Filter YouTube with YouTube For Schools and squidGuard

Before we start

Your LAN must already run a production instance of squid running on a Linux operating system such as Ubuntu.

For this guide, I was using Ubuntu Server 12.04 LTS which ships with squid/3.1.19. The guide has been tested on both 32 & 64 bit builds.

Ensure the following top-level domains are not blocked

youtube.com
ytimg.com

Sign up for a YouTube for school account

Go to http://www.youtube.com/account_school and sign up for a YouTube For school Account. The sign up process should only take minutes.

Once you account is created go to http://www.youtube.com/account_school and under the Instrucations heading, Step 1, search for the following string X-YouTube-Edu-Filter: the random numbers and letters after that string are your account ID. The account ID is required for the redirection to work correctly. Please document your account ID.

ABCD1234567890abcdef

Install squidGuard

squidGuard is the URL rewrite program. To install use the following command

proxy:~$ sudo apt-get install squidguard

Edit squidGuard configuration

Lets backup the default squidGuard configuration as it has examples which as useful but none of which we require.
proxy:~$ sudo cp -v /etc/squid/squidGuard.conf /etc/squid/squidGuard.conf.original

So time to edit the squidGuard configuration and make it work for you.

proxy:~$ sudo vim /etc/squid/squidGuard.conf

Remove all the examples and paste in the new configuration from below. Please replace ABCD1234567890abcdef with your YouTube for Schools Account ID. Save and exit

#
# CONFIG FILE FOR SQUIDGUARD
#
# Caution: do NOT use comments inside { }
#
dbhome /var/lib/squidguard/db
logdir /var/log/squid
# ACL RULES:
#
rew youtube {
 s@(http://www.youtube.com/watch\?v=.*)@\1\&edufilter=ABCD1234567890abcdef@i
}
acl {
 default {
 pass any
 rewrite youtube
 }
}

Add squidGuard into your squid configuration

proxy:~$ sudo vim /etc/squid3/squid.conf

Search for url_rewrite_program and insert the following line. Save and exit.

url_rewrite_program /usr/bin/squidGuard -c /etc/squid/squidGuard.conf

Restart squid to enable squidGuard

To enable the config changes to the squid service.

proxy:~$ sudo service squid3 restart

YouTube for schools in now enabled

When you load http://www.youtube.com you be able to see all videos listed on the main page but when you attempt to watch these videos you will only be able to view content classified as educational by youtube or content that the has been added to the schools youtube account’s playlists.

While you can add staff into a list of teachers that can view all content, only the administrator (schools youtube account) can add content to be viewed by all students.

You may want to block access to youtube.com via HTTPS as squidGuard rewrite is unable to intercept SSL connections.

References

http://www.youtube.com/account_school

http://support.google.com/youtube/bin/static.py?hl=en&page=guide.cs&guide=2592683&topic=2592688

http://support.google.com/youtube/bin/static.py?hl=en&guide=2592683&topic=2592688&page=guide.cs&answer=2695317

http://squidguard.shalla.de/config/#Rewritegroups

https://help.ubuntu.com/community/SquidGuard

12 thoughts on “Filter YouTube with YouTube For Schools and squidGuard

  1. How can I block access to HTTPS youtube as you suggested? When I tried this it seemed to also block Google authentication, Google drive, etc.

    Using Pfsense 2.0.2, Squid and Squidguard.

  2. I’ve got it working. Thanks for the detailed instructions and using the following code:
    rew youtube {
    s@(http://www.youtube.com/watch\v=.*)@\1\&edufilter=ABCD1234567890abcdef@i
    }
    Now, what can anyone help me with a http://www.youtube.com/ to http://www.youtube.com/education redirect?

    I tried using the following
    rew youtube2 {
    s@(http://www.youtube.com/)@(http://www.youtube.com/education)
    }
    the result will be a loop
    http://www.youtube.com/education/education/education/education/ etc..

  3. Seems to be no one understand whats hapening here. As to my understanding what we looking for here is some this like authenticating videos using youtube educational id.
    Let me expain to you guys it.
    If a student try to watch a video lets say
    http://www.youtube.com/watch?v=6r9FUadpLVg
    What need to happen is from squidgurad have to rewrite the URL as below
    http://www.youtube.com/watch?v=6r9FUadpLVg&edufilter=ABCD1234567890abcdef

    ABCD1234567890abcdef = Id given for your account.

    Then what happen is youtube check above video is listed or not in palylist of educational account you created. Then if its not exsit in your playlist or selected channels it won’t let you play.

    Following workaround is correct but url rewrite regex is wrong.. I have tried several ways but I couln’t figure out the correct regex to add ” &edufilter=ABCD1234567890abcdef” in the end of the url. I dont have much time to work on this so if any body figures the regex please post, If i come up with something I ll share as well.

  4. Hey there just wanted to give you a quick heads up and let you know a few of
    the images aren’t loading properly. I’m not sure why but I think its
    a linking issue. I’ve tried it in two different browsers and both show the same results.

  5. Squidblacklist.org, is the worlds leading publisher of native acl blacklists tailored specifically for Squid proxy, and alternative formats for all major third party plugins as well as many other filtering platforms.

    There is room for better blacklists, and we intend to fill that gap.

    It would be our pleasure to serve you.

    Signed,

    Benjamin E. Nichols
    http://www.squidblacklist.org

  6. Very good taking the time to discuss this unique,
    Personally i think extremely to fix it together with fancy mastering
    more about this particular subject matter. In cases
    where would-be, due to the fact generate skill, can you thinking bringing up-to-date all your blog site that includes extra help and advice?
    This is useful for mee and my peers.

Leave a Reply to Tyrone Cancel reply

Your email address will not be published. Required fields are marked *