Parental controls with different settings for different users

Question

Does anyone know of a good way to set up some sort of parental controls so that one user account is subject to them, but not another?

A couple of friends of mine use Ubuntu and have kids (7 to 10 years old) who use the family computer. They'd like to have some blocking of adult sites. They're not going to supervise all the time, which I know might be ideal, but there we go. And they're not particularly technical, so they don't want to have to run scripts to turn the parental controls on and off regularly, but they can cope with having different accounts for different people. I haven't found a great way of doing this. I am pretty technical, so I'm happy to spend some time at the command line to set it up, but then it needs to just work.

Please don't just link to DansGuardian. If your answer doesn't address the different user account aspect, I will vote it down. If you want to talk about general parental controls that apply to all users then please start a new question - I'm sure that plenty of people would be interested in it, and I'll link to it from this question.

Solution 1

Gnome Nanny looks like it would meet the needs of your friends perfectly. To quote the website:

Gnome Nanny is an easy way to control what your kids are doing in the computer. You can limit how much time a day each one of them is browsing the web, chatting or doing email. You can also decide at which times of the day the can do this things. Gnome Nanny filters what web pages are seen by each user, so you can block all undesirable webs and have your kids enjoy the internet with ease of mind, no more worries!

As you can see, Nanny can set different restrictions for each account. nanny 2.29.4-0ubuntu4 is available in the maverick and natty universe repositories. It is also part of Edubuntu. Screenshots of Nanny running on Edubuntu are available on the Edubuntu website.

Solution 2

DansGuardian ;-), but with a twist -- the trick is to set up transparent proxying (filtered by DansGuardian) and use iptables to redirect children's accounts only to the proxy. Parents would have normal direct connection to the network.

Here's a sketch of how to do it:

1. Set up DansGuardian and Squid for transparent proxying. Ignore all the iptables/redir setup, because we're doing it in later steps.

2. Set up a netfilter chain for transparent proxying:

    iptables -t nat -N transparent-proxy 
    iptables -t nat -A transparent-proxy -p tcp --dport 80 -j DNAT --to-destination :8080
   

   (Assuming you have configured DansGuardian to listen on port 8080.)

3. Now you should set up an iptables chain so that only packets originating from selected local accounts are sent to the transparent proxy; all the others flow undisturbed. Netfilter has a owner match for this:

   iptables -t nat -A OUTPUT -m owner --uid-owner child_uid -j transparent-proxy
   

Solution 3

There are several firefox addons that offer content filtering. I believe this is a good solution for what you want because browser extensions are installed on a per-user basis.

You can find such addons on the firefox addons site. An example of a content filtering extension is ProCon Latte.

Besides web safety, children should have a seperate non-administrator login, to prevent them doing system changing activities such as installing new software (such as a different browser to bypass the parental controls).

Comments

[Oli]

Should note that if they're installed on a per-user basis, they're a lot easier to side-step by the user. IMO restrictions should be root or even network level to stop people just going around them. (PS: sorry for the super-late comment)

[Julian Knight]

If you are going to go to this trouble, you should also ensure that the router only accepts traffic from the proxy. Otherwise, when the child hacks Ubuntu (or more likely, just uses another device), they will be able to get round it.

[lamcro]

Can you also control what installed applications they can use? Such as games, and media players.