How can I prevent Desktop Users from accessing any online website?

Question

How can I prevent Desktop Users from accessing any online website? I tried 127.0.0.1 * in /etc/hosts but it didn't do the trick.

Please note that I need to keep http://localhost fully functional.

Thanks.

Answer 1

The quickest (albeit very circumventable method) in my mind would be to break the DNS lookup. What you're doing in /etc/hosts is close but it doesn't accept wildcards. This is a shame because, like you, this sort of setup would really help me from time to time.

Anyway, remove the wildcard entry from /etc/hosts and then edit your network connection. If it's wired, you can edit /etc/networking/interfaces, if it's not, you can just go in through network manager.

Either way, set the connection type to "Automatic DHCP (Address only)" or "Manual" and then set the DNS server as 127.0.0.1. I assume you're not running a DNS proxy server on the machine (otherwise this won't work).

In network manager, this will look something like this:

Click apply. It'll hopefully reconnect and then websites not listed explicitly in /etc/hosts should not resolve.

The workaround that any user can use is they can just type in the IP of the website they want to connect to. You'd need to break more gateway settings to fully neuter the machine.

Note this will probably cut you off from updates. If you want to still get updates, add manual DNS strings to /etc/hosts for each server you connect to (look at what sudo apt-get update does.

Answer 2

Another, more robust method, is to install a content screener like DansGuardian. This, with a couple of iptables config lines will redirect all traffic through it and only allow content that it likes. It uses a proxy (either Squid or TinyProxy - the second being my preferred choice) and its config can be set to only allow certain domains.

https://help.ubuntu.com/community/DansGuardian

IPTables is the thing that makes this rock solid. Only somebody with root or full sudo access would be able to circumvent this. It's a bit more work than just cutting off DNS lookups though.