X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=doc%2Fwebserver%2Fuser-manual%2Fconfig.html;h=532657350d8820798c2d798d7931d3fdd5bb1a69;hp=bef8710e5e009a2297b5c353d34885a619a29418;hb=3f970a064dc22c089ae2e9c78ef7ce8539908bdd;hpb=098f3f996e9465705bc3e02b9454b99568c8e372;ds=sidebyside diff --git a/doc/webserver/user-manual/config.html b/doc/webserver/user-manual/config.html index bef8710e..53265735 100644 --- a/doc/webserver/user-manual/config.html +++ b/doc/webserver/user-manual/config.html @@ -4,7 +4,7 @@
Privoxy 3.0.29 User Manual | +Privoxy 3.0.30 User Manual | |||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Prev | @@ -547,10 +547,10 @@
- debug 1 # Log the destination for each request Privoxy let through. See also debug 1024. +debug 1 # Log the destination for each request. See also debug 1024. debug 2 # show each connection status - debug 4 # show I/O status + debug 4 # show tagging-related messages debug 8 # show header parsing debug 16 # log all data written to the network debug 32 # debug force feature @@ -694,7 +694,8 @@ whenever the IP address is assigned to the system enforce-blocks 1 If your system implements RFC 3493, then src_addr and dst_addr can be - IPv6 addresses delimeted by brackets, port can be a number or a + IPv6 addresses delimited by brackets, port can be a number or a service name, and src_masklen and dst_masklen can be a number from 0 to 128. @@ -1547,7 +1548,7 @@ you try again manually. Start with a small value and check Privoxy's logfile from time to time, to see how many retries are usually needed. -forwarded-connect-retries 1 accept-intercepted-requests 1 Don't enable this option unless you're sure that you really need it. -allow-cgi-request-crunching 1 If you don't notice any editing problems, there is no reason to enable this option, but if one of the submit buttons appears to be broken, you should give it a try. -split-large-forms 1 keep-alive-timeout 300 If you are seeing problems with pages not properly loading, disabling this option could work around the problem. -tolerate-pipelining 1 This option has no effect if Privoxy has been compiled without keep-alive support. -default-server-timeout 60 This option should only be used by experienced users who understand the risks and can weight them against the benefits. -connection-sharing 1 The default is quite high and you probably want to reduce it. If you aren't using an occasionally slow proxy like Tor, reducing it to a few seconds should be fine. -socket-timeout 300 max-client-connections 256 Under high load incoming connection may queue up before Privoxy gets around to serve them. The queue - length is limitted by the operating system. Once the queue is full, additional connections are dropped + length is limited by the operating system. Once the queue is full, additional connections are dropped before Privoxy can accept and serve them. -Increasing the queue length allows Privoxy to accept more incomming connections that arrive roughly at + Increasing the queue length allows Privoxy to accept more incoming connections that arrive roughly at the same time. Note that Privoxy can only request a certain queue length, whether or not the requested length is actually used depends on the operating system which may use a different length instead. @@ -1982,7 +1983,7 @@Effectively using a value above 128 usually requires changing the system configuration as well. On FreeBSD-based system the limit is controlled by the kern.ipc.soacceptqueue sysctl. listen-backlog 4096 enable-accept-filter 1 Note that sorting headers in an uncommon way will make fingerprinting actually easier. Encrypted - headers are not affected by this directive. + headers are not affected by this directive unless https-inspection is enabled. @@ -2203,18 +2205,6 @@
-
Client-specific tags allow Privoxy admins to create different profiles and let the users chose which one they want without impacting other users. One use case is allowing users to circumvent certain blocks without having to allow them to circumvent @@ -2232,7 +2222,7 @@ Clients can request tags to be set by using the CGI interface http://config.privoxy.org/client-tags. The specific tag description is only used on the web page and should be phrased in away that the user - understand the effect of the tag. + understands the effect of the tag.# Define a couple of tags, the described effect requires action sections # that are enabled based on CLIENT-TAG patterns. client-specific-tag circumvent-blocks Overrule blocks but do not affect other actions - client-specific-tag disable-content-filters Disable content-filters but do not affect other actions+ client-specific-tag disable-content-filters Disable content-filters but do not affect other actions + client-specific-tag overrule-redirects Overrule redirect sections + client-specific-tag allow-cookies Do not crunch cookies in either direction + client-specific-tag change-tor-socks-port Change forward-socks5 settings to use a different Tor socks port (and circuits) + client-specific-tag no-https-inspection Disable HTTPS inspection + client-specific-tag no-tls-verification Don't verify certificates when http-inspection is enabled |
Warning | -
- This is an experimental feature. The syntax is likely to change in future versions. - |
-
In case of some tags users may not want to enable them permanently, but only for a short amount of time, for example to circumvent a block that is the result of an overly-broad URL pattern.
The CGI interface http://config.privoxy.org/client-tags therefore provides a "enable this tag temporarily" option. If it is used, the tag will be set until the client-tag-lifetime is over.
Warning | -
- This is an experimental feature. The syntax is likely to change in future versions. - |
-
If clients reach Privoxy through another proxy, for example a load balancer, Privoxy can't tell the client's IP address from the connection. If multiple clients use the same proxy, they will share the same client tag settings which is usually not desired.
@@ -2343,7 +2314,7 @@ change the client tags for other clients or increase Privoxy's memory requirements by registering lots of client tag settings for clients that don't exist.Warning | +
+ Privoxy currently does not garbage-collect obsolete keys and + certificates and does not keep track of how may keys and certificates exist. +Privoxy admins should monitor the size of the directory + and/or make sure there is sufficient space available. A cron job to limit the number of keys and + certificates to a certain number may be worth considering. + |
+
certificate-directory /usr/local/var/privoxy/certs
A list of ciphers to use in TLS handshakes
+Text
+None
+A default value is inherited from the TLS library.
+This directive allows to specify a non-default list of ciphers to use in TLS handshakes with clients + and servers.
+Ciphers are separated by colons. Which ciphers are supported depends on the TLS library. When using + OpenSSL, unsupported ciphers are skipped. When using MbedTLS they are rejected.
+Warning | +
+ Specifying an unusual cipher list makes fingerprinting easier. Note that the default list + provided by the TLS library may be unusual when compared to the one used by modern browsers as + well. + |
+
+ # Explicitly set a couple of ciphers with names used by MbedTLS + cipher-list cipher-list TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:\ +TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:\ +TLS-DHE-RSA-WITH-CHACHA20-POLY1305-SHA256:\ +TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:\ +TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:\ +TLS-ECDHE-ECDSA-WITH-AES-256-CCM:\ +TLS-ECDHE-ECDSA-WITH-AES-256-CCM-8:\ +TLS-ECDHE-ECDSA-WITH-AES-128-CCM:\ +TLS-ECDHE-ECDSA-WITH-AES-128-CCM-8:\ +TLS-ECDHE-ECDSA-WITH-CAMELLIA-128-GCM-SHA256:\ +TLS-ECDHE-ECDSA-WITH-CAMELLIA-256-GCM-SHA384:\ +TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:\ +TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:\ +TLS-ECDHE-RSA-WITH-CAMELLIA-128-GCM-SHA256:\ +TLS-ECDHE-RSA-WITH-CAMELLIA-256-GCM-SHA384:\ +TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:\ +TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:\ +TLS-DHE-RSA-WITH-AES-256-CCM:\ +TLS-DHE-RSA-WITH-AES-256-CCM-8:\ +TLS-DHE-RSA-WITH-AES-128-CCM:\ +TLS-DHE-RSA-WITH-AES-128-CCM-8:\ +TLS-DHE-RSA-WITH-CAMELLIA-128-GCM-SHA256:\ +TLS-DHE-RSA-WITH-CAMELLIA-256-GCM-SHA384:\ +TLS-ECDH-RSA-WITH-AES-128-GCM-SHA256:\ +TLS-ECDH-RSA-WITH-AES-256-GCM-SHA384:\ +TLS-ECDH-RSA-WITH-CAMELLIA-128-GCM-SHA256:\ +TLS-ECDH-RSA-WITH-CAMELLIA-256-GCM-SHA384:\ +TLS-ECDH-ECDSA-WITH-AES-128-GCM-SHA256:\ +TLS-ECDH-ECDSA-WITH-AES-256-GCM-SHA384:\ +TLS-ECDH-ECDSA-WITH-CAMELLIA-128-GCM-SHA256:\ +TLS-ECDH-ECDSA-WITH-CAMELLIA-256-GCM-SHA384 ++ |
+
+ # Explicitly set a couple of ciphers with names used by OpenSSL +cipher-list ECDHE-RSA-AES256-GCM-SHA384:\ +ECDHE-ECDSA-AES256-GCM-SHA384:\ +DH-DSS-AES256-GCM-SHA384:\ +DHE-DSS-AES256-GCM-SHA384:\ +DH-RSA-AES256-GCM-SHA384:\ +DHE-RSA-AES256-GCM-SHA384:\ +ECDH-RSA-AES256-GCM-SHA384:\ +ECDH-ECDSA-AES256-GCM-SHA384:\ +ECDHE-RSA-AES128-GCM-SHA256:\ +ECDHE-ECDSA-AES128-GCM-SHA256:\ +DH-DSS-AES128-GCM-SHA256:\ +DHE-DSS-AES128-GCM-SHA256:\ +DH-RSA-AES128-GCM-SHA256:\ +DHE-RSA-AES128-GCM-SHA256:\ +ECDH-RSA-AES128-GCM-SHA256:\ +ECDH-ECDSA-AES128-GCM-SHA256:\ +ECDHE-RSA-AES256-GCM-SHA384:\ +AES128-SHA ++ |
+
+ # Use keywords instead of explicitly naming the ciphers (Does not work with MbedTLS) + cipher-list ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH ++ |
+
This directive specifies the trusted CAs file that is used when validating certificates for intercepted TLS/SSL requests.
-An example file can be downloaded from https://curl.haxx.se/ca/cacert.pem.
+An example file can be downloaded from https://curl.se/ca/cacert.pem. If you want to create the file yourself, please see: https://curl.se/docs/caextract.html.
trusted-cas-file trusted_cas_file.pem