1

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method for detecting and preventing website compromises (more so than a whole server compromise, though that would be nice as well). While ideally all websites would have perfect security, it would be nice to have one more security measure in place since things are rarely perfect.

In the past I've seen Kaspersky catch malicious JavaScript files when it's running on Windows machines which leads me towards it since they have a Linux offering which supports CentOS, but if there's something better I'd be interested too or if anyone has bad experiences with it, please do share.

My preference would be a big-name commercially-supported one, so they have the resources and person hours to stay on top of the most threats, but if anyone has tried both ClamAV and one or more commercial ones and thinks ClamAV is better (or has other reason to say ClamAV is better), I'd definitely be interested to know.

Thanks!

1
  • 1
    Sorry, but this type of question is off-topic here. Product recommendations and shopping questions aren't a good fit for our Q&A format. Maybe take a look at the faq if you need more clarification.
    – MDMarra
    Jul 23, 2012 at 18:30

1 Answer 1

5

You're not thinking about the problem in the right way; you are trying to apply a solution for Microsoft desktop installations to a Linux server. Square peg, round hole.

Linux is not immune from malware - but different strategies are far more effective.

My preference would be a big-name commercially-supported one

So presumably you haven't read any of the research published on anti-virus software which has shown, that you don't really get what you pay for when buying anti-virus software fairly consistently over the last 10 year. Big names are big names due to good marketing, not quality of software (although I will concede that Kaspersky is relatively good as an anti-virus program for Microsoft desktop machines and servers).

A malware scanner should be very low on your list of priorities for securing your webserver. And it won't come in a shrink-wrapped box from PC World.

The first thing you need is a process for managing the software on the server - both the Linux distribution and any other software. You need to know when patches are available and whether they'll have an adverse impact on your service and you need to deploy them effectively.

You also need to configure your server properly - stripping out un-necessary components and configuring a firewall. You will also need additional security around ssh access - port knocking or fail2ban. Ideally your web content should be stored on a disk mounted read-only.

Next on the list is a host-based intrusion detection system - tripwire or LIDS.

Then you might consider using a rootkit hunter.

At the end of the day there is no substitute for knowledge and the best thing you can do to make your system secure is to spend a lot of time reading up on Linux / Unix security.

Not the answer you're looking for? Browse other questions tagged .