topic Re: virus protection on Unix in Operating System - HP-UX

virus protection on Unix

vaibhav_1 — Thu, 11 Oct 2001 15:52:31 GMT

Does anybody know about virus threat for unix.
Is there anti-virus software available for Unix .

Re: virus protection on Unix

Sridhar Bhaskarla — Thu, 11 Oct 2001 15:59:01 GMT

Vaibhav,

There is nothing like virus on Unix so far.However, check the following thread for more opinions. I do believe that programs like Trojen Horses, unnecessary suids etc are cousins of viruses. But there are no standard viruses on Unix like we have on Windows.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x3c72abe92dabd5118ff10090279cd0f9,00.html

-Sri

Re: virus protection on Unix

harry d brown jr — Thu, 11 Oct 2001 16:06:12 GMT

virus's as in the microsoftie world don't exist in the unix world.

Re: virus protection on Unix

linuxfan — Thu, 11 Oct 2001 16:17:57 GMT

Hi Vaibhav,

As others have already said, virus'es do not affect the unix servers directly. However, sometimes virus checking is necessary if your

1. Unix machines are acting as servers for non-Unix client workstations (windoz)

2. Unix machines are being used as mail servers and can check email for worms and infected attachments before they reach the desktop.

There are both free and commercial anti-virus software available.

-HTH
Ramesh

Re: virus protection on Unix

Mark Vollmers — Thu, 11 Oct 2001 16:43:19 GMT

Hi-

McAffe has a virus protector for Unix, but it is designed to run on a UNIX platform and search for windows virus' (for a web server or something). As the others have said, it really isn't a concern. Just be sure that your system is secure and try to make sure that there are no holes (permissions set right, etc) and you should be fine.

Mark

Re: virus protection on Unix

G. Vrijhoeven — Thu, 11 Oct 2001 16:57:58 GMT

there is anti virus software build in to the shell just type virus at you promt.....:) sorry but if you fix the holes like others have mentioned you should be fine.

Re: virus protection on Unix

John Bolene — Thu, 11 Oct 2001 17:07:47 GMT

As others have said, no viruses for HPUX yet.

You might be interested in the following though:

The IDS/9000 intrusion detection software will now be bundled with HP-UX, HP's flavor of the Unix operating system, said Mark Crosbie, security architect at HP, speaking at the RAID 2001 conference here at the University of California at Davis. HP will also put
out version 2.0 of the product in "a few weeks" and is considering making the software available for other operating systems, Crosbie said. IDS/9000 is already available as a free download from HP.

I have been unable to find the download link.

Re: virus protection on Unix

John Bolene — Thu, 11 Oct 2001 17:15:41 GMT

Found it finally.

http://www.hp.com/security/products/ids/papers/brief/

Re: virus protection on Unix

Mark Crosbie — Fri, 02 Nov 2001 22:47:45 GMT

Now that my fame has preceded me.... :-)

IDS/9000 will detect exploitation of common UNIX vulnerabilities: creating setuid root files, modifying files, creating world-writeable files, race condition exploits.

Nowhere in that list was "virus detection" because there is no such thing for UNIX. In reality a virus has to make some sort of modification to the system (either binaries, libraries or config files) and that modification attempt is detected and reported by IDS/9000.

*But* if the filesystem is NFS exported and the NFS client makes a change to it locally, IDs/9000 won't detect the change - we don't do file signature checking.

You can thank marketing for the "virus detection" stuff in the product brief :-)

Regards,
Mark
--
Mark Crosbie IDS/9000 Product Architect
http://www.hp.com/security/products/ids

Re: virus protection on Unix

harry d brown jr — Sat, 03 Nov 2001 01:21:37 GMT

This thread clearly shows the only potential virus in unix:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0xfdcacf38d6bdd5118ff10090279cd0f9,00.html

live free or die
harry