1

Does anyone know of a way (perhaps using iptables) to put time limits on websites?

More precisely, my boss would like to allow workers access to specific whitelisted websites and would like to assign each whitelisted website a cumulative number of connection minutes per day. For example, the workers are free to access website A anytime they wish, they just have a cumulative total of X minutes to do so; after the allotted X minutes is used up, access to that particular website should be blocked. Similar for all other whitelisted websites. As long as a user is connected to a website (say has the website open on a browser tab), that time is counted against the X minutes for that website, so the user must close the website to avoid having those minutes counted, if they want to preserve minutes to re-access the website later. There are some whitelisted websites required to do our job and their X minutes per day allowed is the full day. A few websites are for personal use (email websites for example) and those websites (which are much easier to navigate with a keyboard/mouse/large screen than on a phone) have a limited X minutes.

If there is a way to do this at the iptables level, that would be great. If this can't be done at the iptables level, is there some way to do it? We use Ubuntu 16.04 LTS. (No brower plug-ins, which are easily modified. Squid cannot set timelimits.)

  • Is everyone using a work computer? Do they use the same computer all day? – Academiphile Oct 26 '17 at 22:41
  • @Academiphile Yes, everyone uses their assigned work computer, and they never change computers; they stay on their assigned computer all day. – Julie Oct 27 '17 at 0:34
  • If the users had to interact with the computer to "open" the sites for a given amount of time, would that be acceptable? – Academiphile Oct 29 '17 at 19:34
  • @Academiphile Definitely acceptable. Interacting with the computer is a very small price to pay to check personal websites like email on their work computer, so they don't have to open any phone or personal device. By the way, the workers use the same browser, firefox (on their assigned computer and they don't switch computers), so they can use any common browser features to make whatever interaction easier. – Julie Oct 30 '17 at 1:00
3

It is very hard to define the time spent on a site: if the site (particular page on a site) has no dynamic updates of any kind, i.e. completely static page, then you could load that page in the morning and close the tab at the end of working day, so no signs that the site is shown on user's screen could be detected on some dedicated firewall or router.

Thus the only feasible solution is a customized browser that performs time accounting for each user. There are a number of lightweight webkit-based browsers that could be modified according to your needs.

The equipment your co-workers are using is a property of your company, so it is a company's absolute right to set up any policies on equipment use as well as sanctions for violations.

If a worker is not capable to follow the established policies and would try to breach them anyway then does (s)he deserves the position?

  • Thanks, is there a specific webkit-based browser you have in mind that can do what's required (such that a user cannot change settings)? I agree about workers deserving positions, but unfortunately we live in a world now where many feel entitled to break rules. Also, I was told it's very hard to find any good replacement people so firing someone would hurt more than help. The idea is to make it not possible to break the rules, so to avoid firing someone. – Julie Oct 27 '17 at 12:01
  • @Julie, if I were to implement your requirement I would take Midori (midori-browser.org) as a base just because I already looked into its source code before. Also you might want to properly administer the workstations to disallow users do whatever they want apart from their direct responsibilities – Serge Oct 27 '17 at 12:17
3

I thought about this for a while, and I think a method similar to this would work:

Have a cron job create a file in the root home directory (usually /root). Do this once a day. The file should contain an integer value for the number of minutes that the users are allowed to access "blocked" sites per day.

Add a line to your /etc/hosts file redirecting all disallowed websites to localhost; This has the effect of "blocking" those websites.

Write a small program that takes one parameter that represents minutes. The program will subtract the number of minutes requested from the file in the root home directory. The program will edit the /etc/hosts file to remove those "blocked" sites, and reset the network interface. It will then sleep for the chosen number of minutes, edit the /etc/hosts file again to block the websites, and reset the network interface. This will be allowed until the file in the root directory stores a zero. Then it will only be reset the next day.

  • Thanks, however, this seems like alot of nontrivial programming that would take a while to implement. – Julie Oct 31 '17 at 4:34
  • Which element do you need help with? I can try to direct you a bit more... – Academiphile Nov 2 '17 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.