Configuring K9 Web Protection for Internet Filtering

November 1, 2015 Todd Love

There are multiple solutions available for content filtering on your computer; Net Nanny, Norton Family Premiere, WebWatcher, MCafee, etc. Unfortunately, the most often overlooked option is, in my experienced opinion, the best product: K9 Web Protection.

K9 is a FREE product. Yes, free! Why free? Two reasons: First, Bluecoat, a corporate Information Security firm, officially offers K9 free as a part of their "Corporate Social Responsibility" program. Very cool and progressive. Second, having as many users as possible accessing one of their flagship products (the sophisticated technology behind the K9 web-filter) allows them to build a better high-end corporate product.

I’ve used all of the other programs, and found holes in each of them; sometimes gaping holes. In fact, I once called in an issue to technical support for one of the above products, and was told by one of their support engineers “umm ya, I guess thats a big hole. Please don’t tell anyone about it.” Hmm. Wasn't worth the $xx yearly fee. As such, K9 is my recommendation, and the following are my recommended steps for a secure configuration of K9 on your Mac:

CONFIGURING K9 WEB PROTECTION

Prior to configuration, you will need to download and install the application. It is CRITICAL that you use your accountability partner’s email address for the license request. Do not register the product with an address that you have access to.
If you do not know how to install an application on your Mac, you can find basic instructions on how to do so here, and somewhat more detailed instructions here (pages 15-19)

Next, go to the “Configure K9 Web Protection” icon located in your Launchpad (or in the “K9 Web Protection” folder in your Applications list). I have found that the default settings for K9 are insufficient, and below are my recommended customizations. Note that this will change per user and per need.

TIP: Remember to click “Save” at the bottom right of each screen after making any changes.

Time Restrictions

(I dont use any, but this may be helpful for some)

Web Site Exceptions

This allows you to block and/or allow specific sites.
“Always Block” - This is helpful for someone who struggles with a particular site that is not included in the K9 categories. I recommend, at minimum, including the following, as it is a required step for the iPhone management, which I will discuss in that section:

appldnld.apple.com

Other possibilities: Some people may need to add amazon.com in order to prevent access to the available erotica. Others may want to block Wikipedia.org or, at minimum, wikimedia.org (to prevent access to the repository of pictures).

“Always Allow” - There will be sites that a person legitimately needs to access that are blocked by default. At minimum, the following two are required in order for the Mac to function properly:

itunes.apple.com (required to access the iTunes Store)
swcdn.apple.com (required to allow the App Store to download updates)

Other suggested additions to consider:

googleapis.com and gstatic.com - (allowing google analytics, ad tracking, etc.)
i.kounamaoni.com
k9safesearch.com
licdn.com and linkedin.com - to allow LinkedIn
live.com and live.net - if user needs to access online Microsoft functionality
netflix.com
skype.com
ted.com
yourbrainonporn .com

Finally, at the very bottom of the window, select “Blacklist Without Password"

Blocking Effects

Select “Show Admin Options"
Select “Show https blocks"

URL Keywords

It is often helpful to list here any particular terms that lead to problematic sites, thus allowing an extra layer of protection against sites that may not be included in the block list. To pick a random example, someone with a shoe fetish may want to enter shoe* (* allows for varients such as shoe, shoes, etc).

Safe Search

Select all options

Other Settings

Select all options
<note: "Supervisor Mode" button is located here, discussed below>

Password/Email

Make sure the accountability partner’s email is listed, not the user's.

Making Changes:

Click on the “Configure K9 Web Protection” app icon to launch the setup window. Have the accountability partner enter their password, then go to "Other Settings", and click on "Enter Supervisor Mode”. Choose a time window for which you want the machine to be unlocked (60 mins is max), and then make sure you click on the Enter Supervisor Mode link after selecting the time. This will allow temporary unblocked access to the web. This is useful when troubleshooting problems or making changes. A few examples would be when someone needs to validly download software, or validly needs temporary full access to google or other websites otherwise blocked.

Two Main Limitations:

First, note that K9 is a filtering/blocking software only, and does not have accountability reporting features. Some people prefer (and are able) to have full access to the internet as long as they know that their traffic is being logged and will be regularly reported to their accountability team (ex. Covenant Eyes). People with more entrenched impulse control/addictive challenges, often do not find that to be a strong enough solution, as they often default to an “I’ll do it now and deal with the consequences later” mode. As such, this solution is for them.

Second, the loss of open access to Google (or other search engines) makes modern internet life very difficult, however, having unfettered access to google is often dealbreakingly problematic for those with compulsive Internet use problems. Fortunately, K9 has a solution to this; K9 Safe Search. While not as robust as full access to Google, K9 Safe Search provides managed search engine functionality. I have found it to be a good compromise.

Finally, I don't consider it a full "limitation", but note also that Bluecoat discontinued official technical support for the K9 product a few years ago, which is understandable as it's a free product. It appears, however, that they do seem to keep the K9 product itself updated; via both beta and gold releases (don't worry if you don't know what this means).

Long-Term Management/Use:

Set realistic expectations. There WILL BE sites that come up as blocked that are validly needed, as well as problematic sites that are not included in the above blocking configuration. Be patient and add them as you go (see steps below). As with the Mac itself, this is a dynamic and iterative process.

See this content in the original post

Doc Todd Love, LLC