Viruses and Security

KDE4me · 05-24-2003, 08:06 AM

I've got this dilemma with my Redhat box.
I'm used to having virus-this-and-protect-that software for Windoze. I realize that Linux is comparatively safe from viruses and that from what I've read most people don't worry about virus-busters. Instead they seem to use things like "intrusion detection software" like "snort" or "system integrity (Aide, Samhain, Tripwire)" etc. (Sorry for quoting this stuff it's come from other discussions).

So really my question isn't whether I (emphasis) should use protection software etc. but DO YOU? If you do what do YOU use and/or in the case of virus software how often do you use it?

I'm sorry for this post. It really arose because everyone's too busy discussing whether Linux is vulnerable or not...NOT whether they use this stuff.

markus1982 · 05-24-2003, 08:30 AM

Well we scan our e-Mails for viruses (cause most of the customers are using Windows). We also use intrusion detection - AIDE. You should also take a look at Tiger :-)

Be sure to use firewalling using netfilter (iptables) also!

quietguy47 · 05-24-2003, 08:36 AM

I don't use any virus detection software other than md5sum.
As for a fireall, I use iptables.

tcaptain · 05-24-2003, 08:45 AM

Personally I don't. So far from everything I read, there's no reason to. Especially if you're just a smidgen careful and you run your linux system properly.

markus1982 · 05-24-2003, 08:59 AM

Quote:

I don't use any virus detection software other than md5sum.

That's just file modification stuff ... but it's not a secure as a properly set up AIDE/Samhain/Tripwire filesystem checking software. For AIDE for instance you could check permission changes, etc. A quote from the manpage:

Quote:

DEFAULT GROUPS
p: permissions

i: inode

n: number of links

u: user

g: group

s: size

m: mtime

a: atime

c: ctime

S: check for growing size

md5: md5 checksum

sha1: sha1 checksum

rmd160: rmd160 checksum

tiger: tiger checksum

R: p+i+n+u+g+s+m+c+md5

L: p+i+n+u+g

E: Empty group

>: Growing logfile p+u+g+i+n+S

And also the following if you have mhash support enabled

crc32: crc32 checksum

haval: haval checksum

gost: gost checksum

You should at least consider using it :-)

fancypiper · 05-24-2003, 09:54 AM

Simple virus protection: avoid using Internet Explorer and Outlook Express, and don't open unsolicited attachments.

I never have caught a virus or worm and I only recently tried a virus scanner in Windows, but I just can't stand to stay in Windows very long, so I uninstalled it.

All I run in Linux is Tripwire.

KDE4me · 05-24-2003, 09:00 PM

thanks you guys, I'll try some of the stuff you've mentioned, you've all been very helpful. Sometimes there's too much choice out there which makes choosing difficult. Thanks again.

Aussie · 05-24-2003, 09:06 PM

Firewall software is build into the linux kernel, all you need to do is learn how to use it.
http://www.netfilter.org/ has all the goodies.