5

I have kids that are old enough to start getting curious, and, while I don't think it's an active problem, I'd rather avoid the usual garbage that comes along the average Google search. Google's SafeSearch is a good filter, but forcing it to be used at the network level has been a difficult proposition. This is (at least) their 3rd iteration of the process.

Per Google's current suggestion to force network users into SafeSearch:

https://support.google.com/websearch/answer/186669?hl=en&ref_topic=3427534

To force SafeSearch for your network, you’ll need to update your DNS configuration. Set the DNS entry for www.google.com (and any other Google ccTLD country subdomains your users may use) to be a CNAME for forcesafesearch.google.com.

I've seen a couple of articles about configuring dnsmasq to do this, but I'm running a local instance of bind as a forwarding caching server (using OpenDNS), but also hosting my internal domain. How would I configure bind with just this one CNAME for all of Google? I can't fathom how I would even start to make my server act as canonical for google.com, but pass through everything but the host "www".

(In the past, I've tried Dansguardian rewrites. Now, I've just gone through the effort of trying SquidGuard redirects. I can't seem to get this accomplished without ruining Google altogether. If there's an answer in proxy-land, or even iptables, I could do that as well. Just sayin'.)

migrated from serverfault.com Oct 15 '14 at 2:44

This question came from our site for system and network administrators.

  • Great question. I'm curious to see the answer. I never even knew that this was a possibility. This will probably get migrated to Superuser, though, as it's a home network question. – EEAA Oct 15 '14 at 1:10
  • I wrestled with that myself, but the Google answer is about how to protect a school network, so I thought this the slightly-better-of-the-two option. – David Krider Oct 15 '14 at 1:13
  • Take a look at RPZ which is targeted at this and similar scenarios. (en.wikipedia.org/wiki/Response_policy_zone) – Brian Oct 15 '14 at 1:20
2

From the ISC Docs about response policy it shows some sample BIND9 configuration which I have modified and posted below. (ftp://ftp.isc.org/isc/dnsrpz/isc-tn-2010-1.txt):

options {
  // other stuff
  response-policy {
     zone "www.google.com" policy CNAME forcesafesearch.google.com;
     zone "www.google.ca" policy CNAME forcesafesearch.google.com;
  };
};
  • Wow. New trick. I had never heard of this in BIND. I tried copy-pasting your snippet into named.conf.options, but the error message made it clear that wouldn't be enough. Thanks to your tip and link, though, I found http://jpmens.net/2011/04/26/how-to-configure-your-bind-resolvers-to-lie-using-response-policy-zones-rpz/, which led me to create a new "db.response" zone file that contained the header shown there, and one entry: www.google.com CNAME forcesafesearch.google.com. It's working great. In Chrome, there's even a message: "Your network has turned on SafeSearch..." – David Krider Oct 15 '14 at 3:02
1

Here's a little more specific and detailed information on how to do this. I made a directory called /config/bind to hold named.conf.default-zones, named.conf.local, and named.conf.options. Then I went into /etc/bind/named.conf and put includes. This isn't overly important for the particular task, but it does make it so you can update bind later without losing your config files. You would just have to go into /etc/bind/named.conf add the include statements back in after named.conf gets overwritten (if it does).

/etc/bind/named.conf

//these are the only entries in my entire named.conf file
include "/config/bind/named.conf.options";
include "/config/bind/named.conf.local";
include "/config/bind/named.conf.default-zones";

/config/bind/named.conf.local

zone "rpz" {
    type master;
    file "/config/bind/db.rpz";
    allow-query {none;};
};

/config/bind/named.conf.options

//note: I added the following lines to this file. 
//There are/were three other lines in it that weren't comments.
    listen-on-v6 { none; };
    listen-on { 192.168.1.1; };
    forwarders { 8.8.8.8; 8.4.8.4; };

    response-policy { zone "rpz"; };

db.rpz a text file I had to create myself. Most other tutorials show it to exist in a different, data directory. I didn't bother as I consider it to be part of my config. Note that I tried to cover a lot of international, English speaking countries/domains. I know I didn't get them all. I'm also not sure how a configuration like this would work for someone outside the US as google doesn't appear to have safe search domains configured for every country.

/config/bind/db.rpz

$TTL 60
@ IN SOA localhost. root.localhost. (
        2014110500;
        10800;
        3600;
        604800;
        10800 )
        IN      NS      localhost.
;
; Google forced Safe Search zone and data
google.com              CNAME forcesafesearch.google.com.
www.google.com          CNAME forcesafesearch.google.com.
google.ca               CNAME forcesafesearch.google.com.
www.google.ca           CNAME forcesafesearch.google.com.
google.co.uk            CNAME forcesafesearch.google.com.
www.google.co.uk        CNAME forcesafesearch.google.com.
www.google.com.au       CNAME forcesafesearch.google.com.
google.com.au           CNAME forcesafesearch.google.com.
www.google.co.in        CNAME forcesafesearch.google.com.
google.co.in            CNAME forcesafesearch.google.com.
www.google.ie           CNAME forcesafesearch.google.com.
google.ie               CNAME forcesafesearch.google.com.
www.google.com.jm       CNAME forcesafesearch.google.com.
google.com.jm           CNAME forcesafesearch.google.com.
www.google.co.za        CNAME forcesafesearch.google.com.
google.co.za            CNAME forcesafesearch.google.com.
google.com.ph           CNAME forcesafesearch.google.com.
www.google.com.ph       CNAME forcesafesearch.google.com.

When you're all done editing your files, don't forget to restart the service. I'm using:

sudo service bind9 restart

You might also find that you need to modify permissions on files after moving them. Or that you have to configure bind/named to start at bootup, but those are topics outside the scope of what we're trying to accomplish here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.