[conspire] linux antivirus?
rick at linuxmafia.com
Wed Sep 10 18:00:11 PDT 2003
Quoting Tom Macke (macke at scripps.edu):
> Our head IT guy just asked me if I knew of any linux "antivirus" package
> that we could get. I think I saw that there was recently a linux virus,
> but just figured that that solution was keep the patches current. Any
Hmm, this is a topic that tends to devolve into a lot of subtopics, many
of them in response to "Yes, but..." questions from people to whom the
answer is alien to the point of incredulity.
The concept of "Linux antivirus package" can mean one of two very
1. Quarantining and scrubbing of MS-Windows (and possibly other
foreign-OS) files temporarily resident on Linux, e.g., because your
Linux box is a Samba server (Windows file/print) or an SMTP/POP3/IMAP
server holding mail that is then handed to Windows MUAs (mail clients).
2. Quarantining and scrubbing of other files on Linux to protect
against Linux malware.
3. Or it can mean that the IT guy in question really hasn't the
faintest idea what he means, but just has a spinal reflex to put
"antivirus" software on any machine whatsoever.
I'm going to address case #1 in this e-mail. I'll probably get to case
#2 later, because that's where discussion tends to become endless and
branch out in lots and lots of directions. Why? Because the short form
of the answer is "There'd be no point. Linux malware may be easy to
create but it's in practice impossible to propagate, because of
cautionary mechanisms that are enforced by Linux architecture and
culture. Any attempt at an 'antiviral' package would be a huge system
threat in itself, and would tend to give wielders of root-user access a
false sense of security, since that privilege is already a much bigger
threat to the system than malware (viruses, etc.) is.
Anyhow, as to virus-checkers that run on virus to find and remove
other-OS viruses. Here are some links I found by googling:
Clam AntiVirus (ClamAV) and OpenAntiVirus:
(Apparently, a number of Linux MTAs can be used with the McAfee viruscan
virus-definition files. No link, exactly, but you can google for
"mcafee antivirus linux" to find relevant materials.)
AMaViS Virus Scanner / AMaViS-ng / amavisd-new
Kaspersky Anti-Virus for Linux
Trend Micro Interscan Viruswall
[$300 for Small Business & $450 for Enterprise Business]
eTrust Antivirus (formerly InoculateIT)
(Note: Computer Associates is where formerly OK software companies go
to be embalmed and their customer-based milked after they've died.)
Vexira Antivirus for Linux Workstation
Panda Antivirus for Linux
AntiVir for Linux
The above list is mostly gathered from other sources. Please note that
I have _zero_ experience with these packages. ClamAV appears to have a
good reputation, though, and is open-source.
A few words about case #3 (IT guy has no clue, but insists reflexively
that any comporate computer must run "antivirus software"): Sometimes,
rather than argue with the guy and try to educate him, it's best to tell
him what he wants to hear. That is, tell him that he raised an
excellent point, and you appreciate being reminded of that
company-critical issue. Therefore, you've deployed the extremely
effective antiviral package comprising Exim and Spamassassin. (See:
http://marc.merlins.org/linux/exim/sa.html) Tell him that _zero_
Sobig.F e-mails ever get past that combination (which is true).
You _don't_ have to tell him that the package's design goal has nothing
whatsoever to do with viruses, but rather aims to eliminate almost all
junkmail during the SMTP session rather than after delivery. What he
doesn't know won't hurt him.
If you don't deploy the Exim-SA combo, you can still (correctly) tell
him that your anti-virus package's name is "procmail" (used as mail
delivery agent). Procmail with a modest collection of filters is
(possibly, maybe) at least as effective as dedicated virus scanners for
case #2 (native Linux viruses), given the fact that they're basically
More about case #2 in a separate mail.
Cheers, Wall Street has all the emotional stability of a
Rick Moen thirteen-year-old girl. -- Louis Rukeyser
rick at linuxmafia.com
More information about the conspire