Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method for detecting and preventing website compromises (more so than a whole server compromise, though that would be nice as well). While ideally all websites would have perfect security, it would be nice to have one more security measure in place since things are rarely perfect.

In the past I've seen Kaspersky catch malicious JavaScript files when it's running on Windows machines which leads me towards it since they have a Linux offering which supports CentOS, but if there's something better I'd be interested too or if anyone has bad experiences with it, please do share.

My preference would be a big-name commercially-supported one, so they have the resources and person hours to stay on top of the most threats, but if anyone has tried both ClamAV and one or more commercial ones and thinks ClamAV is better (or has other reason to say ClamAV is better), I'd definitely be interested to know.


closed as not constructive by MDMarra, Dave M, Tim Brigham, kce, Greg Askew Jul 23 '12 at 22:00

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Sorry, but this type of question is off-topic here. Product recommendations and shopping questions aren't a good fit for our Q&A format. Maybe take a look at the faq if you need more clarification. – MDMarra Jul 23 '12 at 18:30

You're not thinking about the problem in the right way; you are trying to apply a solution for Microsoft desktop installations to a Linux server. Square peg, round hole.

Linux is not immune from malware - but different strategies are far more effective.

My preference would be a big-name commercially-supported one

So presumably you haven't read any of the research published on anti-virus software which has shown, that you don't really get what you pay for when buying anti-virus software fairly consistently over the last 10 year. Big names are big names due to good marketing, not quality of software (although I will concede that Kaspersky is relatively good as an anti-virus program for Microsoft desktop machines and servers).

A malware scanner should be very low on your list of priorities for securing your webserver. And it won't come in a shrink-wrapped box from PC World.

The first thing you need is a process for managing the software on the server - both the Linux distribution and any other software. You need to know when patches are available and whether they'll have an adverse impact on your service and you need to deploy them effectively.

You also need to configure your server properly - stripping out un-necessary components and configuring a firewall. You will also need additional security around ssh access - port knocking or fail2ban. Ideally your web content should be stored on a disk mounted read-only.

Next on the list is a host-based intrusion detection system - tripwire or LIDS.

Then you might consider using a rootkit hunter.

At the end of the day there is no substitute for knowledge and the best thing you can do to make your system secure is to spend a lot of time reading up on Linux / Unix security.

Not the answer you're looking for? Browse other questions tagged or ask your own question.