6

I want to set my small kids loose on the Raspberry Pi with Scratch 2.0 and code.org without having to worry about them accidentally ending up in the undesirable parts of the web.

I have set up OpenDNS to filter web content for the Pi, but even on its strongest setting it still lets plenty of nasty stuff through.

Is there a reasonable way to get a whitelist filter that will only allow the sites I explicitly permit?

  • It turns out that Scratch 2.0 requires Flash, and that is not available for the Raspberry Pi. But I think that etc/hosts looks like the way I want to go. – Tyler Jarvis Jun 28 '14 at 0:18
4

You could do this via the /etc/hosts file, however, this method can be easily over-ridden with the right knowledge and file access. Beyond the /etc/hosts file, there are two methods that I know of, both using Proxys.

These answers were originally for Ubuntu, but they should work just the same on Raspbian (or possibly with a bit of modification,) as both Ubuntu and Raspbian are Debian-based.


First Method - Easiest

Use Privoxy

This method is pretty simple, it can be used to do exactly what you want - Block everything and allow only certain sites through. From the configuration options page:

3.27. Can I set-up Privoxy as a whitelist of "good" sites?

Sure. There are a couple of things you can do for simple white-listing. Here's one real easy one:

############################################################

Blacklist

######################################################

{ +block } / # Block all URLs

############################################################

Whitelist

######################################################

{ -block }
kids.example.com
toys.example.com
games.example.com
This allows access to only those three sites by first blocking all URLs, and then subsequently allowing three specific exceptions.

Another approach is Privoxy's trustfile concept, which incorporates the notion of "trusted referrers". See the Trust documentation for details.

These are fairly simple approaches and are not completely foolproof. There are various other configuration options that should be disabled (described elsewhere here and in the User Manual) so that users can't modify their own configuration and easily circumvent the whitelist.

To edit the whitelist/blacklist: sudo nano /etc/privoxy/config.

To install it, just run the usual sudo apt-get update then sudo apt-get upgrade (checks for updated software, upgrades any software to the newest available version) and then run sudo apt-get install privoxy.


Second Method

Use a transparent proxy

This method is a bit more complicated and uses a squid proxy combined with regex. I haven't actually used this yet, so I simply copy/pasted this answer from Ask Ubuntu (you can read the original answer [here](

You can set up a transparent proxy. As Wikipedia says,

Also known as an intercepting proxy or forced proxy, a transparent proxy intercepts normal communication at the network layer without requiring any special client configuration. Clients need not be aware of the existence of the proxy. A transparent proxy is normally located between the client and the Internet, with the proxy performing some of the functions of a gateway or router

Doing it with /etc/hosts is fine, as long as the user doesn't know about the file or doesn't have the permissions to edit the file. But I guess what you want to achieve would be easier if you use proxy, although it will take some time to set it up.

To set up the transparent proxy, you can use squid. Here are some quick steps to set it up:

  • Install squid

    sudo apt-get install squid squid-common

  • Edit the /etc/squid3/squid file:

    Look for the line http_port 3128 and make sure it is uncommented. squid, by default, listens to port 3128.

    acl bad dstdom_regex '.*abcde.*'
    http_access deny bad

    This will block every URL containing abcde.

  • Restart squid

    service squid3 restart

A very good guide is given here.

Here are some other links:

Hope this helps! Of course, there are other methods out there, but these are just two I found quickly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.