CSSv5.0.0 en:Advanced Cryptshare Configuration
By placing an additional settings file called 'cryptshare.properties' into the Cryptshare installation folder, certain parts of the Cryptshare Server can be influenced in their behavior. These settings are intended for use when experiencing problems with the Cryptshare Server. As of now, settings regarding the following parts of the application can be made:
- Optimizing the database
- Skipping of certain operations during cleanup (Cleanup Task)
- Sizing of the thread pool for encryption threads
- Maximum timeout for a pending Backup Task
- Navigate to the Cryptshare installation folder and create the file 'cryptshare.properties'
- Add the desired configuration flags to the file. One flag per line:
- Save the changes
cryptshare.properties - Example file \# EN: Documentation see here: https://wiki.cryptshare.com/x/TgBC com.befinesolutions.cryptshare.html5.client.maxerrors=100com.befinesolutions.cryptshare.threadPoolSize = 150
Database Connection Pool
Depending on the requirements of your Cryptshare Server and the expected load it might be necessary to increase resource allocation for the database.
Calculating Pool Sizes
The following formula can be used to calculate an appropriate pool size:
|`(cpu_core_count *` `2` `) +` `1`|
Here are some examples with the pool size rounded up:
Database Optimization com.cryptshare.server.database.connection.maxPoolSize=<int> com.cryptshare.server.database.connection.minIdlePoolSize=<int>
Skipping Cleanup Task Steps
The cleanup task consists of several steps executed in subsequent order. If due to database inconsistencies or internal database errors one of these steps cannot finish its operations properly or gets stuck, the respective step can be skipped in order to be able to finish the rest of the cleanup operation.
Steps which can be skipped
In order to find out which cleanup step is responsible for errors you can check the system log and deactivate this step by applying the respective Cryptshare system property.
LockData Cleanup Step
com.befinesolutions.cryptshare.cleanup.skip.lockData = <true|false>
LockData is an internal record keeping track of wrong-password attempts within the Cryptshare download section. This data will be removed from the system as soon as it is not required anymore. For instance if a transfer record has been archived.
Verification Cleanup Step
com.befinesolutions.cryptshare.cleanup.skip.verifications = <true|false>
Verification records are the server-side representation of verified users. Expired verifications will be removed from the system.
Timeout for pending BackupTask
If the database backup has been enabled, the backup task is configured to wait for other tasks to finish their operations before executing the backup. However it can happen, that theses tasks are not finished properly so that the backup task would be waiting infinitely. The maximum timeout setting configures the backup task to continue with its operations regardless of the fact that there are still running tasks. The default value is set to 60 minutes.
Encryption Thread Pool
The size for the Cryptshare encryption thread pool defines the amount of parallel file encryption operations for Cryptshare Transfers. The default setting is set to 50. This means, that on a Cryptshare server with this setting 50 parallel encryption processes can be initiated. The next process which would exceed this maximum will be put into a queue and will be started as soon as a thread from this pool is available again.
- A high value for this setting will INCREASE the CPU usage
- A low value for this setting will DECREASE the CPU usage
Parameter for the Thread pool size com.befinesolutions.cryptshare.mainPoolSize=<int>
Download Decryption Buffer
The default setting for the decryption buffer is 2MB. This is a good setting for a server handling both, small and large files. If the server however is mostly handling larger files, increasing the buffer size can considerably improve the CPU consumption. However, this will increase memory usage.
Parameter for the decryption buffer size com.befinesolutions.cryptshare.decrypt.buffer=<int>
Under high load, the Cryptshare Server delays the decryption of files being downloaded to improve responsiveness of the Cryptshare Server. This behavior can be disabled if it causes problems.
Parameter for the decryption buffer size com.befinesolutions.cryptshare.decrypt.delay=<true|false>
HTML5 Transfer Settings
HTML5 Parallel Upload Streams
Parameter for parallel HTML5 upload streams com.befinesolutions.cryptshare.html5.client.parallel=<int>
Default: 5Maximum: 5
HTML5 Cleanup Tracker Timeout
On bad internet connections however, the default timeout setting of 10 minutes can be too short and ongoing HTML5 uploads are interrupted before the transfer is complete.In order to avoid this behavior, the default timeout setting can be increased.
Cleanup Tracker Timeout com.befinesolutions.cryptshare.html5.server.timeout = <timeout in minutes>
Default: 10Allowed: Integer between 1 and 60
HTML5 Client Error Count
If such an error occurs the client will try to re-send the failed packages until either all packages were transferred successfully or the error counter has exceeded. In case the error count has exceeded the client will cancel the transfer.If your clients often run into this problem it is possible to increase the maximum error count so that clients won't cancel a transfer so quickly.
HTML5 Client Error Count com.befinesolutions.cryptshare.html5.client.maxerrors = <20-5000>
To increase the performance of LDAP requests, Cryptshare uses a pool of already established connections. They can be used and re-used for LDAP requests. It is possible to configure the minimum (initial) and maximum number of simultaneously established connections.
Initial number of connections com.befinesolutions.cryptshare.ldap.initialConnections=<int> Maximum number of connections com.befinesolutions.cryptshare.ldap.maxConnections=<int>
Default initial number: 5Default maximum number: 20
A timeout specifies the maximum time that is allowed to perform a certain task. Regarding LDAP, there are two timeouts that can be configured: Connection timeout: Allowed time to establish a connection to an LDAP server. Response timeout: Allowed time recieve a response to a submitted request.
Connection timeout com.befinesolutions.cryptshare.ldap.connectTimeout=<int> Request timeout com.befinesolutions.cryptshare.ldap.responseTimeout=<int>
Default connection timeout: 5000 (5 seconds)Default response timeout: 20000 (20 seconds)
Some LDAP directories are partitioned / distributed and contain entries that refer to other directories (so-called referrals). Optionally, the automatic resolution of these references through an additional connection can be enabled. If the resolved reference again contains a reference, this will not be resolved.
Referral resolution com.befinesolutions.cryptshare.ldap.followReferrals=<true|false>
Security Setting Rate Limiting
Rate Limiting for Requesting a Verification Code
In order to limit the number of verification requests per minute to prevent DoS attacks and mail flooding, rate limiting for requesting a verification code is active. The number of verification codes that can be requested per minute is limited to 25 by default.
Parameter for setting a rate limit for requesting a verification code com.befinesolutions.cryptshare.verification.verificationsPerMinute=<int>
Default: 25This feature is deactivatable by setting the value to 0.
Prioritisation of file types in EML Archiving and EML Download
Priorization of file types for EML Archiving and EML Download
Using EML archiving and EML Download it is possible to set a attachment total file size limit for attachments put into the generated EML file. When the total attachment file size exceeds the set limit, files are attached to the EML file using a priorization list of file types where file type extensions at the start have a higher priority than those after them. File types not in the list have the lowest priorty. If an empty string is provided as priorization list, this file type priorization behaviour is disabled.
Parameter for setting the priorization list of attachments when reaching the file size limit com.cryptshare.eml.attachmentFileTypeOrder=<csv>
Further Configuration Flags
XML Service Interface: Password Validation
With Cryptshare v18.104.22.168 or higher, the XML Service Interface used by the Cryptshare Robot, Cryptshare for Notes (up to v2.9.x) and Cryptshare for Outlook (up to v1.6.3) will validate a given transfer password. If the password does not comply with the password quality settings on the server, the transfer will be declined. For these products the password validation can be deactivated as they are neither capable of validating nor creating passwords according to the password policy specifications. This can cause transfers to be declined although the client has accepted the given password.
Parameter for disabling password validation for the XML interface com.befinesolutions.cryptshare.xmlservice.validatePW=<true|false>
Cleaning up orphaned temporary upload files
While files are being uploaded during a transfer, this data is written to a temporary upload directory. Due to technical reasons it is however possible that those files are not always deleted afterwards. Therefore an additional cleanup step which is executed during the execution of the Cleanup Task takes care of those orphaned files and removes them from the disk if they are older than 24 hours.
Parameter for disabling the temporary file Cleanup Step com.befinesolutions.cryptshare.cleanup.skip.tmpfiles=<true|false>
Log Verbosity for ongoing uploads
In order to enable the administrator to better notice running uploads, an informal log entry is written after a certain number of upload requests. A file upload usually consists of several upload requests. The counting is done across transfers.
INFO 2016-04-29 08:45:51 CS3System - (com.befinesolutions.wicket.request.HTML5FileItemFactory@1771fb9f) - Cryptshare upload in progress.
Depending on the upload activity of this server there might be too many or to few of these entries. In either way, the counter for this feature can be changed accordingly.
Parameter for controlling how many upload log-entries will be written to the log com.befinesolutions.cryptshare.upload.logverbosity=<int>
Performing a backup before an update
Usually before an update is performed, a rollback-compatible backup will be made. In case, there's something wrong with the backup procedure so that it avoids performing the update, this step can be disabled.
Parameter for enabling backups before an update com.befinesolutions.cryptshare.update.backup=<true|false>
The Content Viewer in the download section of Cryptshare only opens files smaller than 2MB. For security reasons the viewer only opens these files in memory which can massively increase the memory consumption.