Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #170770

Re: Limiting internet access by time

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, Aug 6, 2016 at 3:43 AM Brian <ad44@cityscape.co.uk> wrote:

> On Fri 05 Aug 2016 at 15:49:28 +0000, Mark Fletcher wrote:
>
> > On Fri, Aug 5, 2016 at 11:04 PM Brian <ad44@cityscape.co.uk> wrote:
> >
> > > Sticking with the idea of using a systemd service file, the script it
> > > runs would check the time and alter the routing table when necessary.
> > > Neither cron nor iptables need come into the picture.
> > >
> > Thanks Brian. My thinking was that although this machine won't be on all
> > the time, it will be started and stopped at unpredictable times. I wanted
> > to have a situation where if it is brought up during allowed hours, the
> > internet works. If it is brought up during not-allowed hours, it doesn't,
> > until 9am arrives, at which point it starts working. So if my son gets
> out
> > of bed at 3am and fires up the computer, he gets nowhere (at least until
> he
> > figures out how to hack into my own machine and run an ssh session with X
> > forwarding... but if he figures that out without my help I'm almost
> > inclined to reward him by turning a blind eye :-) )
> >
> > Similarly, if he is surfing away on it at 9pm, well by then he is
> supposed
> > to be at least in the bath if not in bed, so the computer's internet
> > connection sets an example by going to sleep...
> >
> > If he leaves it on, I want it to connect and disconnect automatically at
> > the appropriate times, and if he doesn't, I want it to come up in the
> right
> > state. If I leave a hole in this that can be exploited without strong
> > technical skills, I'm confident he'll find it...
>
> Without the root password or sudo he should be unable to influence the
> routing. The machine will always come up with a route to the internet
> because you are using DHCP. But that shouldn't last for more thn thirty
> seconds if we can get systemd to do its stuff.
>
> We'll forget about a fixed IP. DHCP gets you an address and a default
> route when it boots. Check the latter with 'ip route'. You want a
> default route to the internet between 9am and 9pm but not otherwise.
> Consider this script
>
>   #!/bin/bash
>   while :
>   do
>   HOUR=$(date +%H)
>   if ((9 <= $HOUR && $HOUR <= 21)); then
>      echo "Help with the washingup, tidy your room, make yourself useful."
>   else
>      echo "Have a bath. Go to bed."
>   fi
>   sleep 30
>   done
>
> The first echo line would be replaced with
>
>   ip route add default via <gateway IP> dev <interface>
>
> You need this in the event the machine is left on overnight and the
> second echo line
>
>   ip route del default via <gateway IP> dev <interface>
>
> is in force.
>
> The script would go in /user/local/bin and be run by a systemd service
> file with its Exec directive. You should run the script first and check
> that it does do what you want. Altering the "9" and the "21" will help.
> You probably want a "one-shot" service file. You're ok with devising
> that?
>
> > I could give the box a fixed IP but I have always used DHCP on my local
> > network and don't want to disturb my habits more than necessary for this.
>
> It wasn't a important suggested change.
>
> > Also this would get rid of the need for DHCP but wouldn't get rid of NTP
> > calls, and then I'd get them vomiting all over the logs when they fail to
> > connect. Not a big problem, certainly, but an elegant solution would
> avoid
> > it.
>
> Have the script stop and start the NTP service. Elegant enough?
>
> > I didn't mention earlier, and I'm not sure if it is relevant, but the
> > computer connects via WiFi to my access point, which is also my network's
> > internet gateway -- with an LFS box between it and the cable modem as a
> > dedicated firewall. I don't trust the non-free firewall in the AP,
> although
>
> WiFi or cable shouldn't be a concern. Both set up routing in the same way.
>
> > I have left it on. The rest of my network is not to be subject to this
> 9pm
> > curfew. And I would ideally like connectivity between this machine and
> the
> > rest of my local network to remain even when the internet is denied to
> this
> > machine, so I can do remote maintenance when he's not using the machine,
> > for example. If I monkey around with the default routing as you are
> > suggesting, does that have any negative implications for connectivity to
> > the rest of my local network?
>
> It shouldn't do because you will only be adjusting the route to get off
> your network. But that's where testing comes in.
>
>                                 Finally, I am afraid I did not understand
> the
> > point you made about how cron can be avoided. If the machine's up when
> 9pm
> > arrives, I want internet connectivity to die so I can prise him off the
> > computer and get him to bed. In your idea, how can I make that happen
> > without a cron job?
>
> The script run by systemd takes care of what happens at a particular
> time. A cron-only solution is possible but I think the systemd way seems
> more flexible because the script can be adjusted.
>
> You are after an all-or-nothing solution and iptables is intended for
> more finely-grained routing issues. It would probably do the job but
> there is more work involved and it's a bugger to debug if the rules are
> not quite right.
>
>
Thanks for this Brian.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 02:10 +0200
  Re: Limiting internet access by time Lars Noodén <lars.nooden@gmail.com> - 2016-08-05 09:30 +0200
    Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 17:40 +0200
  Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 12:50 +0200
    Re: Limiting internet access by time Lisi Reisz <lisi.reisz@gmail.com> - 2016-08-05 13:10 +0200
      Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 16:10 +0200
        Re: Limiting internet access by time David Wright <deblis@lionunicorn.co.uk> - 2016-08-05 18:00 +0200
        Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 18:00 +0200
          Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-05 19:50 +0200
            Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 21:10 +0200
              Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-06 03:40 +0200
            Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-06 07:30 +0200
              Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-07 03:00 +0200
                Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-07 05:40 +0200
                Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-07 20:20 +0200
                Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-08 02:10 +0200
                Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-09 19:30 +0200
                Re: Limiting internet access by time Stefan Monnier <monnier@iro.umontreal.ca> - 2016-08-09 21:20 +0200
                Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-10 15:40 +0200
                Re: Limiting internet access by time Stefan Monnier <monnier@iro.umontreal.ca> - 2016-08-10 17:00 +0200
                Re: Limiting internet access by time Dan Ritter <dsr@randomstring.org> - 2016-08-10 18:10 +0200
                Re: Limiting internet access by time Stefan Monnier <monnier@iro.umontreal.ca> - 2016-08-10 22:40 +0200
          Re: Limiting internet access by time Brian <ad44@cityscape.co.uk> - 2016-08-05 20:50 +0200
            Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-06 07:30 +0200
      Re: Limiting internet access by time Mark Fletcher <mark27q1@gmail.com> - 2016-08-05 16:30 +0200
        Re: Limiting internet access by time pv29@gatech.edu - 2016-08-08 01:10 +0200
          Re: Limiting internet access by time Curt <curty@free.fr> - 2016-08-08 09:00 +0200
            Re: Limiting internet access by time pascalv@sdf.org - 2016-08-08 10:30 +0200
              Re: Limiting internet access by time Karol Augustin <karol@augustin.pl> - 2016-08-08 12:00 +0200

csiph-web