A Web filter is a software that can filter the type of content a Web browser displays. The filter checks the content of a Web page against a set of rules and replaces any unwanted content with an alternative Web page, usually an "Access Denied" page. The type of content to be filtered is usually controlled by a systems administrator or a parent. Web filters are used in schools, libraries, and homes to safeguard children from obscene content on the Internet.
Before you begin, you should be familiar with some basic networking concepts:
Getting the software
The only software you need to set up parental filters under GNU/Linux is iptables, DansGuardian, and Squid.
DansGuardian is the actual filtering software. It supports phrase matching, which allow you to block out Web sites that contain certain phrases or words; PICS filtering, which blocks content that's been labeled as possibly objectionable material by the creator of the Web site; URL filtering, to block content from specific sites that are known to contain offensive material; and blacklists, or lists of sites that contain content you want to block. Blacklists usually come from third parties, though you can create and maintain your own.
Squid is a Web proxy server that acts as a middleman between your computer and the Internet. You need a proxy server because DansGuardian isn't able to fetch Web pages by itself. We'll configure Squid as a transparent proxy, meaning we'll hijack network traffic and redirect it to a new destination -- our filter program, in this case -- without the need for the user to know that it is happening.
Most modern distribution have packaged versions of Squid and DansGuardian available. If yours doesn't then you will need to install them from source code. Both the Squid and DansGuardian Web sites have complete instructions for how to compile and install the programs from source.
Iptables is the firewall management tool used with the 2.4.x and higher kernels. Most modern distributions provide iptables. If yours doesn't, you will need to compile a new kernel and enable iptables, which is beyond the scope of this article (and probably beyond the abilities of most parents). You'd probably be better off upgrading to a newer Linux distribution.
Configuring Squid
The default location for the Squid configuration file on most systems is /etc/squid/squid.conf. While most of the default settings for Squid are all right for our usage, you will need to edit the configuration file just a bit.
You will need to become the root user in order
to make the changes and issue the commands shown in this article. You
can do this by either logging in as root or with the su command.
Add or edit the following line to have Squid listen only on the loopback device on port 3128. This will cause Squid to act only as a proxy server for this computer and assigns it a specific port number to listen on:
http_port 127.0.0.1:3128
To configure Squid as a transparent proxy, add the following lines to squid.conf:
httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on
Your system should have created a user and a group named squid
when you installed Squid. If it didn't, you should create them yourself
by using the following two commands from the command line:
groupadd -r squid
useradd -g squid -d /var/spool/squid -s /bin/false -r squid
Since Squid is normally started by the system and run as root, you
need to add the next two lines to /etc/squid/squid.conf in order to
make Squid run with squid's user and group IDs:
cache_effective_user squid cache_effective_group squid
We will later use this to identify Squid to our firewall. Then we will allow the user squid to access the Internet while we redirect all other Web traffic through our filter.
Configuring DansGuardian
Our next step is to configure DansGuardian. The default location, on most systems, for the configuration files is /etc/dansguardian/dansguardian.conf. Once again, most of the default values are fine, but we need to make a few changes.
First, add or edit the following line to make the filter use HTML templates, which are static Web pages that our filter will use to display the "Access Denied" page instead of the inappropriate sites. Using HTML templates keeps us from having to set up a Web server to display the "Access Denied" information.
reportinglevel = 3
Next, add or edit the following lines to make DansGuardian listen on the loopback address and port 8080:
filterip = 127.0.0.1 filterport = 8080
Add or edit the following line to tell DansGuardian which address and port that Squid is listening on. This enables our filter to fetch the requested Web content through the proxy.
proxyip = 127.0.0.1 proxyport = 3128
Again, to keep your filter from running as root you need to change
the user that it will run as. For simplicity, we will reuse the user and
group that we previously set up for Squid. Add or edit the following to
make DansGuardian run with UID and GID of squid:
daemonuser = 'squid' daemongroup = 'squid'
While DansGuardian provides an excellent filter all by itself, you may want to exercise further control over the Web filtering by editing the other files in the /etc/dansguardian directory that contain external blacklists. Blacklists from squidGuard and URLBlacklist work perfectly with DansGuardian. Each file contains a brief explanation for its contents to make configuration easier.
Putting it in action
Once you have Squid and DansGuardian set up, the final step is to
implement a transparent proxy using iptables. Use the following
commands at the command line to add rules to the firewall to allow the
user squid to access both the Internet and the Squid proxy we set up.
iptables -t nat -A OUTPUT -p tcp
--dport 80 -m owner --uid-owner squid -j ACCEPT
iptables -t nat -A OUTPUT -p tcp
--dport 3128 -m owner --uid-owner squid -j ACCEPT
If you want a user to be exempt from filtering -- a parent, for example -- issue the following command. Replace EXEMPT_USER with the username that you wish to exempt from filtering:
iptables -t nat -A OUTPUT -p tcp
--dport 80 -m owner --uid-owner EXEMPT_USER -j ACCEPT
The next command redirects Internet traffic from all users, other than squid and any exempt users, to the filter on port 8080:
iptables -t nat -A OUTPUT -p tcp
--dport 80 -j REDIRECT --to-ports 8080
Since we have a proxy server set up, a user could configure a Web browser to bypass the filter and access the proxy directly. The Squid proxy is listening for requests from the computer, and it doesn't care which user sends the request. We could set up our firewall to deny all access to the proxy except from our filter, but let's be a little sneakier. Let's set it up so that direct requests to the Squid proxy server, except from our filter, get redirected through the filter. To do this, use the following command:
iptables -t nat -A OUTPUT -p tcp
--dport 3128 -j REDIRECT --to-ports 8080
Some systems, such as MandrakeLinux, utilize an application called Shorewall to manage firewall rules. For these systems, place the above firewall rules in /etc/shorewall/start, to use the filtering when Shorewall starts, and in /etc/shorewall/stop, to make them stick if you should stop Shorewall for some reason. To implement the new rules simply restart Shorewall using the following command:
service shorewall restart
For systems using Shorewall, your firewall rules are set. For all other systems, you'll need to perform the next two steps in order to get the new firewall rules started at boot time. Issue the following command to save your firewall rules:
iptables-save > /etc/sysconfig/iptables
Now issue the following to make sure iptables is started at boot time and to start the iptables firewall:
chkconfig iptables on
service iptables restart
You may also need to make sure that DansGuardian and Squid get
started at boot by using the following two commands:
chkconfig squid on
chkconfig dansguardian on
To get the filtering started, you can now enter the following commands:
service squid restart
service dansguardian restart
| |
| The "Access Denied" screen - click to enlarge |
Now when users enter a forbidden Web address they will be presented with an "Access Denied" page instead of the offending site. You can customize the look of the "Access Denied" page by editing the template.html file in the appropriate language section located in /etc/dansguardian/languages.
Final thoughts
While the setup discussed in this article is intended for use on a single computer, this method of Web filtering can be applied to a wide range of scenarios. These tools can be easily and successfully implemented on a small home network, a large business infrastructure, or any environment that needs to comply with the Children's Internet Protection Act.
Bear in mind that Web filtering software of any kind is not 100% failsafe, nor is it a substitute for parental supervision. Along with installing filtering software, educate yourself and your children about the Internet.
Note: Comments are owned by the poster. We are not responsible for their content.
As the previous poster said, it's obvious you've never had to deal with raising real children, or seen them through the age of puberty into adulthood. I honestly hope you never have that responsibility thrust upon you. No wonder the world is so full of sick and sexually mixed up people.
(Frankly, I'm less worried about Clinton and his escapades than I am of little girls thinking that letting men force them to be humped by horses is a "normal" behavior.)
As the previous poster said, it's obvious you've never had to deal with raising real children, or seen them through the age of puberty into adulthood. I honestly hope you never have that responsibility thrust upon you. No wonder the world is so full of sick and sexually mixed up people.
Ok, I want to see YOUR response to the question what oral sex is. Please insert it
here
Do you think it's okay to lie to your children? How are they going to trust you if they find out? What if you refuse to answer - won't you just make them more curious? Or would you explain it to them, but use more graphical language?
Frankly, I'm less worried about Clinton and his escapades than I am of little girls thinking that letting men force them to be humped by horses is a "normal" behavior.
Ok, so you want to prevent them from stumbling upon such sites, which is fine. Never met anyone who managed to get there accidentally, though.
Why don't colleges teach everyone calculus first and then algebra? Because knowledge of algebra provides the tools and foundation to enbale understanding of calculus.
Yes, but then, no one would claim that it's good to block minors' access to WWW information about calculus...
Do you let your child drink alcoholic beverages? Why not? By your rules, as soon as they express an interest in whiskey or beer, you ought to give them some because otherwise you are not treating them as a person.
Should you buy your kid a bottle of booze as a birthday present? Of course not! But does it make sense to restrict their every access to small doses of alcohol whereever it may come from? Well, if you want your kid to hypercompensate like Jenna Bush, go ahead.
Filtering can help me control the when, where and how my children learn many things in life, sexual or otherwise.
It may be a good idea to watch the logfiles so that you know what content and when is blocked, so you can talk to your kids about the purpose of the filtering.
I would not allow some stranger to stand in my living room and display pictures or words of whatever HE feels like. But somehow I am a bad person if I filter the internet?
The Internet doesn't come over to your kid and forces him/her through all the information it has to offer. The WWW is essentially a book with countless pages - the viewer is in charge, not the presenter. Teach your children that every one of these pages is only a tiny slice of reality, and that to every opinion expressed there, there are counter-opinions. Tell them to be critical and take nothing for granted, especially not as representative for their own future. That's the most important thing to do, IMHO.
Have you talked to sex offenders in prison? I worked several years for a company that makes personality assessment tests for prisoners. Based on the statistics processed from those assessments, a large percentage of sex offenders had exposure to sexual content or conduct earlier in life than the general population.
Exposure to sexual content? How does this turn a person into criminal? Exposure to conduct? Umm, yes, because a large percentage of rapists and child molesters have been sexually abused in their childhood. Consensual sex does not make you a rapist, and I've never seen depictions of nonconsensual sex on the Internet (though I'm realistic enough to know that you could find it, if you were looking for it). Psychologists know that rape is much more about violence and humiliation than about sex. There was actually a pretty bad Russian serial killer who was impotent, so he raped his victims with a knife.
Complete isolation of children from all of reality is wrong. They will not be able to develop the skills needed when they reach adulthood.
Complete exposure of children to reality also wrong. They don't have the skills to correctly judge or apply the information they will be flooded with.
I agree 100%.
But don't you see?? Allowing complete, uncontrolled, unmonitored access to the Internet for your children is like taking them to the Liquor store and leaving them there overnight! That's the whole freaking point. Saying you don't want to use any filters at all means you are introducing your kids to all the scum of life on someone else's terms, not your own. Do you take your kids downtown and let pimps and prostitutes teach about not just sex, but love and commitment?
My kids learned lots of things about life, some of them at times that weren't convenient or comfortable for me. That happens. They are adults now, and looking to raise kids of their own some time soon. I couldn't shelter them from everything, nor did I want to. However, there were plenty of things I wanted to make sure they learned from my wife and me, not just anybody.
Filters aren't about sheltering your children from the "hard things in life." They are about taking responsibility for raising your children, and teaching them on your terms, rather than just letting any scum off the street tell them how to think.
I guess Ill take a stab at that one. As a Christian, I believe that pronography, premarital sex, and alcohol and drug use are all wrong. Morally wrong. I believe that each person has a soul that will exist past death, in one of two places (I'm sure you know what they are). So let me see, if my children form habits of looking at or doing things that are wrong, they are jeopardizing their souls. My friend, that is the definition of harmful. A parent's job is to protect their children, yet you would have them ignore the most important aspect of a child, his or her soul.
And I believe that indoctrinating hapless children with your beliefs is wrong. Morally wrong. I can understand why minors should be kept away from sites like rotten.com until they're able to understand and are stable enough to cope. But what I don't understand, is why it's ok to scare 6 year old children to death by threatening them with eternal hellfire. I'm not sure whether I have an immortal soul, but I can tell you the effects on my mortal one were not nice. It came to pass that the Catholic preacher who told me all these horror stories when I was still in elementary school had been a Nazi collaborator. Uh, so much for morality.
PS: Nowhere in the US is teen pregnancy as common as in the Bible Belt. Guess why.
Interesting statement. Show us the stats.
<A HREF="http://www.teenpregnancy.org/resources/data/pdf/stbyst00.pdf" title="teenpregnancy.org">Sure.</a teenpregnancy.org> I haven't looked at it for a while, but it seems quite a number of Southern states are in the lower ranks (lower = worse).
And, correlate it to actual consistent religious activity.
And not to forget shoe size and car brand. I was talking about geographical distribution, and IMHO the main reasons are as explained below. If you don't find this convincing, I encourage you to come up with alternative explanations.
It's is most certainly NOT the simple reason you want us to think.
I don't know what you thought I thought, but I assume that most kids in these regions are just pig ignorant about sexual things and contraception in particular. Reminds me of the joke where two eight year old girls banter about who's more grown-up. Says the first: "I already know how people get kids!", and the second answers: "I already know how they don't!"
And then, many of the Christian kids who do know wouldn't get any contraceptives before "it" happens, because after all they're not supposed to need or use them anyway. And of course they don't know about things like "the pill after" and would probably not seek assistance from adults.
So are BB kids less likely to have sex in their teens? Probably. But OTOH they are more susceptible to pregnancy when it happens.
What did the source of your assertion say about the reason, if true?
Of course nothing, since a good statistician is slow to comment on his work.
We are not designed to stick our penises in the poop of men.
Telling children that - for a man - to suck a dick is normal - let alone allowing them to see those acts - is bad.
Thank you for the most intellectual treatment of the subject I've seen in my entire life. Now if you would excuse me, I'm not really designed for using a computer. I'll put on my fur, take my spear and hunt some mammoths.
YOU SUCK! If your kids turn out to be homosexual, that's how they are... it's not something that's learned from web sites, and, if you don't want your kids committing suicide some day, it's not something that you want to criticize.
The True Answer.
Posted by: Anonymous Coward on July 01, 2004 09:48 PMThe real answer that should have been given: A) It is damaging to your child when you treat your child as a mere object instead of a person in and of themselves with their own interests. B) If your child is old enough to be interested in looking at 'naughty' pictures then I think its time you have the birds and the bees talk with them, and pray to god he or she prefers to satisify themselves on mere images and decide on sex later on. C) There is few, if any, arguements or evidence that suggest harm comes from merely being exposed to information in the form of images or text online. If any harm does exist it pales in comparison with the harm that comes from restrictions on free access to information.
#