NAS and Anti-virus

Question

For the past six or so years now I've done without any kind of anti-virus protection on my (personal) desktops/laptops. Between the A/V subscription scams, resource hogging and errors they 'unintentionally' create, I decided that having an infection was no different then the A/V scanners themselves (to a degree). I have yet to have any kind of virus infect my computers as pfSense and other firewall solutions do a solid job of keeping me safe and a steady diet of patching always helps.

With that said, I also run several consumer-level NAS devices (QNAP,ReadyNAS,etc.) for myself and a handful of clients. For myself, I'm confident that the possibility of a virus hiding amongst my NAS is slim to nil, but for my clients I'm more concerned.

So my direct question to SF: Does anyone know of any type of non-desktop A/V software that can run on a NAS or some service that can (remotely) scan network storage for viruses? I'm looking for a more targeted A/V solution for consumer level NAS. I'm vaguely familiar with Clam-AV for linux based NASes but if anyone else can suggest alternatives to desktop-AV type solutions, I'm all ears (eyes?).

My reasoning for non-desktop A/V scanning is largely based on my experience:

1. My clients computers are easily 3-4 years old. Having several computers all running A/V and slowing them down individually makes no sense when the NAS is perfectly capable of doing the A/V scanning work. I'm not concerned with the workstations as the data (documents, spreadsheets, databases, etc.) are more important.
2. My clients are (very) small business and often don't have a server. Their NAS is as close to a server as they have. Email, web hosting are often outsourced which makes perfect sense for them. All they need is a file server and a NAS is a downright cheap and effective alternative to the real thing.
3. Clients tend to inconsistently follow instructions. Sometimes they disable A/V when they know it's slowing down their computer. All in all, people learn after a disaster but often forget about it over time. No matter how much you try to educate your clients on what to do, their minds are on more important business oriented things and technical issues are (and should be) the last thing on their minds.

Answer 1

Some points to consider:

1. Most infections today are malware from websites. That's why desktops would need protection measures in place...most users don't think about defensive web browsing. Even if they do, it's easy to accidentally trigger something, especially with IE.
2. If the NAS is used solely as a file repository, any desktop scanner should be able to scan mapped drive letters as files are accessed.
3. Even if you protect against browse-by malware, anything that is network based...an infected laptop brought into the network behind the firewall...could theoretically propagate itself into the NAS or clients.
4. Scan the NAS to make sure uneeded ports aren't open for some reason. If you don't need the service, shut it down. Make sure you're using encrypted connections for maintenance.
5. Is your NAS being used for Windows profiles? That's a great place for malware to hide.
6. Email: can you block executable files from being attached, period? We used to do that with a homebrew email filter. I got tired of people getting huge attachments and executables that 99.9% of the time were viruses anyway...so I added a filter to the mail forwarder that just blocked all executables and anything over a couple meg in size.
7. There are antivirus scanners for Linux like F-prot, and of course ClamAV but Clam would have to be a cron job since it's designed for email servers and as such is a "plug in", not on access scanning, just on-demand.
8. Your NAS, especially if not Windows based, will most likely be a virus carrier...not actively infected and trying to spread it.

I'd probably work on scheduling (or having another server schedule) a virus check with an antivirus of choice each night using a mapped drive to the NAS with administrative access; that should allay your client's fears a bit. I don't know what your role is in maintaining them (you're a consultant? on-site support?...) so I don't know if you want to put something in place that the user can maintain or if you're setting things up so you can monitor it remotely; i.e., some antivirus programs can email you a notice. If not, you could set up a small Linux box that is dedicated to doing some maintenance like this (logging) and it could use a cron job to scan for viruses every four hours or so and email you the results.

Answer 2

By virtue of design, most NAS would not be infected by viruses. They are usually harder to write to and are not x86 based. So, they won't be able to actively infect your client machines.

If you rolled your own NAS, you may be able to add in an anti-virus package. There are several Atom based NAS systems (QNAP et al). You could conceivably set up something like FreeNAS/OpenFiler in it and install some anti-virus scanner in it.