Restrict computer time for kids
 

Just a note for anyone with kids who have a similar problem.

I have an Ubuntu 14.04 PC for the kids with a few educational programs as well as Steam & a few games. Unfortunately they have started spending way to much time with this rather than doing homework so I started looking at ways of limiting usage. I found it surprisingly hard to get something that was easy to set up. I looked at pam_time, but this seemed very involved.

I eventually came across this: kidtimer. This little program was very easy to install & it works perfectly.

Regards,
Stefan

Other possible solutions:

Buy lockable cabinet, put keyboard, mouse, power cables in cabinet, lock cabinet.
Change computer or WiFi password, "do all chores / homework" for password.

:)

How about this? Since you are the parent, you tell your child that "computer time is up. Go do something else". Eliminates the need for installation and configuration of software.

actually it does not work, because he (the child) is at home and I'm working now.

Removable hard disk caddy and take the disk with you? :)

Well, I guess I assumed that this interaction takes place when everyone is home and that the kids are very young.

Why? when children are at home (not in school) and they are free to use the net and the pc for an hour or two day by day - for example he can chat with me, look for interesting info, do the homework, but cannot play (shoot bad guys) all day long ...

I suspect you do not have kids! :)

:) Your problems are just beginning!
.. and then chat with friends about how to get around parental restrictions. They are a savvy lot, this generation that have grown up in a world where computers have always existed.
.. and then look for interesting info like the shape of the naked female body and various contortions. Then they get smart and start clearing web browser history.
.. and then do the the homework by finding a friend who has already done it and is prepared to share a copy.
.. and then play on-line games to shoot bad guys ad infinitum because your internet filters are child's play or they have found a new proxy server or they have been given a bootable USB stick.

Time based restriction will work for a while, then 'over the shoulder' restrictions will work for a while, (i.e. access where usage can be physically monitored) but then there are homework assignments that need research and when completed need to be uploaded to school servers and ...

From a security viewpoint, physical access means game over.

Actually not, it is another kind of game. At least in my case. You can say I know much more about internet and security than the "usual" average. So my children have a really hard job to do "bad things". One of them simply went to his friends to see "interesting" pages. But it is a learning curve to the other. So he will try this and will be restricted, and try that and restricted again, and finally he will know a lot about linux, security, proxy, firewall and other stuff.

The thread title got my attention, because this is something I have spent a lot of time on, and it is still a bit of trouble. I developed my own system, which has some similarity to kidtimer. I use pam_time to restrict the hours the child can log in. A cron job runs every minute, and parses the output of ck-list-sessions to determine if any user is active. If so, it increments a counter for that user. When the counter gets to certain points, it uses aplay to play a notification sound, and zenity to send a notification message to the screen (5 minute warning, automatic logout in 1 minute, logging out now), and gnome-session-quit to log the child out.

Problems with my system: If the child's time runs out on one computer, he/she may walk over to another computer and log in there. If the child needs more computer time to do homework, I have to manually adjust the time limit setting.

Problems in general: When they are supposed to be doing homework on the computer, they are usually checking facebook, twitter, etc., in the background.

I'll try kidtimer, but I would like to develop my system further, if I have the time.

This sounds like an interesting way of doing it. Would it be possible to give a short summary of how you configured pam_time?

Regards,
Stefan

When I started working on this problem, I searched the web, but I didn't know the right keywords. Web searches for words like "linux parental control" were not very productive. Now that I know it involves pam, I can tell you to search for "pam restrict login time" or similar words. That pretty much gives you the answer. Additional insight can be gained by the man pages for pam_time, time.conf, and perhaps pam(7).

This is my method, more or less:

1. Determine which service (or services) you wish to restrict.
   My children always log in by the graphical login screen. The corresponding service on my computer is gdm3 (Gnome Display Manager 3). For KDE, I think the service would be kdm (KDE Display Manager). For other channels of access, one might use services called login, sshd, or perhaps others.
2. Edit the appropriate PAM configuration file.
   On my system, PAM is configured by files in the /etc/pam.d directory. I add the following line to the file /etc/pam.d/gdm3:
   
   Code:

   ---

   account required pam_time.so

   ---

   I put this line at the end of the file, but it seems to work just as well if it is inserted elsewhere.
   
   If you don't have a /etc/pam.d directory, then the configuration file is /etc/pam.conf, and you add lines like the following, where the first field is the name of the service:
   
   Code:

   ---

   gdm3 account required pam_time.so

   ---

3. Set the time restriction rules in the file /etc/security/time.conf
   Here is an example similar to my /etc/security/time.conf (usernames have been changed for anonymity):
   
   Code:

   ---

   * ; * ; alfonso ; !Al0000-2400    # can never log in
 * ; * ; bernard ; Al0000-2400    # can always log in
 * ; * ; corrina ; Wk1530-1900|Wd1300-2100    # Mon-Fri 15:30-19:00, Sat-Sun 13:00-21:00.

   ---

   The original /etc/security/time.conf file contains instructions on time.conf syntax.
   
   If a user is not listed in time.conf, that user may log in at any time (no time restrictions).

With this configuration, users can login by gdm only at the specified times. However, it does not log them out. I am not sure if it is possible to force a logout with pam_time. That is why I used gnome-session-quit to force a logout, as I mentioned in my previous post.

Thanks for the information. I also found that a "linux" + "parental control" google search did not help that much although I did eventually find the kidtimer script. We have a pc in the living room and I thought we would just keep an eye on them but it is not that easy. My daughter typed her name plus ".com" in the address bar and promptly got onto a XXX site. Now I have added openDNS and a weekly updated /etc/hosts file.

Regards,
Stefan