Yes. Don't.
I wouldn’t recommend using anti-virus software. It usually creates a lot more overhead, plus it usually mimics existing solutions already in linux. The only viruses I have ever caught using an anti-virus software on Linux are the test viruses to see if all is working fine.
Anyway, here’s my 20+ enterprise experience recommendations with Linux :
- enable secure boot: will disable launching non-signed kernel modules (prevent root kits)
- enable firewall: and only allow ports you really need.
- SELinux: it is getting better, and it will prevent processes to access resources out of their scope. It can be problematic if you don’t know it (and it is complex to understand). But if it doesn’t hinder you, don’t touch it. I do not know AppArmor, but it is supposed to be similar.
- disable root over ssh: or only allow ssh keys, or disable ssh altogether if you do not need it.
- avoid using root: make sure you have a personal account set up with sudo rights to root WITH password.
- only use trusted software: package managers like
aptandrpmtend to have built in functionality to check the state and status of your installed software. Use trusted software repositories only. Often recommended by the distro maintainers. Stay away from use this script scripts unless you can read them and determine if they’re the real thing.
Adhering to these principles will get you a long way!
edit: added section about software sources courtesy of @dragnucs@lemmy.ml
And when in doubt, upload the file to virustotal.
Thank you for the advice!
Firewall on Linux is something I still don't understand, and explanations found on Internet have always confused me. Do you happen to know some good tutorial to share? Or maybe one doesn't need to do anything at all in distros like Ubuntu?
Regarding ssh: you only mean incoming ssh, right?
@bushvin@pathfinder.social @toikpi@feddit.uk @hevov@discuss.tchncs.de @ChonkaLoo@lemmy.world @HotBoxghost2743@lemmy.ml @c1177johuk@lemmy.world (I'm surely forgetting someone, sorry)
Thank you ALL for the great advice and guides! I'm writing from behind a laptop firewall now, and don't notice anything :) It was smoother than I expected. In the end I used UFW because it was already installed, but I'll take a look at firewalld too in some days! I don't have any incoming ssh connections (not a server), so I didn't need to worry about that :)
Really great people here at Lemmy :)
I don't think you need to configure your firewall. Firewalls are usualy used to block incomming connectings. Usualy a Firewall that blocks all incomming connections is already active on your modem/router. Adding exception to the modem/router Firewall usualy happen through port forwords.
Firewall - While this tutorial is Ubuntu 16.04 it should work current versions of Ubuntu https://www.linuxbabe.com/desktop-linux/getting-started-gufw-ubuntu-16-04 It should work for other distributions once you change the package manager.
Yes, usually you configure your endpoint firewall to block incoming traffic, while allowing all outgoing.
Unless you’re in a very secure zone, like DMZ’s.
ebtablesandiptablescan be very complex. And I failed my 1st RHCE exam because of them. But once you learn, you will never unlearn, as they are quite beautifully crafted. You just need to get into the mindset of the people who wrote the tools…Look into
firewalldIt has a rather simplified cli interface:firewall-cmdThe manpages will tell you a lot.
firewall-cmd —add-service=sshWill open the ports for your ssh daemon until you reload your firewall or reboot your systemfirewall-cmd —permanent —add-service=sshWill open the ssh ports until you remove themfirewall-cmd —list-allWill show you the current firewall config
Do you have any antivirus recomendations for Linux.
Install all applications from your package manager.
Don't run things as root.
Don't visit sketchy websites.
Run an ad-blocker that isn't owned by an advertising company.
Can you get a virus just for visiting a sketchy website?
Also, some programs aren't available via my package manager (I use Fedora) so I have to add 3rd party repos. Is there a general security guide for linux?
Thank you!
Nowadays it is almost impossible to get a virus just from visiting websites. As for security recommendations I would recommend never running applications as roo that 100% don't need it, as for 3rd party repos I would always be a by mindful of the apps but generally there isn't too much of a risk, of getting a virus.
There have been cases of malware exploiting scripts and even images being displayed, whether directly hosted on the site or via compromised ads.
Highly unlikely. A site could try to exploit unpatched security holes in your browser, but if your browser is up to date, this is unlikely to succeed. Modern browsers are very complex and large so they have lots of weaknesses, but they also get fixed quickly, a lot of eyes are on their code and they utilize sandboxing techniques as well to isolate things from your system.
Still, it's a good idea to harden your browser further yourself, or run it in an additional sandbox.Check Flatpaks as well.
There are anti viruses that run on GNU/Linux like ClamAv and kaspersky but they actually do not target the machine they run on or at least they are not so useful. Their intention is to stop the spread of malware.
In general, you just need to install softwaref uaong the package manager from trusted sources that are usually the defaults of your distribution and not input your password when you are not expecting it.
When copying commands to the terminal, most terminals will warn you if you are copying a command that requires root privileges.
That said for the operating system, apply it to the browser as well by being eclectic on what extensions you install and voila. 99.99% guaranteed malware free.
A very good point I forgot! Only use trusted software repositories!
You don't need one if you know what you are doing but there's ClamAV
Yeah, I think most of the times, if you don't run very sensitive enterprise grade machine there isn't much point to it.
Maybe run it once in a while if you really want to.
Trusting end-users to know what they're doing... Impossible mission
Permanently Deleted
Wow really helpful
Thanks for the helpful list. I had concerns in the past about flatpak, because as far as I know the dependencies are bundled into the flatpak and are not using the latest version of your distro. But that means that some flatpaks probably use outdated and unsecure dependencies.
Whats your opinion on that matter?
Permanently Deleted
I found flatpak to in fact be ahead of distros' packages. Granted, I use distros that are rather conservative on update (Debian, Gentoo, and Linux Mint). If you use something bleeding edge like Arch, things may be different, but shouldn't be far off.
Either way, I find flatpak to be reliable.
do not use browsers from flatpak. browsers have their own built in sandbox that is crippled or sometimes fully disabled in order to make flatpaks sandboxing work, which are often less restrictive than the browser's.
flatpak is better than nothing for the average user but most packages completely ignore the sandboxing it is supposed to use and require manual changes on flatseal.
Permanently Deleted
I would actually like to see your Bubblewrap script if you wouldn't mind sharing. I've been thinking about trying to learn how to use it for a while now, but I've kept putting it off since getting Xorg programs to work with it seemed difficult/confusing to me.
Permanently Deleted
I don't understand why we keep telling new users that it is useless to use an antivirus on Linux. For people with computer knowledge, sure. However more widespread Linux adoption will mean more casual users will start using it. Most of them don't have the "common sense" that is often mentioned ; these users will eventually fall for scams that tell them to run programs attached in emails or random bash scripts from the internet. The possibility is small, but it's not zero, so why not protect against it?
Because snake oil is not helping, or a working substitute.
Security is a process, not a solution.
Security is a process, not a solution.
Well put!
You might be legitimately annoyed by the amount of free antivirus software on Windows that don't offer good protection, on top of being filled with ads. But I don't agree that scanning for malicious files and preventing dangerous commands (regardless of how good the implementation is) can be labelled as snake oil.
Same thing happened on macOS. We used to say it’s immune because everything was written only for Windows. That stopped being true a long time ago and the majority of web servers have been running Linux for a decade. Doesn’t seem so crazy to me that someone would want to regularly scan their Linux boxes for bad code.
You should protect against it, but antiviruses are not the answer. It's more efficient to prevent breaches by building good security into software by design (and keeping your system up to date) than to play an endless game of catch-up enumerating pieces of malware after they're already circulating.
Windows tried this approach and it turned into a mess, antivirus companies turned into villains themselves and it still didn't fix the underlying problems. Eventually they came around to actually fixing security problems, and keeping Windows up to date, and offering a curated source of apps and so on.
You can still use scanning on Linux, but apply it efficiently on entry points, like attachments in your email client or your Downloads dir. Don't run a scanner all the time on all your processes and files, that's a gross waste of resources.
It also makes no sense for a properly secured modern system. Take for example Android, where a userspace antivirus can't work because userspace processes are isolated from each other, and a system level antivirus cannot be trusted because it needs to download signatures externally and can (and probably will) be a breach of privacy.
I basically agree with all the points you are making. Only scan downloads, email attachments and whatnot. Don't try to play cat and mouse with sophisticated malware because that's a waste of resources. I don't think software like this exists?
Perhaps SELinux on desktop is the way to go as other posts are suggesting, although I heard that it has some usability problems and can break some programs.
Schrödinger's Linux fanbase
Linux is so much better and easy to use for casual users. But in order to use it, you have to understand terminal, bash scripting, understand permissions, understand the difference between various flavors, etc
Most antivirus software are just root level tools to harvest your data, that pretend to help
-
Do not run a root account for regular stuff. This is a lot less common now since most distros require you to create a non-root account during install and a lot of the systems annoy you if you're running as root, but you'd be surprised by the sheer number of people who use accounts with UID 0 daily. This may also be caused by """more experienced""" friends/family setting it up that way to try cutting corners regarding access rights, but the bottom line is: don't be that person. Use root when necessary only.
-
Get into the habit of not blindly running every command you see online or trying every trick you read/hear, at least not on your main system. Try to setup a VM (or multiple) for the purpose of trying stuff out or running something you're not sure what the impact might be.
-
Keep your system updated, from kernel to userland.
-
Get into the habit of reading news regarding exploits, malware and the responses for them. You don't need to become an infosec professional or even understand what they actually do. What is important is for you to learn what to avoid and when something really bad is discovered so you can update as soon as possible.
These 4 steps are arguably more important and create better results than any anti-virus could ever hope to do for you. They won't ever get to 100% security, but then again, nothing will.
-
I think clamav is a good antivirus
Permanently Deleted
I have clamav installed, can I disable livescan? I use it mainly for data I will transfer to windows computers to make sure it's safe
[This comment has been deleted by an automated system]
ESET Endpont Antivirus for Linux
I haven't used on-access scanning for years but I remember Dazuko was used by multiple AV devs to provide it.
Permanently Deleted
I'm using since corporate Eset on Linux. When did they drop support?
Permanently Deleted
ClamAV is really only used to check for cross virus contamination. It's a tool that checks for windows malware inside of Linux.
Linux doesn't need any malware software. The way Linux runs and works is already way more secure in itself, almost everything you'll ever download is pre compiled intro software repositories that are checked constantly.
The only way you'll catch a virus on Linux is being dumb and clicking ads or downloading something from untrusted sources like websites that could be fake but look real.
At first: In most cases you don't need and don't want one.
I wanted to get one as I have several old (over two decades and more) Windows game CDs that I've bought long before switching to Linux. Back in the days it was actually a thing that sometimes malware slipped into professionally pressed CDs (especially on discs that came with PC game magazines or cheap game collection boxes).
For this case (Windows software check before attempting to run with wine) I can recommend ClamAV. It is open source and available on probably every distribution. But there is no need to attempt having it running all the time. I just run scans from the terminal whenever needed.
Unless you are in a cooperate environment or very careless with the stuff you download and commands you run you shouldn't need one!
[This comment has been deleted by an automated system]
There are way more viruses written for windows than there is for Linux
-
Linux users find viruses and they report them and then everyone works on a fix for it and it gets patched as soon as possible. This is why open sourced code is good.
-
Windows takes forever to fix or patch viruses most of the time they probably dont even care.
Everything virus related or even bug related gets patched almost immediately under Linux
Also... Everything you install on Linux is pre compiled and ore configured inside a package manager and these packages get checked constantly for bugs and viruses. Theres almost no need to install anything on Linux from websites that could be compromised
Out of the 13 years I have been using Linux I haven't Once caught a virus but I also study malware and write malware so I also understand it more on a deep level.
But honestly it's very hard to catch a virus on Linux
-
The typical consumer Windows antivirus was designed to solve a different set of problems in a different environment and analysing files for signatures and behaviors against known threats was very valuable when so many people were running executables from unsafe sources intentionally or not. Even on Windows an antivirus has never been the best way to secure a machine. It was always the lowest common denominator solution that you put on everyone's machine because it was better than nothing.
Linux has been well served for a long time by the division or privileges between root and users and signed trusted distro sources. The linux desktop is trending towards containerized flatpak applications running in seperate namespaces with additonal protection via seccomp. Try and understand the protections Linux provides and how to best take advantage of them first and only reach for an antivirus if you still think it is needed.
Common sense. ClamAV exists, but I have no idea if it's worth it
Currently I don't like any of the common AV solutions, ClamAV is the best we have and has great signature based antivirus, with many excellent third party virus signatures (I even use it on windows). however ClamAV has no heuristic based capabilities which means it's lacking quite a bit in that regard.
I really wish we had a decent hurestics based AV solution oriented to consumers but afaik none really exist that are any good.
ClamAV goated
If you’re looking for personal antivirus, you probably don’t need one. ClamAV is an option, but it is aimed at scanning emails rather than anything else. If you’re looking to protect your company or a network of computers, then Wazuh is a great choice.
Use common sense and dont install random shady shit from the internet.
Best antivrius in the world
After happily not following your advise my entire life on Arch Linux... I got this weird Virus on my PC while game developing. This virus made my entire PC glitch and my friend also wondered what the fuck is going on. Weird and creepy music started and sounded like its telling me I am dumb. After unplugging my entire PC from electricity, the music was still there... and I cried.
After waking up I asked myself how the fuck did I dream this and why this dream felt so real (like a lucid dream but I thought this is real life). I maybe dreamed this after having a discussion why I should get an IPhone. As a GrapheneOS user I explained myself, but restarted my thinking about Security. (But even without being a Security focused guy, an IPhone has not enough features like Sideloading Open Source apps)
what vim does to a motherfucker
Common Sense Antivirus(tm) is breddy gucci.
I've been running Linux for 20 years. Not once have I been in a situation that required an antivirus. The one time I've had a security breach it was not a virus but user error that left a door open. And even then, it was just ransomware, not a virus.
Yes, no antivirus. You don't need it. There are no viruses. Plus, the way Linux is setup it's not easy for a virus to do alot of damage.
And if you're dual booting with Windows and shared data?
Put the AV on Windows only. Linux cannot run any .exe files anyway so they are useless, unless you try run them under wine, but I wouldn't recommend it.
Virustotal is great to scan anything you download that does not contain sensitive information, and ClamAV + TK will work locally to scan anything that contains sensitive information (e.g. documents sent by others) or things too big for Virustotal.
Like others are saying, there's less of a need for antivirus on Linux since there's less easy entry points (e.g package manager over downloading an installer) and less (but far from 0) malware made for Linux. But we all probably download app images or get documents related to job searches at some point and I personally prefer to scan almost file that I get from a remote computer.
Most is malware these days. Checkout Safing Portmaster and config blocking various outbound connections and pick a good DNS filter like AdGuard. Then if you get malware it won't be able to connect to CnC server.
Avast! runs on Linux.
Personally I prefer to just avoid clicking on dodgy links. In the last 5 years I haven't found any viruses. YMMV
And don't use root for anything that doesn't need root.
yeah I always try without sudo and do "sudo !!" if it needs it.
Yeach that was my personal preference but the profliferation of streaming services each with their own exclusive shows made me sail the black seas once again, so i was wondering if there is something to scan downloaded files. If its even possible in the first place to get a virus on Linux that way.
I think if you added this context to your post, you’d get less hostile answers from people saying you don’t need one. You have a legit reason for using an AV. While the risk of malicious stuff downloaded from the high seas affecting you is lower, it’s still good to conduct due diligence that they don’t sit on your machine and spread anywhere else. As others mentioned, clamav is a good option.
No judgement on what you're doing online. In your case, don't download untrusted files, stream where you can. For all users, whether on the black seas or not, you should as a matter of habit use uBlock Origin in your browser, turn on the filterlists for security, ads, annoyances in particular.
[This comment has been deleted by an automated system]
Dr Web for linux. Run it once a week.
