Setting Up a Linux Laptop for Your Child (e.g. Edubuntu) Safely

A used Linux laptop is a good choice for a child: cheap and quick even on older hardware. Many schools use Edubuntu for this, an Ubuntu variant that, according to its website, is built for the classroom. What you won't find there is a ready-made parental control. You build it yourself in five steps.

Step 1: An account without administrator rights

On Ubuntu, the first user you create during installation is the administrator. Your child shouldn't work with that account. Create an administrator account for yourself (with your own password that only you know) and a standard account for the child. You find it under Settings → System → Users (menu names and looks differ by version and desktop). A standard account can't install programs system-wide or change system settings without entering your password. Set up the child's account together: your child picks the name and background and watches as you set up the browser. Explain why it isn't an administrator: "So nothing breaks and we decide together what gets installed." Your child may suggest programs.

Step 2: Turn on updates

Current updates are the most important protection against malware. Switch on automatic updates in the settings and check once a month that the laptop really is up to date.

Step 3: Keep the browser in hand

The browser is the gateway to the net and so the most important place. Two things matter:

• To begin with, one browser only. Allow only the browser you set up on the child's account. Installing programs system-wide then needs your password. Programs in the child's own folder (for example as an AppImage or Flatpak in the user area) are a gap a standard account alone doesn't close.
• Check DNS over HTTPS. Firefox can look addresses up encrypted at a provider of its own and so walk around the filter in the router. In Firefox, look at the "DNS over HTTPS" section under Privacy & Security in the settings. Safest is "Off". With the snap version of Firefox that Ubuntu ships, a lot can behave differently; rely on the display in about:policies. All steps, including how to set it permanently, are in Why Parental Controls Sometimes Don't Work.

Step 4: The filter in the home network

On Wi-Fi the laptop asks the DNS server the router specifies. If a filter is entered there, it applies automatically, with no setting on the laptop. The Internet-Schutzschild enters it at the router, which then applies to all devices on the Wi-Fi, not on mobile data. How that works is in Setting Up the Internet-Schutzschild on Your Router. Important: enter the filter for IPv4 and IPv6.

If you also want to set the filter on the device itself, go to Settings → Wi-Fi → gear icon next to the network, then the IPv4 and IPv6 tabs, field DNS. The device then asks this server outside the home network too. Whether a standard account may change the network settings, check on the child's account itself.

A technical note: Ubuntu routes DNS requests through a cache of its own (systemd-resolved). Its encryption (DNS-over-TLS) is off by default according to the manufacturer's documentation; a distribution can change that. So the filter in the router sees the requests only as long as nobody redirects them encrypted on the device. That is a setting, not a quirk of the system.

Step 5: Limit programs

For Ubuntu, the package archive (universe) has the program malcontent, which according to its package description provides a framework for parental control of applications. With the graphical interface malcontent-gui you choose which programs the child may start. It is not web filtering. It complements the filter but doesn't replace it. Whether and how it is built into your Edubuntu version, best check yourself.

Also decide where the laptop sleeps in the evening, for example at a charging spot in the hallway. That is simpler and fairer than any time lock, and screen light in bed is gone.

On a child's laptop with Edubuntu we noticed three things:

1. The IPv6 address changed several times a day. A rule tied to such an address didn't hold. Device rules belong to the fixed number of the network card (MAC), not to an address.
2. The browser asked by itself. Firefox went around the filter through DNS over HTTPS although the network's signal address was blocked. We haven't conclusively worked out why.
3. Browser games kept running because they loaded their files from other servers than the blocked portal. More in Browser Games Despite a Block.

Log in with the child's account and open the protection check. Then try whether the browser can be changed without your password. Repeat the test after major updates. And talk to your child about what you set up and why. That turns a technical block into an agreement they back. How to write it down is shown in the family media agreement.