1

We're looking for some sort of antivirus for a server running Linux and can't seem to find a decent one that runs server-side. And by serverside I mean that it could run as a daemon instead of having to start up and execute for every file that we send to it.

If it's any help the service we have is run on Amazon EC2 instances and we store the files on S3.

We have looked at ClamAV but are really unsure whether it's a good fit. The software seems good, but I'm not sure that their database is always updated.

Does anyone have some hard earned knowledge on this?

Zypher
  • 37,405
  • 5
  • 53
  • 95
freeall
  • 194
  • 1
  • 9

3 Answers3

3

A) Clamav is updated all the time and regularly.

B) What kind of server is this? You might not want an antivirus so much as focusing on IDS and auditing.

If you're just going to get an AV on the server, ClamAV is probably your best bet. Lots of users. Pluggable architecture. Updated more often than many commercial ones, it seems. You can set it to regularly poll for updated versions. And it's made for *nix systems.

Just don't rely on it as being your best defense because unless this is a fileserver, AV (or AV alone) just doesn't cut it.

Bart Silverstrim
  • 31,172
  • 9
  • 67
  • 87
  • It is a fileserver in the sense that it stands in front of S3. So every file stored on S3 will have to through this. You think Clam is a good solution for this? – freeall Sep 02 '11 at 13:13
  • A file server in the sense that it holds files that clients download, like a file share. I.e., you're running the AV to protect from your Linux server acting as a host/carrier for Windows malware. – Bart Silverstrim Sep 02 '11 at 13:17
  • 1
    Yes, you're right with the last example. We are not worried about the server getting infected, but merely that we host files with virus in it. Sorry for not making myself clear before. – freeall Sep 02 '11 at 14:18
  • Not a problem, it's just a consideration. If you're serving files out to Windows systems you should run some form of AV in my opinion. ClamAV is updated regularly and is actually geared for mail server filtering, so it does catch Windows malware and is well supported with an active developer community. It does take more effort to configure for on-access scanning, but once set up you should be good to go. – Bart Silverstrim Sep 02 '11 at 14:58
2

clamAV is a great option, it's free and has very regular updates. Being the only commonly deployed (only active one in existence?) open source anti-virus, it also has a lot of good implementations for integration w/ other software.

such as: ClamAVPlugin, clamav-milter, Amavis-new for, samba-vscan ... list goes on and on.

there are other choices for Linux, and one of the reasons people look elsewhere is because ClamAV is considerably slower then other AV scanners for Linux.
ClamAV also has a somewhat lower detection rate, last I checked (was months ago, things could have changed).

I actually really like F-prot for Linux, and it is now free for home. It is so fast, I mean really fast scanning. If your not a home user, it really would depend on how important this really is, vs. the estimated threat level vs Cost.

ClamAV is not bad option, it does the job at the best price.

J. M. Becker
  • 2,471
  • 1
  • 17
  • 21
0

You should use commercial AV because they have the fastest response for the latest threat and no matter how cheap/fast the product is, you are at risk if you don't have in time the signatures for the whole malware family. Particulary I have found ClamAV annoying and at that time the updates were weak compare to many other commercial products. You should check AV Comparatives and Virus Bulletin for more details.

migabi
  • 154
  • 3
  • We would love to use commercial AV. The main issue was that we were unable to find one that could actually run as a daemon (which is the only way to not have it overload one system completely). Can you recommend any good ones? – freeall Sep 22 '11 at 20:35
  • Right now I can suggest Bitdefender. – migabi Sep 22 '11 at 21:27
  • We called them twice and both times they would get back to us with information on whether or not it could run as a daemon. They didn't. Do you know if you're able to run it as a daemon/background process? Otherwise the entire program and the AV database would have to load to check every file coming in. And that's too heavy on the machines. – freeall Sep 22 '11 at 23:39
  • All AV products will put a load on your services. Yes, Bitdefender is using a daemon module. You shoud check that there is no compatibility problem with your service (have a spare server and a demo and simulate your environment with upgrades/downgrades for both), check the features like remote management and make sure it is listed in top AV. – migabi Sep 23 '11 at 07:32
  • Last I checked, AVG Linux scans with a daemon. Also consider Avast Linux, I wouldn't know personally but they claim something about a daemon. – J. M. Becker Sep 23 '11 at 14:07
  • You also can get the daemon for F-Prot, it's not included in the free workstation version. You can get a test of the enterprise file server version, which includes the daemon. As stated in my answer, I prefer using F-Prot for Linux. – J. M. Becker Sep 23 '11 at 14:16
  • @migabi: For the best AV at this moment, yes commercial offerings are worth the investment. Even if you go zero cost only, commercial offerings are better. However for a couple reasons, I don't agree with your reasoning. Updated signatures are not the problem, it is the respective scanning engines. More importantly, ClamAV the only game in town, we can't say another project couldn't have a strong offering. – J. M. Becker Sep 23 '11 at 14:22