Parental control

Several methods exist to protect and limit child activity on a computer.
Note
Any security features will be effective only on the level you enforce them. For example, even after installing a parental control application in the operating system, the child may bypass it by downloading and booting any Linux distribution live image.
Applications
timekpr-next
— Timekpr-nExT, a fresh, simple and easy to use screen time managing application that helps optimizing time spent at computer.
https://mjasnik.gitlab.io/timekpr-next/
||
timekpr-next
AUR
timeoutd
— A lightweight alternative to timekpr, it scans
/var/run/utmp
every minute and checks
/etc/timeouts
for an entry matching a restricted user.
https://github.com/sohonet/timeoutd
||
timeoutd
AUR
logkeys
— A daemon that logs keypresses into a logfile for later inspection.
https://github.com/kernc/logkeys
||
logkeys
AUR
Restrict opening applications
malcontent
allows setting access restrictions for
flatpak
based applications.
malcontent-client set-app-filter timmy x-scheme-handler/http
This will disallow the user timmy from opening a web browser provided by Flatpak.
Whitelist with Tinyproxy and Firehol
The following description will enable you to filter any user's access to the internet with a whitelist of url-s using
firehol
AUR
and
tinyproxy
(or
tinyproxy-git
AUR
).
/etc/tinyproxy/tinyproxy.conf
consists of the following changes:
FilterURLs On
FilterDefaultDeny Yes
Filter "/etc/tinyproxy/whitelist"
/etc/tinyproxy/whitelist
should hold the url's that will be only allowed accessed by selected users. A silly example:
(www|wiki|static).archlinux.org
google.com
/etc/firehol/firehol.conf
should contain the following line:
transparent_proxy "80 443" 8888 "nobody root bin myaccount"
where myaccount is my account that should not be filtered by Tinyproxy.
OpenDNS Parental Control
OpenDNS
provides free DNS services as an alternative to your ISP's default servers. Furthermore, they provide optional filtering capabilities. Different levels of filtering is possible; see the OpenDNS main page for details.
For dynamic IP addresses, it is a good idea to keep them updated on OpenDNS. Use
ddclient
and edit
/etc/ddclient/ddclient.conf
as follows:
# OpenDNS.com account-configuration
use=web, web=myip.dnsomatic.com
server=updates.opendns.com
protocol=dyndns2
login=myopendns@email.address
password=myopendnspassword
myhostname
You may sometimes even set up your router to use OpenDNS, therefore allowing protection spanning on all devices connected to that router.
Editing /etc/hosts
You may configure your
/etc/hosts
file to block access to certain domains. A more draconian approach is to only allow domains explicitly stated in
/etc/hosts
, as described
here
. If you do this, please remember that this will affect your whole system, so for example pacman may be unable to connect to the update server unless you make a proper binding in your
/etc/hosts
.
Blocklisting using named
See also:
BIND
Create stub zone file ("/var/named/denied.zone") that redirects everything to localhost
@                               1D IN SOA   ns1.example.com. root.example.com. (
                                   42    ; serial (yyyymmdd##)
                                   3H    ; refresh
                                   15M   ; retry
                                   1W    ; expiry
                                   1D )  ; minimum ttl
                               1D  IN  NS      ns.example.com.
                      1D  IN  A       127.0.0.1
                      1D  IN  AAAA    ::1

*                      1D  IN  A       127.0.0.1
*                      1D  IN  AAAA    ::1
Add
zone "SOME-DOMAIN-1.TLD" IN { type master; file "denied.zone"; };
...
zone "SOME-DOMAIN-N.TLD" IN { type master; file "denied.zone"; };
to named.conf.
Recent named versions support DoT and DoH, so you can expose named to internet and use it from outside your lan.
(For example Firefox can use DoH, android devices has global "private DNS server" setting for DoT)
Squid
Squid
is feature reach proxy that supports authorization, caching, TLS bumping, transparency with firewall, access lists based on MAC, IP, domain, and TLS SNI.
It has separate
article
.
In combination with
nftables
,
Squid
can be used to fully control which websites can be browsed by the children (see
[1]
).
Browser add-ons
Several add-ons exist for web browsers to filter web content. Some of them can even block out pages examining on their body, not only on their URL. Be warned, however, that this is not a very secure way. Starting Firefox in safe mode, messing with the Firefox profile directory or Firefox profile manager are obvious ways to attempt to shut down Firefox-based add-ons. If all else fails, the kid may simply use a different browser.