1

We're looking for some sort of antivirus for a server running Linux and can't seem to find a decent one that runs server-side. And by serverside I mean that it could run as a daemon instead of having to start up and execute for every file that we send to it.

If it's any help the service we have is run on Amazon EC2 instances and we store the files on S3.

We have looked at ClamAV but are really unsure whether it's a good fit. The software seems good, but I'm not sure that their database is always updated.

Does anyone have some hard earned knowledge on this?

Improve this question
2
  • And you are running what OS on EC2?
    – Sven
    Sep 2, 2011 at 9:35
  • Doh, sorry for not writing that. We're running Ubuntu.
    – freeall
    Sep 2, 2011 at 9:36

3 Answers 3

Reset to default
3

A) Clamav is updated all the time and regularly.

B) What kind of server is this? You might not want an antivirus so much as focusing on IDS and auditing.

If you're just going to get an AV on the server, ClamAV is probably your best bet. Lots of users. Pluggable architecture. Updated more often than many commercial ones, it seems. You can set it to regularly poll for updated versions. And it's made for *nix systems.

Just don't rely on it as being your best defense because unless this is a fileserver, AV (or AV alone) just doesn't cut it.

Improve this answer
4
  • It is a fileserver in the sense that it stands in front of S3. So every file stored on S3 will have to through this. You think Clam is a good solution for this?
    – freeall
    Sep 2, 2011 at 13:13
  • A file server in the sense that it holds files that clients download, like a file share. I.e., you're running the AV to protect from your Linux server acting as a host/carrier for Windows malware.
    – Bart Silverstrim
    Sep 2, 2011 at 13:17
  • 1
    Yes, you're right with the last example. We are not worried about the server getting infected, but merely that we host files with virus in it. Sorry for not making myself clear before.
    – freeall
    Sep 2, 2011 at 14:18
  • Not a problem, it's just a consideration. If you're serving files out to Windows systems you should run some form of AV in my opinion. ClamAV is updated regularly and is actually geared for mail server filtering, so it does catch Windows malware and is well supported with an active developer community. It does take more effort to configure for on-access scanning, but once set up you should be good to go.
    – Bart Silverstrim
    Sep 2, 2011 at 14:58
2

clamAV is a great option, it's free and has very regular updates. Being the only commonly deployed (only active one in existence?) open source anti-virus, it also has a lot of good implementations for integration w/ other software.

such as: ClamAVPlugin, clamav-milter, Amavis-new for, samba-vscan ... list goes on and on.

there are other choices for Linux, and one of the reasons people look elsewhere is because ClamAV is considerably slower then other AV scanners for Linux.
ClamAV also has a somewhat lower detection rate, last I checked (was months ago, things could have changed).

I actually really like F-prot for Linux, and it is now free for home. It is so fast, I mean really fast scanning. If your not a home user, it really would depend on how important this really is, vs. the estimated threat level vs Cost.

ClamAV is not bad option, it does the job at the best price.

Improve this answer
0

You should use commercial AV because they have the fastest response for the latest threat and no matter how cheap/fast the product is, you are at risk if you don't have in time the signatures for the whole malware family. Particulary I have found ClamAV annoying and at that time the updates were weak compare to many other commercial products. You should check AV Comparatives and Virus Bulletin for more details.

Improve this answer
7
  • We would love to use commercial AV. The main issue was that we were unable to find one that could actually run as a daemon (which is the only way to not have it overload one system completely). Can you recommend any good ones?
    – freeall
    Sep 22, 2011 at 20:35
  • Right now I can suggest Bitdefender.
    – migabi
    Sep 22, 2011 at 21:27
  • We called them twice and both times they would get back to us with information on whether or not it could run as a daemon. They didn't. Do you know if you're able to run it as a daemon/background process? Otherwise the entire program and the AV database would have to load to check every file coming in. And that's too heavy on the machines.
    – freeall
    Sep 22, 2011 at 23:39
  • All AV products will put a load on your services. Yes, Bitdefender is using a daemon module. You shoud check that there is no compatibility problem with your service (have a spare server and a demo and simulate your environment with upgrades/downgrades for both), check the features like remote management and make sure it is listed in top AV.
    – migabi
    Sep 23, 2011 at 7:32
  • Last I checked, AVG Linux scans with a daemon. Also consider Avast Linux, I wouldn't know personally but they claim something about a daemon.
    – J. M. Becker
    Sep 23, 2011 at 14:07

Not the answer you're looking for? Browse other questions tagged .