CSSCurrent en:Advanced Configuration
By placing an additional settings file called 'cryptshare.properties' into the Cryptshare installation folder, certain parts of the Cryptshare Server can be influenced in their behaviour. These settings are intended for use when experiencing problems with the Cryptshare Server. As of now, settings regarding the following parts of the application can be made:
- Optimizing the database
- Skipping of certain operations during cleanup (Cleanup Task)
- Sizing of the thread pool for encryption threads
- Maximum timeout for a pending Backup Task
- Navigate to the Cryptshare installation folder and create the file 'cryptshare.properties'
- Add the desired configuration flags to the file. One flag per line:
<configuration-flag>=<configuration-value>
- Save the changes
# EN: Documentation see here: https://documentation.cryptshare.com/w/CSSCurrent_en:Advanced_Configuration upload.html.maxerrors=100 mainPoolSize = 150
Database
Database Connection Pool
Depending on the requirements of your Cryptshare Server and the expected load it might be necessary to increase resource allocation for the database.
Calculating Pool Sizes
The following formula can be used to calculate an appropriate pool size:
| (cpu_core_count * 2) + 1 |
Here are some examples with the pool size rounded up:
| CPU Cores | 2 | 4 | 8 | 16 |
|---|---|---|---|---|
| Pool Size | 5 | 10 | 20 | 35 |
Database Optimization
database.connection.maxPoolSize=<int> database.connection.minIdlePoolSize=<int>
Skipping Cleanup Task Steps
The cleanup task consists of several steps executed in subsequent order. If due to database inconsistencies or internal database errors one of these steps cannot finish its operations properly or gets stuck, the respective step can be skipped in order to be able to finish the rest of the cleanup operation.
Steps which can be skipped
In order to find out which cleanup step is responsible for errors you can check the system log and deactivate this step by applying the respective Cryptshare system property.
LockData Cleanup Step
cleanup.skip.lockData = <true|false>
LockData is an internal record keeping track of wrong-password attempts within the Cryptshare download section. This data will be removed from the system as soon as it is not required any more. For instance if a transfer record has been archived.
Verification Cleanup Step
cleanup.skip.verifications = <true|false>
Verification records are the server-side representation of verified users. Expired verifications will be removed from the system.
Timeout for pending BackupTask
If the database backup has been enabled, the backup task is configured to wait for other tasks to finish their operations before executing the backup. However it can happen, that theses tasks are not finished properly so that the backup task would be waiting infinitely. The maximum timeout setting configures the backup task to continue with its operations regardless of the fact that there are still running tasks. The default value is set to 60 minutes.
backup.maxWait=<int>
Default: 60
Performance Adjustment
Encryption Thread Pool
The size for the Cryptshare encryption thread pool defines the amount of parallel file encryption operations for Cryptshare Transfers. The default setting is set to 30. This means, that on a Cryptshare server with this setting 30 parallel encryption processes can be initiated. The next process which would exceed this maximum will be put into a queue and will be started as soon as a thread from this pool is available again. This parameter not only influences the size of the encryption thread pool, but also affects the number of parallel gathering processes of the pre-processing result, if the display of pre-processing results is activated.
- A high value for this setting will INCREASE the CPU usage
- A low value for this setting will DECREASE the CPU usage
Parameter for the encryption thread pool size
mainPoolSize=<int>
Default: 30
Mailing Thread Pool
The size for the Cryptshare mailing thread pool defines the amount of parallel mail sending operations. Please note that email servers often only allow a limited number of simultaneous connections. If you adjust this parameter, make sure that your email server is able to handle this increased quantity.
Parameter for the mail thread pool size
mailingPoolSize=<int>
Default: 5
Download Decryption Buffer
The default setting for the decryption buffer is 2MB. This is a good setting for a server handling both, small and large files. If the server however is mostly handling larger files, increasing the buffer size can considerably improve the CPU consumption. However, this will increase memory usage.
Parameter for the decryption buffer size
decrypt.buffer=<int>
Default: 2097152 (2MB)
Download Delay
Under high load, the Cryptshare Server delays the decryption of files being downloaded to improve responsiveness of the Cryptshare Server. This behavior can be disabled if it causes problems.
Parameter for the decryption buffer size
decrypt.delay=<true|false>
HTML5 Transfer Settings
HTML5 Parallel Upload Streams
Parameter for parallel HTML5 upload streams
upload.html.parallel=<int>
Default: 5
Maximum: 5HTML5 Cleanup Tracker Timeout
On bad internet connections however, the default timeout setting of 10 minutes can be too short and ongoing HTML5 uploads are interrupted before the transfer is complete.
In order to avoid this behavior, the default timeout setting can be increased.Cleanup Tracker Timeout
upload.html.timeout = <timeout in minutes>
Default: 10
Allowed: Integer between 1 and 60HTML5 Client Error Count
If such an error occurs the client will try to re-send the failed packages until either all packages were transferred successfully or the error counter has exceeded. In case the error count has exceeded the client will cancel the transfer.
If your clients often run into this problem it is possible to increase the maximum error count so that clients won't cancel a transfer so quickly.HTML5 Client Error Count
upload.html.maxerrors = <20-5000>
Default: 100
Allowed: 20-5000LDAP Settings
Connection pool
To increase the performance of LDAP requests, Cryptshare uses a pool of already established connections. They can be used and re-used for LDAP requests. It is possible to configure the minimum (initial) and maximum number of simultaneously established connections.
Initial number of connections ldap.initialConnections=<int>
Maximum number of connections ldap.maxConnections=<int>
Default initial number: 5
Default maximum number: 20Alternatively, connection pools can be deactivated completely. When deactivated, the parameters ldap.initialConnections and ldap.maxConnections won't have an effect anymore. By default, connection pools are activated and can be deactivated, if necessary.
Usage of connection pools ldap.connectionPooling = <true|false>
Timeouts
A timeout specifies the maximum time that is allowed to perform a certain task. Regarding LDAP, there are two timeouts that can be configured: Connection timeout: Allowed time to establish a connection to an LDAP server. Response timeout: Allowed time recieve a response to a submitted request.
Connection timeout
ldap.connectTimeout=<int>
Request timeout
ldap.responseTimeout=<int>
Default connection timeout: 5000 (5 seconds)
Default response timeout: 20000 (20 seconds)Referrals
Some LDAP directories are partitioned / distributed and contain entries that refer to other directories (so-called referrals). Optionally, the automatic resolution of these references through an additional connection can be enabled. If the resolved reference again contains a reference, this will not be resolved.
Referral resolution
ldap.followReferrals=<true|false>
Security Setting Rate Limiting
Rate Limiting for Requesting a Verification Code
In order to limit the number of verification requests per minute to prevent DoS attacks and mail flooding, rate limiting for requesting a verification code is active. The number of verification codes that can be requested per minute is limited to 25 by default.
Parameter for setting a rate limit for requesting a verification code
verification.verificationsPerMinute=<int>
Default: 25
This feature is deactivatable by setting the value to 0.Content Security Policy
Content Security Policy (CSP) is an additional security mechanism that helps to detect and mitigate certain types of attacks, e.g. Cross-Site Scripting (XSS). For this purpose, a so-called CSP header can be used, which allows the client(browser) to access only certain defined resources. This can prevent e.g. an attacker from executing malicious code from an unknown source. By default, the Cryptshare server only allows the use of resources from the server's domain.
Parameter for adding other urls as resources
csp.fetchDirectives.urls=<string>
Example: To add the additional URLS 'https://example.com' and 'https://app.example.com/images', set the value to 'https://example.com,https://app.example.com/images'
Prioritisation of file types in EML Archiving and EML Download
Priorization of file types for EML Archiving and EML Download
Using EML archiving and EML Download it is possible to set a attachment total file size limit for attachments put into the generated EML file. When the total attachment file size exceeds the set limit, files are attached to the EML file using a priorization list of file types where file type extensions at the start have a higher priority than those after them. File types not in the list have the lowest priorty. If an empty string is provided as priorization list, this file type priorization behaviour is disabled.
Parameter for setting the priorization list of attachments when reaching the file size limit
eml.attachmentFileTypeOrder=<csv>
Further Configuration Flags
Cleaning up orphaned temporary upload files
While files are being uploaded during a transfer, this data is written to a temporary upload directory. Due to technical reasons it is however possible that those files are not always deleted afterwards. Therefore an additional cleanup step which is executed during the execution of the Cleanup Task takes care of those orphaned files and removes them from the disk if they are older than 24 hours.
Parameter for disabling the temporary file Cleanup Step
cleanup.skip.tmpfiles=<true|false>
Log Verbosity for ongoing uploads
In order to enable the administrator to better notice running uploads, an informal log entry is written after a certain number of upload requests. A file upload usually consists of several upload requests. The counting is done across transfers.
INFO 2016-04-29 08:45:51 CS3System - (com.cryptshare.wicket.request.HTML5FileItemFactory@1771fb9f) - Cryptshare upload in progress.
Depending on the upload activity of this server there might be too many or to few of these entries. In either way, the counter for this feature can be changed accordingly.
Parameter for controlling how many upload log-entries will be written to the log
upload.logverbosity=<int>
Performing a backup before an update
Usually before an update is performed, a rollback-compatible backup will be made. In case, there's something wrong with the backup procedure so that it avoids performing the update, this step can be disabled.
Parameter for enabling backups before an update
update.backup=<true|false>
The Content Viewer in the download section of Cryptshare only opens files smaller than 2MB. For security reasons the viewer only opens these files in memory which can massively increase the memory consumption.
Increasing the maximum file size of the Content Viewer
viewer.maxSize = <int>
Default: 2
File Type Filter Max. Buffer Size
When the embedded file analysis of the file type filter is active, supported files are opened and scanned for their contents. In the case of MS Office files, this analysis can require large amounts of memory when working with larger files. If files cannot be scanned due to this, the following parameter can be set to a large value to allow scanning these files, at the cost of increased memory consumption.
Increasing the maximum buffer size when analyzing office files
fileTypeFilter.byteArrayMax= <int>
Default: 100000000 (100 Million Bytes = 100 MB)
Virtual Hosts Restriction
By default, the Cryptshare Server will respond to HTTP requests regardless of the contents of the 'Host'-header. To protect against Host-Header-Injection-Attacks, the server can be configured to block requests with a Host-header that is not the canonical host of this system.
Restrict Host-headers
virtualHosts.restrict= <true|false>
Default: false
Additional Virtual Hosts
If `virtualHosts.restrict` is enabled, `virtualHosts.additional` can be used to add additional hosts the server is available under.
Add additional virtual host
virtualHosts.additional= <string>
Default: ""
Example: To add the additional virtual hosts 'example.com' and 'app.example.com', set the value to 'example.com,app.example.com'