming connection may queue up before -# Privoxy gets around to serve them. The queue length is -# limitted by the operating system. Once the queue is full, -# additional connections are dropped before Privoxy can accept -# and serve them. +# Privoxy gets around to serve them. The queue length is limited +# by the operating system. Once the queue is full, additional +# connections are dropped before Privoxy can accept and serve +# them. # # Increasing the queue length allows Privoxy to accept more -# incomming connections that arrive roughly at the same time. +# incoming connections that arrive roughly at the same time. # # Note that Privoxy can only request a certain queue length, # whether or not the requested length is actually used depends @@ -2290,8 +2294,7 @@ socket-timeout 300 # # Define a couple of tags, the described effect requires action sections # # that are enabled based on CLIENT-TAG patterns. # client-specific-tag circumvent-blocks Overrule blocks but do not affect other actions -# disable-content-filters Disable content-filters but do not affect other actions -# +# client-specific-tag disable-content-filters Disable content-filters but do not affect other actions # # # 6.17. client-tag-lifetime @@ -2436,8 +2439,8 @@ socket-timeout 300 # receive-buffer-size 32768 # # -# 7. TLS/SSL -# =========== +# 7. TLS/SSL INSPECTION +# ====================== # # 7.1. ca-directory # ================== @@ -2464,6 +2467,9 @@ socket-timeout 300 # This directive specifies the directory where the CA key, the # CA certificate and the trusted CAs file are located. # +# The permissions should only let Privoxy and the Privoxy admin +# access the directory. +# # Examples: # # ca-directory /usr/local/etc/privoxy/CA @@ -2494,8 +2500,15 @@ socket-timeout 300 # This directive specifies the name of the CA certificate file # in ".crt" format. # -# It can be generated with: openssl req -new -x509 -extensions -# v3_ca -keyout cakey.pem -out cacert.crt -days 3650 +# The file is used by Privoxy to generate website certificates +# when https inspection is enabled with the https-inspection +# action. +# +# Privoxy clients should import the certificate so that they can +# validate the generated certificates. +# +# The file can be generated with: openssl req -new -x509 +# -extensions v3_ca -keyout cakey.pem -out cacert.crt -days 3650 # # Examples: # @@ -2572,7 +2585,7 @@ socket-timeout 300 # # Specifies: # -# Directory to safe generated keys and certificates. +# Directory to save generated keys and certificates. # # Type of value: # @@ -2589,7 +2602,14 @@ socket-timeout 300 # Notes: # # This directive specifies the directory where generated TLS/SSL -# keys and certificates are saved. +# keys and certificates are saved when https inspection is +# enabled with the https-inspection action. +# +# The keys and certificates currently have to be deleted +# manually when changing the ca-cert-file and the ca-cert-key. +# +# The permissions should only let Privoxy and the Privoxy admin +# access the directory. # # Examples: # @@ -2619,7 +2639,7 @@ socket-timeout 300 # Notes: # # This directive specifies the trusted CAs file that is used -# when validating certificates for intercepted TLS/SSL request. +# when validating certificates for intercepted TLS/SSL requests. # # An example file can be downloaded from https://curl.haxx.se/ca # /cacert.pem.