1

So, I am have been on a quest lately to secure laptops used by children & help with a small school computer lab.

They are split between Macs & Ubuntu (Linux).

One of my first rules was to leverage a restricted DNS provider to prevent (well, minimize) the chance of the kids visiting porn. It worked great on Ubuntu as I just ran this command on all computers:

echo "nameserver 185.228.168.168" > /etc/resolv.conf ; chattr +i /etc/resolv.conf 

This forces the 185.228.168.168 nameserver (used by cleanbrowsing ) and sets the file as immutable, so nobody can change it.

Easy to automate and applies across all wifi networks. However, on the Mac, it does not work. It seems that they stopped using the resolv.conf file and you have to go through the UI to set it. However, the problem is that anyone can change it and you have to configure it PER WIFI network.

Q: Does anyone know a way to force a name server across all Wi-Fi networks on the Mac? Preferably through the terminal, so I can SSH into all of them and configure? If we can set it as immutable, so kids can't change, it would be ideal.

Appreciate the help!

*I know that I can do do that via the router DHCP/DNS and force to all computers, but due to some other technical challenges, I can't do it from there.

1
sudo networksetup -setdnsservers Ethernet 185.228.168.168
sudo networksetup -setdnsservers Wi-Fi 185.228.168.168

The Ethernet/Wi-Fi bit is the name of the network connection in the Network control panel.

You'll need sudo rights, as this has to be run as by and admin, and needs them to interactively enter a password if you leave that out.

But, you can easily script the above to run remotely.

From the man page (Sierra):

-setdnsservers networkservice dns1 [dns2] [...]

Use this command to specify the IP addresses of servers you want the specified to use to resolve domain names. You can list any number of servers (replace dns1, dns2, and so on with the IP addresses of domain name servers). If you want to clear all DNS entries for the specified network service, type "empty" in place of the DNS server names.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .