Content filtering for minors

I use DansGuardian as a content filter for our local network.  Much to my children's chagrin, they are not allowed to access sites that are rated above their pay grades, nor to sites that contain content that, via a set of weighted phraselists, is deemed to be too mature for them.  Finally, they're completely disallowed to access files based on filetype (e.g. exe, zip, rar, bz2) and mime type -- basically, they are not allowed to download executable files.

After having a few of my (now adult) children have their computers toasted by malware and whatnot (10 or so years ago), and after one of them accidentally fell into pop-up porn hell, I set this system up to try to protect them from themselves.  Since then, I am happy to say that nobody has had their computer lost to the bad stuff.  (But the credit for this obviously goes to DansGuardian.)

I use Shorewall as my firewall solution, and configure it to (transparently) redirect all outgoing traffic on port 80 to Dansguardian (on port 8080):

REDIRECT lan 8080  tcp www  # redirect LAN-www to local 8080

Dansguardian relays the requests to a proxy (originally I used Squid, but I have also configured Apache's proxy module), and you should probably block access from the LAN to the proxy ports, lest someone configure their computer to bypass your content filter.  I have not done this because at times I do exactly this and configure a computer to directly access the proxy.  So far, nobody has figured this out (I do check occasionally) so I haven't worried about it.

For computers that should bypass the content filter, like my Wife's, I define a variable in /etc/shorewall/params listing the MAC addresses of those computers:

RIKKI_IPAD=~ed-0d-59-b7-c7-5d
RIKKI_IPHONE=~24-ab-81-fd-71-c4

Then, I define a variable that includes all of the systems that should bypass the filter:

MACS_NOT_FILTERED=$RIKKI_IPAD,$RIKKI_IPHONE,...

Then, finally, in /etc/shorewall/rules I specify that these should bypass the filter:

ACCEPT+  lan:$MACS_NOT_FILTERED net tcp www 

The ACCEPT+ target is like ACCEPT, but it also prevents further rules from matching, so by placing this rule above the REDIRECT rule, we ensure that  $MACS_NOT_FILTERED will never reach the REDIRECT rule.

One final issue I've had is that DansGuardian allows me to "whitelist" sites using /etc/dansguardian/lists/exception{site,url}list files, but some of my [linux] systems try to get updates from one of any number of mirror sites, and I don't necessarily know all the mirror sites and even if I could be bothered to find out, I wouldn't want to manually maintain a list of exceptions.  So, instead I used /etc/dansguardian/lists/exceptionregexpurllist to allow access to any mirror (in this case, the CentOS 6.0 servers):

 ^.*centos/6.0/(os|extras|updates)/x86_64/.*$

Unfortunately there isn't a very good way to have the kids hit a blocked page, and allow them to have access for a limited time.  DansGuardian has some functionality to allow you to get "warned" but then continue onto the site, but it doesn't have a way to issue "tokens" that would expire after a period of time.  To try to help solve this issue, I've started playing with a form that adds exceptions to the DansGuardian configuration (the form only being shown to the adults by having them in their own filtergroup).  But this is a very immature solution so far.

That said, I think DansGuardian is an excellent tool for networks with children, and I highly recommend it.

Web Cams, woot

I have set up a webcam page, mostly for fun, although my wife likes it because she can see if I'm working or watching TV or whatever.  I thought it might be fun to go over the technology involved, or at least the pieces that I've chosen for myself over the years.

Motion is a motion-detection and recording camera application for Linux.  This makes a great basis for a webcam.  You can have it generate recordings of activity on your camera that can be reviewed later with a simple PHP script.  MJPG-Streamer is another great tool for Linux.  It's a bit "raw" in that it's not packaged into system packages (that I know of) but it's actually a pretty slick lightweight program for having a live streaming camera.

On Windows, there's no shortage of webcam applications, but a simple free one that gets the job done is Yawcam (Yet Another Web CAM).  This is Java, but works reasonably well even on lower-powered systems (but definitely not as lightweight as mjpg-streamer).

I've tried all sorts of chat widgets for my webcam page, but none (for me) has ended up being better than CGI::IRC, which is a Perl-based IRC server in a web page.  I use this to allow people to join my private IRC server where I idle just in case anyone ever shows up.  They never do, but that's not the point. ;)

On my page, there are three cameras, each hosted on a separate computer.  A linux box (10.10.100.2) running motion records on the "main" camera with the widest angle.  Then, I have two laptops with integrated webcams that provide live streams from "side angles".  One of the laptops (10.10.100.19) runs mjpg-streamer, the other (10.10.100.201) runs Yawcam on Windows.

I've set it up so that the IP address (cam.akropolys.com) resolves to my firewall, both on internal DNS (as 10.10.100.1) and on external DNS.  I use Shorewall's DNAT rules to redirect external clients to the live camera streams:

DNAT net lan:10.10.100.2        tcp 8081     # webcam streaming
DNAT net lan:10.10.100.19:8082  tcp 8082     # webcam streaming
DNAT net lan:10.10.100.201:8081 tcp 8083     # webcam steraming

To allow internal clients to access the live streams, I use the rinetd utility to redirect request to the live video streams:

0.0.0.0         8081    10.10.100.2     8081 # cam
0.0.0.0         8082    10.10.100.19    8082 # cam 0.0.0.0         8083    10.10.100.201   8081 # cam 3

Of course, I use my reverse-proxy trick to redirect requests to the actual website.  This works for both internal and external clients:

RewriteCond %{HTTP_HOST} ^cam\.akropolys\.com$ [NC]
RewriteRule /(.*) http://10.10.100.2/~troy/$1 [P]

I also installed an ErrorHandler for error 503.  This error is thrown if Apache can't proxy requests to the camera page.  The error handler script checks the value of the $SERVER_NAME environment variable and if it's the camera server, it returns the camera down page.  This doesn't help if the webpage requests (on port 80) can be fulfilled but the live camera streams are down.  At some point I'm thinking I can use Javascript on the page itself to display an error image, but I haven't tried this yet.


Finally, I restrict access to the recordings to internal clients by checking the PHP $_SERVER['HTTP_X_FORWARDED_FOR'] variable and ensuring that the requesting client is on the 10.10.100.0/24 network.  This gives me a way to sort of secure parts of the page from prying eyes if I need to.