4 ms·

Is there any good real-time AV for desktop linux available?

by bearbin 13y ago

marcosdumay 13y ago
Is there any good real-time AV available? For any kind of system?
acadien 13y ago
I'm guessing they mean AV software for removal of windows viruses on thumb-drives? AV software for linux is 100% unnecessary AFAIK. Maybe a sysadmin could chime in?
- Derpdiherp 13y ago
  Didn't they say the same thing about iMacs? Can't comment though, I personally don't run an AV on linux.
  - dlitz 13y ago
    AV software is effectively a really complicated blacklist-based form of access control, which is a terrible way to do security in the first place. There's no reason for antivirus software of this kind of exist on desktop Linux, because the whole operating system is free software, so if we want to fix some vulnerability that malware exploits, we can just do it (for example, by sandboxing applications), rather than implementing kludgy workarounds that turn users' machines into battlegrounds. From what I hear, Wayland should help a lot with this, since it's much simpler and provides better isolation than X11.
onli 13y ago
No. My knowledge might be a bit dated, but as far as I know, there is nothing good. But you also don't need realtime Antivirus software for Linux, there still are no real active viruses for Linux. The scanner for detecting windows-virus while using Linux were said to be ok (ClamAV, I think).
- bcoates 13y ago
  There are active worms for insecure software that runs on Linux (and weak SSH passwords), so that'd be detectable. Something more like an IDS that detects known-insecure software and configurations is probably more useful than a pattern-matching evil bytes detector though.
voidlogic 13y ago
Maybe make add a call & to a script containing something like this (not tested) to your .bashrc? inotifywait -mre modify /home/$USER | while read DIR EVT FILE; do do clamscan $FILE --move=/tmp/noexec_prison/$USER/ done
- lotsofcows 13y ago
  Good idea. Maybe add some ionice?

Is there any good real-time AV for desktop linux available?

by bearbin 13y ago

Is there any good real-time AV for desktop linux available?

marcosdumay 13y ago

Is there any good real-time AV available? For any kind of system?

acadien 13y ago

I'm guessing they mean AV software for removal of windows viruses on thumb-drives? AV software for linux is 100% unnecessary AFAIK. Maybe a sysadmin could chime in?

Derpdiherp 13y ago
Didn't they say the same thing about iMacs? Can't comment though, I personally don't run an AV on linux.
- dlitz 13y ago
  AV software is effectively a really complicated blacklist-based form of access control, which is a terrible way to do security in the first place. There's no reason for antivirus software of this kind of exist on desktop Linux, because the whole operating system is free software, so if we want to fix some vulnerability that malware exploits, we can just do it (for example, by sandboxing applications), rather than implementing kludgy workarounds that turn users' machines into battlegrounds. From what I hear, Wayland should help a lot with this, since it's much simpler and provides better isolation than X11.

onli 13y ago

No. My knowledge might be a bit dated, but as far as I know, there is nothing good. But you also don't need realtime Antivirus software for Linux, there still are no real active viruses for Linux. The scanner for detecting windows-virus while using Linux were said to be ok (ClamAV, I think).

bcoates 13y ago
There are active worms for insecure software that runs on Linux (and weak SSH passwords), so that'd be detectable. Something more like an IDS that detects known-insecure software and configurations is probably more useful than a pattern-matching evil bytes detector though.

voidlogic 13y ago

Maybe make add a call & to a script containing something like this (not tested) to your .bashrc? inotifywait -mre modify /home/$USER | while read DIR EVT FILE; do do clamscan $FILE --move=/tmp/noexec_prison/$USER/ done

lotsofcows 13y ago
Good idea. Maybe add some ionice?