@Numeral3 ClamAV is the goto option, it helps finding bad files on windows shares and mailboxes
this post was submitted on 02 Mar 2025
4 points (100.0% liked)
homelab
7293 readers
1 users here now
founded 4 years ago
MODERATORS
None, because they typicially open up a larger attack surface than the system would have without them. It's been like that for a while now. For references, I'd recommend this article from Ars Technica, who reference some very knowledgeable people (including Chrome's Security Chief at the time).
There was a time when AV software was useful. We're a decade past that, the world has changed, software has changed, defenses have changed, and AV software did not keep up.
Windows defender on Windows PC's. Nothing on Linux.
My antivirus for Linux is a policy of not executing things as root and installing things via safe channels when possible.
If I'm setting up a server or other untrusted service, I create a user specifically for it that has very limited permissions.
This makes it so that when something is compromised it is still trapped in a box and can't spread.
None. I won't install something that checks the whole system, but maybe a tool something that checks installed packages or container images against some known cve database and alerts me if it has findings.
What would you run an antivirus for? I trust the software I out on my servers, if I didn't I wouldn't be installing it or at the very least would put it in a VM.
I have real security boundaries in place, no need for useless scareware.
In my competitive industry I often have to install half baked software often written without security in mind and written by folks from all over the world that I've never met
Nothing gives white knuckles like piping a curl output to bash because your boss says to try out a program their friend found and you don't have time to audit anything.
Though your point still holds. If you are careful you can do this with relative safety in Linux. Windows makes it harder tho
I just use disposable VMs or containers for that stuff, with limited network access. I'd always rather have a real security boundary than databases and heuristics.
On my debian server, I have trivy to scan containers and I use clamav to scan files now and again but clamav uses up a lot of ram and its not a mailserver so I'm planning on uninstalling it.
On desktops I use virus total to scan PDFs or small files and stick to foss software
I have my server behind NAT and I use Tailscale to access it from elsewhere.
Clamav against any new downloaded files. That's about it
Microsoft is "generally competent," according to O'Callahan
Sorry had to DQ the article cause of that /s