Hi all, First post... just seeing if I'm on the right track. I have my router locked down to prevent my kids from bringing unauthorized devices into the house... I change the router passwords daily and have it locked down by MAC address. However, once I give them the daily password they have full internet access to do homework. Unfortunately, once they have the password they seem to be watching youtube and other things instead of doing homework. Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access? I feel like I can, but all I'm looking for here is a "yes you can do that" and I'll keep trying to figure it out - I just want to see if I'm on the right track. Thanks, Bret -- Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | bits.and.bytes.software@gmail.com
Hi, Really you’re asking if this is a job for RADIUS. RADIUS can tell your NAS (i.e. your wireless router, maybe?) what to do, but the NAS needs to support those things. If your wireless router supports putting users in to different groups, or something, and applying policy to those groups based on RADIUS, then sure, RADIUS is able to do that, and you can use FreeRADIUS to do that for you. RADIUS would be involved when they connect to wifi - *not* for every website they visit etc. It would push a profile or group or something to the NAS which would be something like “Restricted” or “Open” or “Homework time” or whatever, and the NAS would know that that profile means it needs to limit/permit x, y, z. I don’t know any NASes that support this sort of behaviour - they may exist, but I don’t know of them. What I’m describing here is how RADIUS would fit in to such a solution if it were to exist - i.e. only for the “login” part. My feeling though - I don’t know what your skill level is with this stuff.. but you’re probably better off getting “parental control” product. I work with ISPs, and have been testing and looking at a lot of these. They’re good. They’ll give you a much simpler point and click type interface which can manage this. There aren’t any canned solutions (which I’m aware of) for this with RADIUS where you use your own NAS etc. etc., you’ll be doing a lot of work building an interface - or when homework is done you’ll be off running SQL queries or editing files or whatever. Sounds like a chore to me ! Check our Koala (koalasafe.com) - that thing works pretty well. There are others as well, but that’s the better one that I’ve seen. Again - you *can* use RADIUS as the authentication/signalling layer part of such a solution, but I don’t think doing that yourself is the right solution for a home. Certainly for a service provider, or a school or enterprise network, but not a home.
On 25/09/2018, at 9:19 AM, Bret Schuhmacher <ultimatebeersnob@gmail.com> wrote:
Hi all,
First post... just seeing if I'm on the right track.
I have my router locked down to prevent my kids from bringing unauthorized devices into the house... I change the router passwords daily and have it locked down by MAC address. However, once I give them the daily password they have full internet access to do homework. Unfortunately, once they have the password they seem to be watching youtube and other things instead of doing homework.
Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access?
I feel like I can, but all I'm looking for here is a "yes you can do that" and I'll keep trying to figure it out - I just want to see if I'm on the right track.
Thanks,
Bret -- Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | bits.and.bytes.software@gmail.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I don't think you're on the right track. Radius is the wrong layer to look at. You should "zoom out" and look again. You probably want some kind of proxy server to accomplish what you want (on top of the host authentication you already implemented). On September 24, 2018 11:19:00 PM GMT+02:00, Bret Schuhmacher <ultimatebeersnob@gmail.com> wrote:
Hi all,
First post... just seeing if I'm on the right track.
I have my router locked down to prevent my kids from bringing unauthorized devices into the house... I change the router passwords daily and have it locked down by MAC address. However, once I give them the daily password they have full internet access to do homework. Unfortunately, once they have the password they seem to be watching youtube and other things instead of doing homework.
Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access?
I feel like I can, but all I'm looking for here is a "yes you can do that" and I'll keep trying to figure it out - I just want to see if I'm on the right track.
Thanks,
Bret -- Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | bits.and.bytes.software@gmail.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Look at squid proxy > On 25 Sep 2018, at 07:00, jm+freeradiususer@roth.lu wrote: > > I don't think you're on the right track. Radius is the wrong layer to look at. You should "zoom out" and look again. You probably want some kind of proxy server to accomplish what you want (on top of the host authentication you already implemented). > >> On September 24, 2018 11:19:00 PM GMT+02:00, Bret Schuhmacher <ultimatebeersnob@gmail.com> wrote: >> Hi all, >> >> First post... just seeing if I'm on the right track. >> >> I have my router locked down to prevent my kids from bringing >> unauthorized >> devices into the house... I change the router passwords daily and have >> it >> locked down by MAC address. However, once I give them the daily >> password >> they have full internet access to do homework. Unfortunately, once >> they >> have the password they seem to be watching youtube and other things >> instead >> of doing homework. >> >> Can I use FreeRadius to limit their access to the Internet to exclude a >> list of blacklisted sites until they prove their homework is done and I >> flip some bits to make policy changes **PER USER** and allow one child >> access to youtube without allowing the other child access? >> >> I feel like I can, but all I'm looking for here is a "yes you can do >> that" >> and I'll keep trying to figure it out - I just want to see if I'm on >> the >> right track. >> >> Thanks, >> >> >> Bret >> -- >> Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | >> bits.and.bytes.software@gmail.com >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Sep 24, 2018 at 05:19:00PM -0400, Bret Schuhmacher wrote:
Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access?
Well, you could configure freeradius to tell your NAS to put each user in a different VLAN, and then since each user has their own VLAN, you could implement and dynamically change some policies on the router per vlan. So the task of freeradius is limited to assigning the VLAN per user, the rest needs to be done elsewhere, as others have already pointed out. But, I know this is a bit off-topic maybe, why would you even want to implement a complicated technical solution for this? Isn't that time lost spending with and talking to your kids? As a kid, I would have felt very bad if my parents had distrusted me so much that they felt the need to implement some digital restrictions... Cheers HC
The also skip the technical stuff (which would be proxy based with authentication) and just go directly to parenting. Have some chats, agree on some ground rules etc :) alan On Tue, 25 Sep 2018, 08:08 Hans-Christian Esperer, <hc@hcesperer.org> wrote:
On Mon, Sep 24, 2018 at 05:19:00PM -0400, Bret Schuhmacher wrote:
Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access?
Well, you could configure freeradius to tell your NAS to put each user in a different VLAN, and then since each user has their own VLAN, you could implement and dynamically change some policies on the router per vlan. So the task of freeradius is limited to assigning the VLAN per user, the rest needs to be done elsewhere, as others have already pointed out.
But, I know this is a bit off-topic maybe, why would you even want to implement a complicated technical solution for this? Isn't that time lost spending with and talking to your kids? As a kid, I would have felt very bad if my parents had distrusted me so much that they felt the need to implement some digital restrictions...
Cheers HC - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 25/09/18 10:36, Alan Buxey wrote:
The also skip the technical stuff (which would be proxy based with authentication) and just go directly to parenting. Have some chats, agree on some ground rules etc :)
Sort-of related: I used to work for a company that supplied networking kit to schools. What we learned from talking to them was that when the schools had some sort of filter, the kids would inevitably find a way around it; indeed, it was seen as a challenge, and of course, if it's not been blocked, it's legit, right? OTOH some schools had a much simpler system - all internet access was logged, and there was an "oops!" book where the children would note down if / when they stumbled across something "inappropriate". If they failed to log it there would be consequences... obvs this sort of system would fail in some schools, but in others, giving the children the responsibility of policing themselves worked very well indeed.
Thank you everyone, for quick responses! I'll look towards other solutions for my issue. Thanks, Bret -- Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | bits.and.bytes.software@gmail.com On Mon, Sep 24, 2018 at 5:19 PM Bret Schuhmacher <ultimatebeersnob@gmail.com> wrote:
Hi all,
First post... just seeing if I'm on the right track.
I have my router locked down to prevent my kids from bringing unauthorized devices into the house... I change the router passwords daily and have it locked down by MAC address. However, once I give them the daily password they have full internet access to do homework. Unfortunately, once they have the password they seem to be watching youtube and other things instead of doing homework.
Can I use FreeRadius to limit their access to the Internet to exclude a list of blacklisted sites until they prove their homework is done and I flip some bits to make policy changes **PER USER** and allow one child access to youtube without allowing the other child access?
I feel like I can, but all I'm looking for here is a "yes you can do that" and I'll keep trying to figure it out - I just want to see if I'm on the right track.
Thanks,
Bret -- Bret Schuhmacher | Sr. Solutions Architect | 865.257.9856 | bits.and.bytes.software@gmail.com
participants (7)
-
Alan Buxey -
Bret Schuhmacher -
Christian Salway -
Dom Latter -
Hans-Christian Esperer -
jm+freeradiususer＠roth.lu -
Nathan Ward