# Can "hosts" file be locked? **URL:** \ **Category:** Factual Questions\ **Created:** [July 24, 2014, 6:18pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954 "2014-07-24T18:18:25Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 25, 2014, 2:08pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/21 "2014-07-25T14:08:58Z")
My own setup at home is that my son’s computer is connected to an isolated VLAN that runs to a dual-homed Linux host running Privoxy, which allows me to white-list sites. I can also white-list a site for referral. So he can get to [marvel.com](http://marvel.com) and [nintendo.com](http://nintendo.com), plus (without intervention from me) get to any site linked to from those sites. Anything else, he’s stuck. He has nearly 1,800 white-listed URLs now (this setup has existed for several years) and I look back with fondness on [webkinz.com](http://webkinz.com), his very first white-listed site. His computer’s MAC is blacklisted at the home router. He could grab the router and factory reset it, to be sure, but then I’d know he’d done so. There’s also a WAP on his VLAN to support his iPad use. If he learns enough to get around that, he’s old enough to look at what he wants. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 25, 2014, 2:22pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/22 "2014-07-25T14:22:57Z")
> [@Bricker](#): > > My own setup at home is that my son’s computer is connected to an isolated VLAN that runs to a dual-homed Linux host running Privoxy, which allows me to white-list sites. I can also white-list a site for referral. So he can get to [marvel.com](http://marvel.com) and [nintendo.com](http://nintendo.com), plus (without intervention from me) get to any site linked to from those sites. Anything else, he’s stuck. He has nearly 1,800 white-listed URLs now (this setup has existed for several years) and I look back with fondness on [webkinz.com](http://webkinz.com), his very first white-listed site. > > His computer’s MAC is blacklisted at the home router. He could grab the router and factory reset it, to be sure, but then I’d know he’d done so. > > There’s also a WAP on his VLAN to support his iPad use. > > If he learns enough to get around that, he’s old enough to look at what he wants. Or he sticks a router with wifi in line with the WAN feed. Does the WAN side of your LINUX use DHCP? Or figures out how to get into a neighbour’s wifi. And so on… I think your last line is the most valid. Like most parenting situations, all you can do is try… ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 25, 2014, 11:12pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/23 "2014-07-25T23:12:22Z")
> [@md2000](#): > > Or he sticks a router with wifi in line with the WAN feed. Does the WAN side of your LINUX use DHCP? Or figures out how to get into a neighbour’s wifi. And so on… It’s not really correct to ask about “the WAN side” of the Linux host; both interfaces are LAN. One is the kid VLAN; the other is the house VLAN. There’s no DHCP on the house VLAN; all house devices are statically assigned and their IPs white-listed at the border firewall. (I also have a guest VLAN on yet another wireless AP that routes directly to the outside world; that is enabled when I have guests and I give them the password and change it when they leave.) He could physically add a router with Wifi to the house LAN, but that router wouldn’t have access to the outside world because it’s WAN side IP isn’t whitelisted at my router. He could theoretically unplug my border firewall and plug in his own router, but that would trigger my Nagios instance because it could no longer ping external reference points. So my Nagios dashboard would show an unexplained drop in network connectivity that would be hard to explain. ---
**Author:** ![amanset](https://avatars.discourse-cdn.com/v4/letter/a/8dc957/32.png) [@amanset](https://boards.straightdope.com/u/amanset)\ **Post date:** [July 25, 2014, 11:47pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/24 "2014-07-25T23:47:53Z")
> [@Bricker](#): > > My own setup at home is that my son’s computer is connected to an isolated VLAN that runs to a dual-homed Linux host running Privoxy, which allows me to white-list sites. I can also white-list a site for referral. So he can get to [marvel.com](http://marvel.com) and [nintendo.com](http://nintendo.com), plus (without intervention from me) get to any site linked to from those sites. Anything else, he’s stuck. He has nearly 1,800 white-listed URLs now (this setup has existed for several years) and I look back with fondness on [webkinz.com](http://webkinz.com), his very first white-listed site. > > His computer’s MAC is blacklisted at the home router. He could grab the router and factory reset it, to be sure, but then I’d know he’d done so. > > There’s also a WAP on his VLAN to support his iPad use. > > If he learns enough to get around that, he’s old enough to look at what he wants. Do you lock up the Linux host physically? If not, it is a quick live CD and he’s away. Basic rule of computer security: if you allow physical access to the server then you have no security. ---
**Author:** ![simster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/simster/32/1047_2.png) [@simster](https://boards.straightdope.com/u/simster)\ **Post date:** [July 26, 2014, 1:38am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/25 "2014-07-26T01:38:11Z")
> [@Bricker](#): > > My own setup at home is that my son’s computer is connected to an isolated VLAN that runs to a dual-homed Linux host running Privoxy, which allows me to white-list sites. I can also white-list a site for referral. So he can get to [marvel.com](http://marvel.com) and [nintendo.com](http://nintendo.com), plus (without intervention from me) get to any site linked to from those sites. Anything else, he’s stuck. He has nearly 1,800 white-listed URLs now (this setup has existed for several years) and I look back with fondness on [webkinz.com](http://webkinz.com), his very first white-listed site. > > His computer’s MAC is blacklisted at the home router. He could grab the router and factory reset it, to be sure, but then I’d know he’d done so. > > There’s also a WAP on his VLAN to support his iPad use. > > If he learns enough to get around that, he’s old enough to look at what he wants. You’ve just earned a gold star for the day - and I thought you were just a lawyer. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 26, 2014, 2:36am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/26 "2014-07-26T02:36:45Z")
> [@amanset](#): > > Do you lock up the Linux host physically? If not, it is a quick live CD and he’s away. > > Basic rule of computer security: if you allow physical access to the server then you have no security. No, the Linux host isn’t locked up physically…but if he were to reboot it with a Live CD (and to do that he’d have to know the BIOS password in order to enable boot from the CD) that too would show up in the Nagios dashboard as an extended outage. ---
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [July 26, 2014, 4:34am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/27 "2014-07-26T04:34:24Z")
> [@Bricker](#): > > Not necessarily. That assumes the http server hosting the site is only hosting that site on that IP. There are many more DNS names than there are IP addresses in the world. (Well, IPv4 addresses, anyway). Web servers can host multiple sites at a single IP address and manage the traffic by looking at the host header name passed by the browser. But that fails if you try to use an IP address in the browser. > > ETA: Er… as explained already in post 14, which corrected post 12’s wrong idea. You mean post 7, where I was initially right. ---
**Author:** ![Bryan\_Ekers](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bryan_ekers/32/183_2.png) [@Bryan\_Ekers](https://boards.straightdope.com/u/Bryan_Ekers)\ **Post date:** [July 26, 2014, 4:44am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/28 "2014-07-26T04:44:20Z")
Why not just set up a virtual PC and let him look at whatever he wants? Personally, I’d be more concerned about protecting the computer from malware than protecting the boy from boobies. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 26, 2014, 1:48pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/29 "2014-07-26T13:48:40Z")
> [@Bryan\_Ekers](#): > > Why not just set up a virtual PC and let him look at whatever he wants? Personally, I’d be more concerned about protecting the computer from malware than protecting the boy from boobies. If you’re aware of a technical solution that could limit questionable sites to those that merely expose “boobies,” I would certainly be interested in learning more. My concern is more that he stumbles upon Raven, Starfire, and Beast Boy in a threesome scene that ends when Beast Boy is knocked out by a tentacle creature with rapey intentions towards the two female Teen Titans. More generally, I am convinced that at 12, it’s still appropriate to sharply limit his unfettered access to the Internet, because the questionable material that is available is not “boobies.” I understand that you, personally, would not be as concerned as I, and of course that’s your privilege to apply to your children. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 26, 2014, 1:52pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/30 "2014-07-26T13:52:26Z")
> [@ZipperJJ](#): > > You mean post 7, where I was initially right. You were. Missed it. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 26, 2014, 1:54pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/31 "2014-07-26T13:54:14Z")
> [@simster](#): > > You’ve just earned a gold star for the day - and I thought you were just a lawyer. “Just?” 🙂 ---
**Author:** ![Bryan\_Ekers](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bryan_ekers/32/183_2.png) [@Bryan\_Ekers](https://boards.straightdope.com/u/Bryan_Ekers)\ **Post date:** [July 26, 2014, 3:45pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/32 "2014-07-26T15:45:42Z")
> [@Bricker](#): > > If you’re aware of a technical solution that could limit questionable sites to those that merely expose “boobies,” I would certainly be interested in learning more. My concern is more that he stumbles upon Raven, Starfire, and Beast Boy in a threesome scene that ends when Beast Boy is knocked out by a tentacle creature with rapey intentions towards the two female Teen Titans. It’s not a concern I can bring myself to share. I get that rapey violent cartoons (or rapey violent media in general) might seem like they _should_ mess a kid up, but I’m not convinced they do. Further discussion along those lines is more GD than GQ so I’ll drop it. If the OP is determined to put in such blocks, I’ll give some thought to purely technical suggestions to that end. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 26, 2014, 4:37pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/33 "2014-07-26T16:37:24Z")
[I agree that GD](http://boards.straightdope.com/sdmb/showthread.php?p=17583257#post17583257) is the right venue to continue this interesting tangent. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 26, 2014, 6:17pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/34 "2014-07-26T18:17:42Z")
> [@Bricker](#): > > It’s not really correct to ask about “the WAN side” of the Linux host; both interfaces are LAN. One is the kid VLAN; the other is the house VLAN. There’s no DHCP on the house VLAN; all house devices are statically assigned and their IPs white-listed at the border firewall. (I also have a guest VLAN on yet another wireless AP that routes directly to the outside world; that is enabled when I have guests and I give them the password and change it when they leave.) > > He could physically add a router with Wifi to the house LAN, but that router wouldn’t have access to the outside world because it’s WAN side IP isn’t whitelisted at my router. He could theoretically unplug my border firewall and plug in his own router, but that would trigger my Nagios instance because it could no longer ping external reference points. So my Nagios dashboard would show an unexplained drop in network connectivity that would be hard to explain. So could he impersonate a device on the adult side with the correct IP and MAC? Use wireshark to see what’s running there. Is he allowed to see straightdope? ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 26, 2014, 6:37pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/35 "2014-07-26T18:37:01Z")
> [@md2000](#): > > So could he impersonate a device on the adult side with the correct IP and MAC? Use wireshark to see what’s running there. He could theoretically spoof one of the authorized devices on the adult network. But that’s going to trigger an IP address conflict from the device he’s spoofing. > [@](#): > > Is he allowed to see straightdope? Nope. The minimum age for the site is 13, so that’s a hard-stop. If he’s interested, I’d be open to adding it to his white-list after he’s 13. ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 26, 2014, 6:42pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/36 "2014-07-26T18:42:28Z")
> [@Bricker](#): > > He could theoretically spoof one of the authorized devices on the adult network. But that’s going to trigger an IP address conflict from the device he’s spoofing. > > Nope. The minimum age for the site is 13, so that’s a hard-stop. If he’s interested, I’d be open to adding it to his white-list after he’s 13. Well obviously he would turn off or disconnect that device first. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 27, 2014, 2:15am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/37 "2014-07-27T02:15:43Z")
> [@md2000](#): > > Well obviously he would turn off or disconnect that device first. Then he triggers a Nagios alert for the device he turns off or disconnects, and a syslog or Event Log entry on the disconnected device too. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [July 27, 2014, 2:57pm UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/38 "2014-07-27T14:57:23Z")
A 100 buck tablet and prepaid 3G card? ---
**Author:** ![md2000](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@md2000](https://boards.straightdope.com/u/md2000)\ **Post date:** [July 28, 2014, 2:21am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/39 "2014-07-28T02:21:21Z")
> [@Bricker](#): > > Then he triggers a Nagios alert for the device he turns off or disconnects, and a syslog or Event Log entry on the disconnected device too. At that point, if it were me, I would be randomly turning stuff off and on just to generate bogus events and confuse my parents. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [July 28, 2014, 3:02am UTC](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954/40 "2014-07-28T03:02:52Z")
> [@md2000](#): > > At that point, if it were me, I would be randomly turning stuff off and on just to generate bogus events and confuse my parents. What a good thing you aren’t a child of mine. But for this discussion the relevant fact would be that I have a technical control that detects unexpected shutdowns. [Previous page](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954.md?page=1) [Next page](https://boards.straightdope.com/t/can-hosts-file-be-locked/693954.md?page=3)