Tips/How To: Use the Mac to ground your kids
Ahhh report card season. There can be no prouder moment in a parent’s life than when they open that report card and see that their little babies are excelling in their studies 
thanks to countless hours of hard work, studying, determination, and of course, amazing genetics. And of course there can be no greater sense of shame, disappointment, and out-right “how can I have been so blind?”-rage when you find out your little angel has spent most of their time not studying, but chatting online with friends.
This brings us to a question posed to us by faithful Macenstein reader DK, who writes:
“Hey Doc, I wish to stop my son from chatting with friends on his Mac for 3 weeks as punishment for his last report card. Is there an easy way to do this, so that it is reversible? He has an iMac, connected via Ethernet. His account is the only account on the system, and he is an admin, so I don’t think I want to mess with trying to convert him to a limited account. I guess we should have done that from the start. If possible I’d like to be able to still use iChat on MY laptop as well. Any suggestions?”
Hmmm… well, yes, if he were on a restricted account this would be easier. The main thing to realize here is if he really wants to, odds are he can find a way around most blocking measures. It all depends on how computer savvy he is (or his friends are). Hopefully his bad grades are a sign he isn’t overly motivated. Here are some suggestions…
1) Well, the easiest thing would be to simply remove the Ethernet cable from the iMac. He will have no internet access at all, but chatting will also be impossible.
2) It might also be a good idea to move the computer out of his room for those 3 weeks into a common living room area, so you can see when he is using it, and how.
3) If your son gives you some line about needing the internet to do homework (which he obviously HASN’T been doing) you could delete iChat from his computer (in the Applications folder). Since you mentioned you have iChat on your laptop, you could recopy it over in 3 weeks. This is not a fool proof way around it, of course, as he could chat via many different web-based clients, move a friend’s copy of iChat over on his iPod, or use other chatting programs like Adium.
4) If your kid isn’t all that computer savvy, you could try to use the FireWall built into OSX on his computer to block iChat. He may not know where to look or what to look for. In fact, in Leopard, I have no idea. It was easier in Tiger. Check out this link on Apple’s site for information on OS X FireWall and Chatting ports.
5) Unfortunately, your best bet is probably to block the ports iChat uses on your router. This can get a little technical, and also unfortunately means you will also not be able to use chatting programs yourself, but you’ll have the best chance of success. You’ll have to consult the manual that came with your router for specific instructions, but in general you’ll want to block ports 16384 through 16403, 5060, and and 5678. Again, check the above link for a full list of iChat ports.
So hopefully one of those suggestions helps you DK. But I am sure there are other ways, and I also put the call out to our other faithful Macesntein readers to help out with any other useful Mac-based disciplinary tricks they may know.
Isn’t this what Leopard’s Parental Controls are for? You can simply disallow access to iChat and any other chat application. Then you have web-based chat clients that you would need to keep an eye on and block those sites as needed.
Jon
Yes, quite right Jon. Parental controls are indeed the way to go, but she said they did not set up her son’s computer that way, unfortunately. You can alos set time limits, if using parental controls. But that’s what what you get for giving your kids too much independence, if I may get preachy for a moment.
Unless that kid bought that iMac, the parent should be the only admin on that system.
-The Doc
I did overlook that part about his being the only account in the machine. In that case, the parent could(should) create another admin account and “demote” the child to non-admin status.
Other than that, being in control of the router is the next best thing. Here’ s to hoping the child didn’t setup the router for the parent.
That’s what I was going to suggest. He could create an administrative account and then demote his child’s account. Then he could use parental controls.
Thanks guys for your help. Is there nothing that potentially will get screwed up for my son if I make him a child’s account? Will he come running in to me for me to type in my admin password to install apps and change control panels?
-DK
DK, sure he will come to you… but I think he can live without onstalling anyting new on those 3 weeks… as a part of the punishment.
And if he really needs to… you can go, and type it once (without him peeping 😉 ).
Then, with you as an admin, you can apply the parental filters ]:-)
DK,
Your assumption is correct. If your son is accustomed to changing system prefs and installing software, then the demotion to non-admin status may be shocking, since he will no longer be able to do those things without an administrator name and password.
Jon
Am I the only one disappointed with the new parental controls in Leopard?
The time restrictions work quite well, but the ability to block application use appears to be limited to a few Mac-only applications.
What I would like to be able to do, and quite frankly expected in the Leopard upgrade, was to be able to isolate any individual application on the system, and restrict its use.
ie, by creating a list of applications, and then blocking them between particular hours . This would allow full internet access, but block the use of MSN/Ebay/YouTube etc. to ensure that the little darlings actually do their homework when they are supposed to. When they’re done, they all get switched back on again. Apps could be added to/removed from the list as required.
Everyone’s happy, great grades ensue, and a lifetime of fulfillment is laid at their feet…probably.
Anyone out there on the interwebs know of any such application?
If you’re familiar with the Unix side of OS X, you can enable the root password, then make sure that iChat is owned by root, and disable all non-root access.
I agree with Khan, its really not that difficult and it works great. I use little tricks like that with my Mac labs at school.
Parents outsmarting children regarding computers isn’t the best way to stop a child using instant-messaging.
The second option is by far the best way of doing things.
All the described options aren’t going to work..
1) Remove the Ethernet cable – Well, that’ll work, but if you just want to stop the child chatting online, it’s a bit overkill..
3) delete iChat – As stated, it’s trivial to use a web-messenger that they’ll use at school and such, or download Adium, or grab it of the OS X install disc or a backup, or…
4) the FireWall built into OSX on his computer to block iChat. Again, this won’t stop web-messengers, and possibly not other IM applications, and I recall seeing somewhere that iChat can use port 80 as a fall-back (For AIM possibly?)
5) best bet is probably to block the ports iChat uses on your router. – Same problems with the firewall. It’s very easy to bypass, and will stop the parent from using iChat.
I suppose the other technical way of blocking it would be to change the childs password for a few weeks, but again, this is far from prefect.
I’d suggest just paying more attention to what they’re doing on the computer – just make sure iChat isn’t running but hidden, or any web-IM sites aren’t open.. Easy, and has lots of other benefits.
Solution #5 sounds “best” to me.
Just block the Chat Ports to his IP and leave yours free… Of course, if he knows his ways around some ssh-tunneling he will be chatting again in no time…
Generally speaking, find some better way to encourage your kids to do some learning. Internet and Computer filtering and blocking are possibly not your best bet…
The “router” idea is on track, but should be refined better. Most routers use something called NAT to share one “real” Internet address with multiple computers. DK should definitely be the only one with Admin access to set up the router.
Use the website I linked to my name to find the ports you need to control for iChat. Then, in the router setup, you can link those ports to the internal IP address for your computer, which would leave other computers on your network unable to access them (and hence, unable to use iChat).
If your router is an Apple AirPort Base Station (of some flavor) you can do this with the AirPort Admin utility located in your Utilities folder. If you have another brand of router setup is probably done via your web browser.