7:44 p.m.
I know that the number and popularity of viruses for Linux is extremely
lower than Windoze; however, I am on a university network that has
viruses floating around like an AIDS convention so I would like to have
some sort of anti-virus program running in the background. The ones I
find are either a) commercial apps b) exclusively for e-mail c) open
source ones that don't look very complete. What do you guys use for
non-email based virus scanners?
7:52 p.m.
What do you guys use for non-email based virus scanners?
I don't know about more than a couple dozen people, but some use
server-based tools to scan for viruses (when deemed necessary) and, the rest
of the time, we use our brains... ;-)
You should never run anything on any system (especially with root
privileges) that you haven't verified via source, encryption, or
hash/checksum validation.
My 2 pennies...
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.572 / Virus Database: 362 - Release Date: 1/27/2004
7:53 p.m.
On Wed, 2004-01-28 at 20:44, Carter J. Castor wrote:
I know that the number and popularity of viruses for Linux is
extremely
lower than Windoze; however, I am on a university network that has
viruses floating around like an AIDS convention
Real classy.
so I would like to have
some sort of anti-virus program running in the background. The ones I
find are either a) commercial apps b) exclusively for e-mail c) open
source ones that don't look very complete. What do you guys use for
non-email based virus scanners?
I've used AVG running on Windows hosts to scan Samba shares. Works
great.
--
Jason Dixon, RHCE
DixonGroup Consulting
http://www.dixongroup.net
12:10 a.m.
On Wed, 2004-01-28 at 20:44, Carter J. Castor wrote:
> I know that the number and popularity of viruses for Linux is
extremely
> lower than Windoze; however, I am on a university network that has
> viruses floating around like an AIDS convention
Real classy.
Sorry. Inside joke. Didn't think about it when I typed it...
8:25 p.m.
Carter J. Castor wrote:
I know that the number and popularity of viruses for Linux is
extremely
lower than Windoze; however, I am on a university network that has
viruses floating around like an AIDS convention so I would like to have
some sort of anti-virus program running in the background. The ones I
find are either a) commercial apps b) exclusively for e-mail c) open
source ones that don't look very complete. What do you guys use for
non-email based virus scanners?
You pretty much answered your own question. There are about as many
linux viruses on your network as there are HIV virus particles floating
around at an AIDS convention. In other words, none. HIV does not
"float around". However, worms and trojans do exist, as well as regular
old exploits, etc. A scanner would be of no help for regular exploits,
although it *might* be of some benefit with trojans. But only after the
fact. Once the trojan has been run even once, your whole box is a
potential security risk whether the trojan executable has been removed
or not.
Scanning for virii after the fact is pretty poor as a security policy.
Has that policy stemmed the flow of virii in the Windows world?
Ask yourself how you think your machine might become infected. Are you
keeping your box updated with security patches from your vendor? This
is your best defense against remote network exploits. Are you running
network services that are visible to the network? This is a vector for
"worms", not virii. Are you running executables from an untrusted
source? That's how you get trojans. Are you running as root
unnecessarily? To be honest, I have always found the arguments for not
running as root to be rather flimsy, but it is still a good idea. If
you do happen to run a trojan, you at least can contain and isolate the
contamination more easily, though you could still lose all your data,
which is usually more valuable than the 30 minute OS installation. Are
you doing backups?
Personally, I hate these "there's no magic bullet" answers when they are
used to argue against things like transpernt buffer overflow prevention
in compilers, which have a real, though not "magic bullet" benefit. But
I just don't see Linux virus scanning being of much value.
Steve
11:35 p.m.
Try F-prot! It is free for peronal use on linux.
Steve Bergman wrote:
Carter J. Castor wrote:
> I know that the number and popularity of viruses for Linux is extremely
> lower than Windoze; however, I am on a university network that has
> viruses floating around like an AIDS convention so I would like to have
> some sort of anti-virus program running in the background. The ones I
> find are either a) commercial apps b) exclusively for e-mail c) open
> source ones that don't look very complete. What do you guys use for
> non-email based virus scanners?
>
>
>
>
You pretty much answered your own question. There are about as many
linux viruses on your network as there are HIV virus particles floating
around at an AIDS convention. In other words, none. HIV does not
"float around". However, worms and trojans do exist, as well as regular
old exploits, etc. A scanner would be of no help for regular exploits,
although it *might* be of some benefit with trojans. But only after the
fact. Once the trojan has been run even once, your whole box is a
potential security risk whether the trojan executable has been removed
or not.
Scanning for virii after the fact is pretty poor as a security policy.
Has that policy stemmed the flow of virii in the Windows world?
Ask yourself how you think your machine might become infected. Are you
keeping your box updated with security patches from your vendor? This
is your best defense against remote network exploits. Are you running
network services that are visible to the network? This is a vector for
"worms", not virii. Are you running executables from an untrusted
source? That's how you get trojans. Are you running as root
unnecessarily? To be honest, I have always found the arguments for not
running as root to be rather flimsy, but it is still a good idea. If
you do happen to run a trojan, you at least can contain and isolate the
contamination more easily, though you could still lose all your data,
which is usually more valuable than the 30 minute OS installation. Are
you doing backups?
Personally, I hate these "there's no magic bullet" answers when they are
used to argue against things like transpernt buffer overflow prevention
in compilers, which have a real, though not "magic bullet" benefit. But
I just don't see Linux virus scanning being of much value.
Steve
1:04 p.m.
On Wednesday 28 January 2004 11:35 pm, stephan schutter wrote:
Try F-prot! It is free for peronal use on linux.
Steve Bergman wrote:
> Carter J. Castor wrote:
>> I know that the number and popularity of viruses for Linux is extremely
>> lower than Windoze; however, I am on a university network that has
>> viruses floating around like an AIDS convention so I would like to have
>> some sort of anti-virus program running in the background. The ones I
>> find are either a) commercial apps b) exclusively for e-mail c) open
>> source ones that don't look very complete. What do you guys use for
>> non-email based virus scanners?
>
> You pretty much answered your own question. There are about as many
> linux viruses on your network as there are HIV virus particles floating
> around at an AIDS convention. In other words, none. HIV does not
> "float around". However, worms and trojans do exist, as well as regular
> old exploits, etc. A scanner would be of no help for regular exploits,
> although it *might* be of some benefit with trojans. But only after the
> fact. Once the trojan has been run even once, your whole box is a
> potential security risk whether the trojan executable has been removed
> or not.
>
> Scanning for virii after the fact is pretty poor as a security policy.
> Has that policy stemmed the flow of virii in the Windows world?
>
> Ask yourself how you think your machine might become infected. Are you
> keeping your box updated with security patches from your vendor? This
> is your best defense against remote network exploits. Are you running
> network services that are visible to the network? This is a vector for
> "worms", not virii. Are you running executables from an untrusted
> source? That's how you get trojans. Are you running as root
> unnecessarily? To be honest, I have always found the arguments for not
> running as root to be rather flimsy, but it is still a good idea. If
> you do happen to run a trojan, you at least can contain and isolate the
> contamination more easily, though you could still lose all your data,
> which is usually more valuable than the 30 minute OS installation. Are
> you doing backups?
>
> Personally, I hate these "there's no magic bullet" answers when they
are
> used to argue against things like transpernt buffer overflow prevention
> in compilers, which have a real, though not "magic bullet" benefit. But
> I just don't see Linux virus scanning being of much value.
FYI, http://www.f-prot.com/virusinfo/unix.html reports that there are only 2
virii infecting Unix systems, 1 is targeting BSD systems running a vulnerable
version of Apache, and the other is targeting Linux systems running Apache w/
Open SSL enabled
--
Charles Howse
Jackson, TN
Fedora Core 1 Uptime: 4:38
8:29 p.m.
On Wed, Jan 28, 2004 at 11:35:58PM -0600, stephan schutter wrote:
Try F-prot! It is free for peronal use on linux.
Good one
Steve Bergman wrote:
>Carter J. Castor wrote:
>
>>I know that the number and popularity of viruses for Linux is extremely
>>lower than Windoze; however, I am on a university network that has
>>viruses floating around
It is not silly to cautiously export read only file systems with samba
to a single trusted box and scan for infected files using quality
windows tools. Scan, then unexport them...
Most university networks have system admin groups that can help
you. Check the FAQ and ask in a way that makes you a good guy.
--
T o m M i t c h e l l
mitch48-at-sbcglobal-dot-net
8:59 p.m.
What do you guys use for non-email based virus scanners?
The best Linux virus scanner I've found is Clam-AV:
http://clamav.sourceforge.net/
To be honest, you have absolutely no vulnerability to Windows viruses. For more
information, I recommend you read the Linux Virus Writing HOWTO on tldp.org. It will give
you more info on why viruses are a non-issue with Linux.
Your best protection will always be to turn off unused services, run a firewall, avoid
buggy programs, and always use strong passwords. Cracking is a much more clear and
present threat to your Linux install than viruses will ever be.
Mitch Oliver
11:05 p.m.
As for SMB/CIFS filesystems shared with Windows systems I use Clamav to
scan them. This way Windows systems can't drop trojans in the shared
directories. Clamav is horrendously slow but the virus database appears
to be very well kept. It takes 3 DAYS to scan 60 GB of data on one of
my systems. I will simply have to setup on-access virus scanning with
Samba-vscan or Dazuko at some point very soon. Look here for some
interesting ways to use Clamav:
http://www.clamav.net/3rdparty.html#pagestart
On Wed, 2004-01-28 at 21:59, Mitch Oliver wrote:
Your best protection will always be to turn off unused services,
run a firewall, avoid buggy programs, and always use strong passwords.
Cracking is a much more clear and present threat to your Linux install than viruses will
ever be.
Viruses and such are pretty rare. Break-ins by actual human beings are
seemingly rampant among (arrogant) home Linux users (who have been
brainwashed into thinking their Linux system is invulnerable). Over the
years I've helped more than a few people pick up the pieces after a
break-in on their Linux systems. One was exploited through an unpatched
SSH vulnerability. Dozens were broken into because of weak passwords
and drafty old services (SMTP, FTP, etc) setup to authenticate real
users who have remote shell access. Mail and FTP servers are terribly
bad about allowing remote crackers to hunt and peck their way through
your user's passwords.
But poorly setup mail servers are possibly the worst because your
usernames aren't unknown to the remote user. The cracker can poke
around your web server, mailing lists, Google, etc to find a couple of
email addresses on your machine. Then he uses a script to bang on your
sendmail server until he finds a valid password for one of the users.
He logs in via SSH or telnet, runs a root kit, and wipes the sendmail,
secure and last logs.
In one such case I found the administrator had forced the user's
password to "password" and did not set the login shell to
/sbin/nologin. (AllowGroups in /etc/ssh/sshd_config is also a good way
to combat unwanted remote logins.) The user had not legitimately logged
in via SSH once since the account was created and would never have done
so if told she could. The cracker logged in exactly once as that user,
wiped his entries from some logs, and used a rootkit to repurpose the
adm account for his own use. He was very sloppy and even left behind an
extensive .bash_history. He also missed the maillog entries showing all
of his password attempts against sendmail. But nonetheless, he owned
that machine for several months before his buggy rootkit patches caused
enough filesystem corruption to make the system unstable/unbootable.
The chances that a rootkit will work should be greatly reduced with
Fedora Core if you've not disabled exec-shield. Even so, I uninstall
all remote services (except SSH) from workstations, remove mail servers
from non-mail servers, firewall all non-essential ports, and restrict
SSH access to only those individuals who absolutely require it.
--
David Norris
http://www.webaugur.com/dave/
ICQ - 412039
9:18 p.m.
On Thu, 2004-01-29 at 00:05, David L Norris wrote:
As for SMB/CIFS filesystems shared with Windows systems I use Clamav
to
scan them. This way Windows systems can't drop trojans in the shared
directories. Clamav is horrendously slow but the virus database appears
to be very well kept. It takes 3 DAYS to scan 60 GB of data on one of
my systems. I will simply have to setup on-access virus scanning with
Samba-vscan or Dazuko at some point very soon. Look here for some
interesting ways to use Clamav:
http://www.clamav.net/3rdparty.html#pagestart
I know that with Samba-2.2.7 I could configure Samba to not allow
certain file types to be accessed.
12:33 a.m.
I know that the number and popularity of viruses for Linux is
extremely
lower than Windoze; however, I am on a university network that has
viruses floating around like an AIDS convention so I would like to have
some sort of anti-virus program running in the background. The ones I
find are either a) commercial apps b) exclusively for e-mail c) open
source ones that don't look very complete. What do you guys use for
non-email based virus scanners?
--
fedora-list mailing list
fedora-list(a)redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
i use antivir from http://www.antivir. its free for personal use, as i
don't like using my brain just to prevent viruses. It is free for personal
use and has license-cost for commercial use. Definitions-Files usually
come out once per day, so i got it before the first doom reached my
mailserver, as you can use it also with amavis vor mailservers. Update is
done automatically and free of charge (for private use)
Antivir is intented to run in a cron job. With the use of dazuko
http://www.dazuko.org you can do online scans of your system, but this
slows your systems not bad...
HTH
Roger
7:59 a.m.
Carter
source ones that don't look very complete. What do you guys use
for
non-email based virus scanners?
I use both for e-mail and for general scanning of my box, f-prot from
Frisk http://f-prot.com
they are really good about keeping their virus defs up to date and the
scanner works well.
Chris
7393
days inactive
7398
days old
12 comments
12 participants
participants (12)
-
Carter J. Castor -
Charles Howse -
Chris Stankaitis -
David L Norris -
Jason Dixon -
john.rehmert＠speakeasy.net -
Mitch Oliver -
Roger Grosswiler -
Stephan Schutter -
Steve Bergman -
Tom Mitchell -
Travis Fraser