HOWTO: Parental control. Now with GUI too! (updated version)

[KIAaze]

Description:
WebContentControl is a parental control GUI (more specifically a GUI for DansGuardian+TinyProxy+FireHol).

Official website: https://launchpad.net/webcontentcontrol

Feedback is very welcome. And help too!

Please report bugs at https://bugs.launchpad.net/webcontentcontrol

Pre-Installation:
Please make sure you have the "universe" repository enabled.

Go to System->Administration->Software sources and check the "universe" repository.
More info: https://help.ubuntu.com/community/Repositories/Ubuntu

Installation:
There are three ways to install WebContentControl:
1)Through the PPA repositories
2)From the Debian package
3)From source

1)Through the PPA repositories

deb http://ppa.launchpad.net/webcontentcontrol/webcontentcontrol/ubuntu lucid main 
deb-src http://ppa.launchpad.net/webcontentcontrol/webcontentcontrol/ubuntu lucid main

See here for how to add repositories:
https://help.ubuntu.com/community/Repositories/Ubuntu

Add the repos by command-line:

sudo add-apt-repository ppa:webcontentcontrol/webcontentcontrol
sudo apt-get update

Once you've added those repositories, just:

sudo apt-get install webcontentcontrol

(Or use Synaptic package manager if you prefer a GUI.)

2)From the Debian package
Download the latest .deb from the site and double-click on it or by command-line:

sudo gdebi <package>.deb

3)From source

sudo apt-get install gambas2-runtime gambas2-gb-qt gambas2-gb-form gambas2-gb-form-dialog gambas2-gb-qt-kde gambas2-gb-qt-kde-html
sudo apt-get install dansguardian tinyproxy firehol

Then download the latest version on https://launchpad.net/webcontentcontrol/+download and:

tar -xzvf webcontentcontrol-1.0.tar.gz
cd webcontentcontrol-1.0
./configure && make && sudo make install

The shortcut should be created in Applications->System tools.
If it isn't, the command-line to launch it is:

/usr/bin/webcontentcontrol

How to uninstall it:

sudo make uninstall

____________________________________

List of filtering solutions/projects:

• WebContentControl: https://launchpad.net/webcontentcontrol
• Webstrict: http://www.ubuntume.com/webstrict + https://launchpad.net/webstrict
• GChildCare (not yet available): https://launchpad.net/gchildcare
• UbuntuCE's Parental control GUI: http://linux.softpedia.com/get/Secur...ol-24501.shtml
• Squid+Squidgard:
  https://help.ubuntu.com/community/SquidGuard + http://www.squidguard.org/
• SmoothGuardian (by the creator of DansGuardian, commercial version with web-based easy to use interface): http://smoothwall.net/products/smoothguardian2008/ + http://dansguardian.org/?page=smoothwall
• MintNanny: http://www.linuxmint.com/blog/?p=350
• MoBlock, an IP blocker: http://moblock.berlios.de/
• TimeKpr, track and control account usage: https://launchpad.net/timekpr
• Discussion about K9 web protection GNU/Linux port: http://forums.bluecoat.com/viewtopic...=a&hilit=linux (suggested by eric.duveau)
• Mandriva Linux Parental Control: DrakGuard: http://www.mandriva.com/enterprise/e...ux-2008-spring and http://rpm.pbone.net/index.php3/stat...oarch.rpm.html
• A content filtering solution for Linux-based netbooks (proprietary): http://www.mobicip.com/online_safety/netbooks
• Gnome Nanny (under development): http://projects.gnome.org/nanny/

DNS filtering:

• OpenDNS (suggested by forger): http://www.opendns.com/
• GNU/Linux Desktop parental control based on Opendns.com by Eric Duveau: http://forums.opendns.com/comments.p...#Comment_18690
• ScrubIT: http://www.scrubit.com/

Kiosk specific (for internet cafes, etc):

• Kiosk: http://kiosk.mozdev.org/
• Lock down KDE settings: http://jriddell.org/programs/kiosk-article.html
• Lock down Gnome settings + disable virtual terminals: http://www.redhat.com/docs/manuals/e...mand-line.html
• Disable ctrl+alt+backspace: http://www.redhat.com/docs/manuals/e...f-serverf.html
• KDE Kiosk Admin Tool: http://extragear.kde.org/apps/kiosktool/
• Ubuntu server and DansGuardian for filtering public wireless access: http://www.branchdistrictlibrary.org...nsguardian.php

Firefox specific:

• http://kb.mozillazine.org/Parental_controls

Firewalls and blocking MSN:

• NuFW: An authenticating firewall: http://www.nufw.org/
• How to block MSN: http://blog.eglis.com/index.php/post...e-protocol-MSN (French)

For Windows:

• LogProtect (Windows only, but Free/Libre Software): http://www.logprotect.fr/
• K9 Web Protection (proprietary): http://www1.k9webprotection.com/
• Time control on Windows: http://www.dougknox.com/xp/tips/xp_restrict_users.htm and http://www.builderau.com.au/program/...9282967,00.htm

Useful links:

• Setup without iptables: http://www.vollmar.ch/dansguardian-e.html
• Sarg - Squid Analysis Report Generator: http://sarg.sourceforge.net/sarg.php
• DansGuardian Documentation Wiki: http://contentfilter.futuragts.com/w...?id=main_index

How it works:
Note: Tinyproxy is equivalent to Squid and Firehol is equivalent to iptables (FireHol manages iptables).

• http://dansguardian.org/?page=dgflow (except that WebContentControl forces the use of the proxy through FireHol)
• http://www.zephyrsoft.net/files/linu...ring-howto.pdf (Picture inside, as well as script for mailing banned sites access attempts to someone)

If you know other projects, useful links, etc, please tell me so I can add them to the list.

FAQ, troubleshooting and tips:

1. Is user-specific configuration possible?
   Not yet. But you can do it manually.
   It requires setting up some authentication method (so that dansguardian can identify the user).
   I managed to do it using squid (webcontentcontrol uses tinyproxy instead):
   http://tech.groups.yahoo.com/group/d.../message/22651
   See here for more info:
   http://contentfilter.futuragts.com/w...cation_methods
   http://contentfilter.futuragts.com/w..._configuration
   
2. If the internet doesn't work anymore or isn't filtered: Please post the contents of the following files:
   

   /etc/dansguardian/dansguardian.conf
   /etc/tinyproxy/tinyproxy.conf
   /etc/firehol/firehol.conf

   and also the output of this command:
   

   sudo lsof -i :8080

3. If almost everything you google gets blocked: Just turn on Google safe mode again.
   
4. Filtering not working over wireless?
   Three solutions:
   1)Lock WPA interfaces by clicking on the "WPA interfaces unlocked" button.
   2)Lock the firefox proxy settings from the GUI and disable/uninstall all other browsers (or lock their proxy settings to port 8080 if you know how to do it).
   3)Restart FireHol after wireless has started.
   
5. SSL not blocked?
   You have to lock down the browser settings for this to work. cf explanation above.
   
6. Dansguardian tweaking tips:
   Use http://urlblacklist.com/ or http://www.shallalist.de/ (suggested by eric.duveau)
   
7. Also, it's useful to comment out "japanese pornography" in the weightedphraselist, as well as whitelist all webmail sites in the "exceptionsitelist".
   
   /etc/dansguardian/lists/exceptionsitelist:
   

   ...
   .Include</etc/dansguardian/lists/blacklists/mail/domains>
   ...

   /etc/dansguardian/lists/exceptionurllist:
   

   ...
   .Include</etc/dansguardian/lists/blacklists/mail/urls>
   ...

   /etc/dansguardian/lists/weightedphraselist:
   

   ...
   ##.Include</etc/dansguardian/lists/phraselists/pornography/weighted_japanese> #ALPHA#
   ...

   ...because some valid sites tend to get blocked by it due to some strange encoding problems.
   
8. Don't forget to prevent getting any filesharing program (or configure your firewall to block ports):
   /etc/dansguardian/lists/bannedsitelist:
   

   ...
   .Include</etc/dansguardian/lists/blacklists/filesharing/domains>
   ...

   /etc/dansguardian/lists/bannedurllist:
   

   ...
   .Include</etc/dansguardian/lists/blacklists/filesharing/urls>
   ...

   An interface to select categories from the blacklists directory is planned.
   
9. How to disable X11 forwarding in openssh:
   I created a patch for this, which you can get here: http://bazaar.launchpad.net/%7Ezohn-...sableX11.patch
   Download openssh-5.2p1.tar.gz from http://www.openssh.com/
   Then just:
   

   tar -xzvf openssh-5.2p1.tar.gz
   cd openssh-5.2p1
   patch -p2 < ../openssh-5.2p1_disableX11.patch
   ./configure
   make
   sudo make install

10. Using a custom proxy (like squid):
    I added the possibility to disable filtering configuration during install, as well as choose a custom proxy!
    
    Just do the following to use squid instead of tinyproxy:
    

    bzr branch lp:webcontentcontrol
    cd webcontentcontrol
    ./configure --with-proxy=squid --disable-config  && make && sudo make install

    For now you'll have to configure the .conf files yourself of course.
    But at least, you'll be able to use the GUI to start/stop the filtering and open the .conf files.
    Setting ports will probably not work correctly since it was made for tinyproxy.conf.
    
    Please let me know how it works and also post your squid.conf, so I can adapt the install process for it (if you want to have a go at it yourself, look at WCCDIR/scripts/install.sh).
    If it works, I'll make a quick release of it.
    

____________________________________

The rest of this post should now hopefully be unnecessary.

If you want to set up such a system manually without the GUI, here's a very helpful guide which also explains how it works:
http://www.pilpi.net/journal/item-985.php

=======================================
06/09/2008: UPDATE
I started uploading my code to launchpad for version control (&bug reports+ distribution):
https://launchpad.net/webcontentcontrol

I also joined the GChildCare project and plan to help it. So this is only a project to get a working GUI quickly up and running.

Until this is the case, please follow the instructions below.
=======================================

This "Howto" is an updated version of this one:
http://ubuntuforums.org/showthread.php?t=226298

Downloads are at the bottom of this post.
Note: WebContentControl.tar.gz is meant for developers and contains the source code of a new GUI I'm working on.

The original GUI was made by nanomad. I just made a few changes so that it should work "out of the box".
I created a new thread because nanomad stopped updating the other one.
If you still encounter problems, please tell me.

Here is a simple (but powerful) install script for a parental control feature It is based on tinyproxy + firehol + dansguardian. Download the attached archive, extract it and run the script (2x click or from a terminal) (There are a couple of hidden files and folder too in the archive) It will d/l, install and configure all you need + install a GUI created by me to configure everything (it is located under System --> Administration)

Note:
Another parental control GUI is available from Ubuntu ME here:
http://www.ubuntume.com/webstrict

However, it is browser dependent, meaning that it will only work with properly configured browsers. In other words, it can easily be bypassed by using another browser or changing the browser config if it isn't locked.
An easy way to fix this is installing firehol. However, it is then also necessary to configure it correctly...

If I have time, I might try using their nice GUI with the browser-independent system from the one given here.

For Hardy and later versions:
gambas-runtime has been replaced by gambas2-runtime, so until the GUI is made compatible with the new version, you may download&install the old gambas-runtime here:
http://packages.ubuntu.com/gutsy/gambas-runtime

Troubleshooting: If you are having problems:
1)Please post the console output of the installation process (just rerun the installation and copy/paste the output before closing the terminal window)
An easier way to do this (until I add automatic log creation ):
For installation problems:

./.setup 1>install.log 2>&1

For uninstallation problems:

./.remove 1>uninstall.log 2>&1

2)If the GUI won't launch: post the output of the following command:

/usr/local/apps/parental-control/ubuntu_parental_control_gui

[WhiteJedi]

Thanks for the information very useful, now I have a ? do I need to install the script on every User Profile?

thanks

WJ

[KIAaze]

No, you shouldn't have to. I have not yet tested it, but it should work for all users.

The programs (tinyproxy, dansguardian, firehol, gambas) get installed the standard way from the repositories, so they are certainly available for all users.
The GUI gets installed for all users too (/usr/local/bin/ + /usr/local/apps/parental-control).

The only potential problem might be the configuration files, but it seems they are user independant.

__________
Speaking of configuration files, I just noticed my package doesn't contain the custom dansguardian.conf made by nanomad...
Will correct that immediately.
edit: Seems there is no custom dansguardian.conf. It just uses the default one and comments out the "unconfigured" line. ^^'
__________

P.S:
Thanks to the admins for accepting this updated thread version.

[zedstrange]

Thanks but not working for me - am using 8.04 Edubuntu.
Installed the script, and when run the main Application Parental Control Filter a terminal screen flashes up for a split second and closes.

And Browsing is completly blocked.

I also noticed during the installation process at the language select page, there was not an option to choose English.

Sorry cant give much more info, but if ya give me a clue i might?

p.s. I set it up on another computer running plain old Ubuntu 8.04 and problem repeats exactly the same.

[KIAaze]

Sorry for the delay.
Yes, I know about the language selection problem.
It seems to be due to a limitation of the number of options in zenity (GUI system used in the installation script).

I'll try finishing a pyGTK version of that dialog for tomorrow. Don't have time right now.

For the moment, an easy solution is to change the language manually in the dansguardian.conf file.
Open the configuration file:

gksudo gedit /etc/dansguardian/dansguardian.conf

Look for a line like this:

# language to use from languagedir.
language = 'french'

and replace "french" or whatever there is to "ukenglish", then save and it should work.

As for the GUI problem, try running it from command-line and post the output here:

/usr/local/bin/parental-control-config

And Browsing is completly blocked.

This is most likely due to dansguardian not having started correctly. Since everything goes through dansguardian, if it hasn't started, the internet won't work at all unless firehol and tinyproxy are stopped.

Temporary solution: stop all 3 services:

sudo /etc/init.d/dansguardian stop
sudo /etc/init.d/tinyproxy stop
sudo /etc/init.d/firehol stop

Definitive solution:
My guess is that there is a configuration problem or that another program is using port 8080 (default port used by the parental control system).
I had the problem myself and here's the solution:
http://ubuntuforums.org/showthread.php?t=884664

You can try solving the problem yourself by changing the port number.
If you can start tinyproxy and then dansguardian without any error messages, it will most likely work.
commands to start the different services manually:

sudo /etc/init.d/dansguardian start
sudo /etc/init.d/tinyproxy start
sudo /etc/init.d/firehol start

If this seems to complex to you, just post the contents of the following files and I'll see what I can do:

/etc/dansguardian/dansguardian.conf /etc/tinyproxy/tinyproxy.conf /etc/firehol/firehol.conf

[iGama]

Thanks for the Update!

Going to test it now

[iGama]

the gui wont work Using 8.04.

When i run it, a terminal opens and closes right away, but browsing is working.

Any ideia?

[KIAaze]

Ok, I made some updates.
Please try version 3.1 from above.

Also note the added troubleshooting section.

Changes:
-pyGTK language selection dialogue -> All available languages get displayed
-If dansguardian+tinyproxy+firehol don't start successfully after the installation, they will be automatically deactivated so that the internet isn't blocked. (oops forgot about what happens after reboot. Todo...)
-terminals remain open now until you close them (for installation, uninstallation and the GUI).
This should make debugging easier. Originally I wanted to have both terminal output + this output saved in a file, but it got a bit complicated so I settled for this solution.
Eventually, I'll just create install/uninstall logs, remove the terminal output and replace it with a progress bar.
-Some code simplification

[iGama]

Ok just tested v3.1 and already found the problem.

The problem is with Gambas.

$ /usr/local/apps/parental-control/ubuntu_parental_control_gui
bash: /usr/local/apps/parental-control/ubuntu_parental_control_gui: /usr/bin/gbx: bad interpreter: No such file or directory

So i installed gambas2-runtime, but this installes gbx2. gambas-runtime is not available in Hardy.

If I do a ln -s gbx2 gbx , and run the gui again, i get:

$ /usr/local/apps/parental-control/ubuntu_parental_control_gui
gbx2: too many project files.

Does this help?

[KIAaze]

Yes, that helps.
I never noticed that because I still have the old gambas-runtime installed (despite already running Intrepid ^^).

For the moment, you could try installing the old Gutsy version:
http://packages.ubuntu.com/gutsy/gambas-runtime

I'll have to update the GUI to make it compatible with gambas2, but the main problem is that I don't have the source code!

I already contacted nanomad and mhancoc7 (the one who made a GUI for UbuntuCE's parental control) and hope one of them will answer me.
Another solution might be to use the Java webstrict GUI (of which I already have the source code ).