How to set-up a Linux machine for children's Internet use?

As the administrator for a company proxy, I have a slightly different view of this. I'll step forward and say it's not going to be a popular one, but it's one I've given much thought to over the years for the same reason.

The best filter and access control setup to use ...

is you.

The crux of the matter is very similar to the issues surrounding antivirus updates. No matter how good the detection engine is, no matter how often you update, there is always a window of "vulnerability" between when when a "problem" is released onto the internet in general, and when it is detected.

Proxy filtering software is a reasonable approach. Everyone that has suggested these answers has done the right thing - use a form of content filtering that makes sense for you. (Yes, I gave everyone a +1 that mentioned this). But the same issue remains - there are new sites coming online every day, and old ones that go offline. During this time, you need to be able to known about these and block them. So there is always a window of opportunity to stumble into "inappropriate material" or "web exploits".

Being there with your younger child as they surf around is a great idea. It is difficult to substitute adult experience with a piece of software, and being able to spot a problem and steer the child away before it becomes an issue is something that no proxy can deduce. And if by unfortunate luck you end up clicking a "disguised link" or end up under a cross-scripting attack that spawns 100 bazillion popups/installs/downloads, you'll be able to respond in seconds...instead of minutes after the fact, when your child comes to you and says "I keep seeing funny pictures of people without clothes, and now I have a funny purple gorilla that keep bugging me to see things. Make it stop (mom/dad)!"

As kids get older, you can keep the proxy in place and reduce the filtering, but the occasional pop-in and "hey, whatcha up to?" is worth its weight in gold. It's not so much snooping into their personal lives - a sensitive issue for many teens and one they would resent greatly - as it is a quick "check for trouble". For older teens, I might even forgo the filtering, provided they agree to have the URLs logged via the proxy (possibly through a squid setup that has minimal controls but logs each visit). This is a good tradeoff between keeping tabs on where they go, but still giving them enough privacy in their communications (because it only logs the URL visited, not what they send or post online).

In the end, I suppose that most people will just install a basic filter and get on with life, but for me, and my kids, being there as they explore and learn is something I would never miss.

Once a month, I'm approached by customers that want to take an old laptop and give it to a young child. We always install Edubuntu and use Linux based Content Filtering.

DansGuardian is a viable option. Here's someone else's experience.

I think you should take it out of the system and onto the network instead. It would be a bit trickier to implement, but with OpenDNS you can select filters to activate, and boom, your child is safe from all the stuff you don't want him/her to see.

For more information, take a look at this explanatory page for parental controls.

Pardon if this escapes the scope of the question, as this would be more of an network implementation (changing DNS servers for that user) instead of a software solution.