Raspberry for kids: remote management, web filtering & parental controls

Following on from my post about setting up my kids with a Raspberry Pi 400 as their first computer, here I share how I’ve made the system easy to manage remotely and how I imposed some light parental controls, all while keeping the system open to tinkering. It will be a matter of time until they discover how to break out of it — indeed I see that as part of the challenge of discovery that I hope they’ll take on.

I wanted the Pi 400 to be part of our home network for easy remote management. I also want the kids to be able to use a browser and interact with websites. At the same time, I am quite mindful of their privacy and safety, so I wanted to start with a simple whitelist of websites they could visit. And finally, since it’s useful to have some insight into how the thing is used, and if needed set some limits, I figured out a low-friction way to keep track and set reasonable limits with friendly notifications.

Remote management via SSH

For ssh access all I needed to do was enable the ssh server on the Pi 400: sudo raspi-config > 3. Interface options > I2. SSH Enable remote command line access. This makes it possible to SSH into the Pi 400 from other computers in the network.

For good measure I also added the option to log in by remote desktop. This means installing xrdp and (owing to some Raspbian weirdness I don’t want to understand) removing the remote user from the video and render groups. A fun side-effect is that we have in effect a way to replicate the Raspberry Pi 400 desktop experience, in case they’re finding it hard to share (which is bound to happen).

Thanks to the remote access I can manage the Raspberry Pi 400 from other systems on our network. This also means I can help the kids troubleshoot, or install a bunch of new games for them to discover even as they’re using the computer.

Whitelisting websites through pi-hole

I first looked into options to filter or tamp down access on the Pi 400 itself, but I soon realized the safer and easier to manage solution would be to use the Pi-hole we already had running in our network. (If you have configurable router, you can probably accomplish much the same in the router settings itself by restricting access for one client.) Here’s what I did:

1. Make sure the Pi 400 had a stable IP by telling my router to bind its MAC address to a particular IP
2. In the Pi-hole configuration, add a client corresponding to the Pi 400, and create a group “kids” holding that client. Create further groups for other clients for good measure, so that every device on the network is in such a group.
3. Set the “default” group to disabled (we’ll see why later)

Now we want to make it so that clients in the kids group can only access whitelisted websites (for starters). To do so, we first need to block everything for that group.

1. In the Pi-hole admin settings, go to Group Management > Domains.
2. Click the tab “Add a Regex filter” and specify the following: ([a-z])*\.[a-z]{2,}$ . This regex matches all domain names that use alphabetical characters. Add this as a blacklist filter. Adding a new filter will apply it to the “Default” group by default (this is why it’s useful to set that group to disabled: otherwise you might be locking yourself out).
3. Find the newly created row in the Domain/RegEx table and click on ‘group assignment’ to select the kids group. Don’t forget to click the green “Apply” button on top of the selection menu.
4. Now for every site you want to whitelist, follow the same procedure: add a new filter, click “Add to whitelist”, and assign the rule to the “kids” group.

The whitelist includes stuff related to the Raspberry Pi (e.g., tutorials, useful Raspbian packages), access to Wikipedia, and access to Hedy (at Hedy.org), which could become their first textual programming language.

Parental controls, or, how much time do they get?

There isn’t a high demand for screen time in our household: we don’t own a TV and viewing video content is not a daily must for the kids. A computer of course adds a very visible screen in the living room that brings its own special pull. I wanted a simple way to make the kids aware of how time is passing when you’re using a PC, and to set some sensible limits.

They’re telling me some of their friends have 30 minutes of daily computer time. We’ll probably end up with a broad daily interval for computer use, and within that, a set of processes limited to an allotted amount of PlayTime. Apps that fall outside of this (e.g. Klavaro for learning to type or Firefox+Wikipedia for looking up information) are not directly limited.

I found that Timekpr-nExT offers exactly what I need: highly customizable ways of setting limits, including abilities to adjust on the fly, limit certain apps only, and customize the settings for each user.

It took me a while to get it to work on the Raspberry Pi though. This is because RPi doesn’t come with some basic things Timekpr-nExT expects to be there — most critically a notification manager. It did work without that, but would not show any notifications, closing the session without a warning when time was up. Here’s what I did to get things working:

0. Install a screensaver

sudo apt install -y timekpr-next
sudo apt install -y xscreensaver

1. Install a notification manager:

sudo apt install -y notification-daemon

2. add it to the services for my desktop environment by editing this file:

sudo nano /usr/share/dbus-1/services/org.freedesktop.Notifications.service

3. and adding these lines to that file:

[D-BUS Service]
Name=org.freedesktop.Notifications
Exec=/usr/lib/notification-daemon/notification-daemon

I am guessing this may work more easily out of the box for the Pi5, which has a different desktop environment (Wayland) — but for everyone out there running Raspberry OS based on Debian Bullseye or lower, this is likely to solve any issues you may have with Timekpr-nExT not showing notifications.

In conclusion: let them tinker

The current setup gives me good ways to let the kids discover for themselves what they can do on the Raspberry Pi. It is easy to administer over SSH, the whitelisting behind the pi-hole means there are no privacy or safety issues to worry about just yet, and Timekpr-nExT enables simple time accounting for when we need it.

As the whole thing is pretty new still we’re not setting strict time limits just yet. The kids agree however that limits are sensible, and that some apps are more useful than others. Over the next few weeks we’re going to refine the settings together. My hope is that this will turn their Raspberry Pi into a device for discovery and exploration.

The first signs are all good. They love seeing their own learning curve in Klavaro; they are as addicted to Nibbles as I once was (also we have a lot of fun in the multiplayer mode); and just this morning I overheard the 6 year old telling the 9 year old you can “simply Tab > Tab > Enter” to move through the settings if you don’t want to use the mouse. Looks like it is shaping up as a good foundation for them to build digital literacy.