Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're looking for some sort of antivirus for a server running Linux and can't seem to find a decent one that runs server-side. And by serverside I mean that it could run as a daemon instead of having to start up and execute for every file that we send to it.

If it's any help the service we have is run on Amazon EC2 instances and we store the files on S3.

We have looked at ClamAV but are really unsure whether it's a good fit. The software seems good, but I'm not sure that their database is always updated.

Does anyone have some hard earned knowledge on this?

share|improve this question

closed as not constructive by HopelessN00b, mdpc, kce, Alex, Jacob Jan 29 '13 at 22:41

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

And you are running what OS on EC2? – Sven Sep 2 '11 at 9:35
Doh, sorry for not writing that. We're running Ubuntu. – freeall Sep 2 '11 at 9:36
up vote 3 down vote accepted

A) Clamav is updated all the time and regularly.

B) What kind of server is this? You might not want an antivirus so much as focusing on IDS and auditing.

If you're just going to get an AV on the server, ClamAV is probably your best bet. Lots of users. Pluggable architecture. Updated more often than many commercial ones, it seems. You can set it to regularly poll for updated versions. And it's made for *nix systems.

Just don't rely on it as being your best defense because unless this is a fileserver, AV (or AV alone) just doesn't cut it.

share|improve this answer
It is a fileserver in the sense that it stands in front of S3. So every file stored on S3 will have to through this. You think Clam is a good solution for this? – freeall Sep 2 '11 at 13:13
A file server in the sense that it holds files that clients download, like a file share. I.e., you're running the AV to protect from your Linux server acting as a host/carrier for Windows malware. – Bart Silverstrim Sep 2 '11 at 13:17
Yes, you're right with the last example. We are not worried about the server getting infected, but merely that we host files with virus in it. Sorry for not making myself clear before. – freeall Sep 2 '11 at 14:18
Not a problem, it's just a consideration. If you're serving files out to Windows systems you should run some form of AV in my opinion. ClamAV is updated regularly and is actually geared for mail server filtering, so it does catch Windows malware and is well supported with an active developer community. It does take more effort to configure for on-access scanning, but once set up you should be good to go. – Bart Silverstrim Sep 2 '11 at 14:58

clamAV is a great option, it's free and has very regular updates. Being the only commonly deployed (only active one in existence?) open source anti-virus, it also has a lot of good implementations for integration w/ other software.

such as: ClamAVPlugin, clamav-milter, Amavis-new for, samba-vscan ... list goes on and on.

there are other choices for Linux, and one of the reasons people look elsewhere is because ClamAV is considerably slower then other AV scanners for Linux.
ClamAV also has a somewhat lower detection rate, last I checked (was months ago, things could have changed).

I actually really like F-prot for Linux, and it is now free for home. It is so fast, I mean really fast scanning. If your not a home user, it really would depend on how important this really is, vs. the estimated threat level vs Cost.

ClamAV is not bad option, it does the job at the best price.

share|improve this answer

You should use commercial AV because they have the fastest response for the latest threat and no matter how cheap/fast the product is, you are at risk if you don't have in time the signatures for the whole malware family. Particulary I have found ClamAV annoying and at that time the updates were weak compare to many other commercial products. You should check AV Comparatives and Virus Bulletin for more details.

share|improve this answer
We would love to use commercial AV. The main issue was that we were unable to find one that could actually run as a daemon (which is the only way to not have it overload one system completely). Can you recommend any good ones? – freeall Sep 22 '11 at 20:35
Right now I can suggest Bitdefender. – migabi Sep 22 '11 at 21:27
We called them twice and both times they would get back to us with information on whether or not it could run as a daemon. They didn't. Do you know if you're able to run it as a daemon/background process? Otherwise the entire program and the AV database would have to load to check every file coming in. And that's too heavy on the machines. – freeall Sep 22 '11 at 23:39
All AV products will put a load on your services. Yes, Bitdefender is using a daemon module. You shoud check that there is no compatibility problem with your service (have a spare server and a demo and simulate your environment with upgrades/downgrades for both), check the features like remote management and make sure it is listed in top AV. – migabi Sep 23 '11 at 7:32
Last I checked, AVG Linux scans with a daemon. Also consider Avast Linux, I wouldn't know personally but they claim something about a daemon. – TechZilla Sep 23 '11 at 14:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.