Simpler Navigation for Servers and Operating Systems - Please Update Your Bookmarks
Completed: a much simpler Servers and Operating Systems section of the Community. We combined many of the older boards, so you won't have to click through so many levels to get at the information you need. Check the consolidated boards here as many sub-forums are now single boards.
If you have bookmarked forums or discussion boards in Servers and Operating Systems, we suggest you check and update them as needed.
cancel
Showing results for 
Search instead for 
Did you mean: 

antivirus software for hpux

SOLVED
Go to solution
CJENSEN_1
Regular Advisor

antivirus software for hpux

Hello Everyone,
We have two machines, both are HPUX 9000/800 machines. One K200 running HPUX 10.20, the other a K360 running HPUX 11.11. What does everyone use for antivirus software?
9 REPLIES
John Poff
Honored Contributor

Re: antivirus software for hpux

Hi,

There isn't much in the way of anti-virus software for HP-UX, as the demand is really low because you just don't see any viruses there. You might setup something if you provide disk space as Samba shares for Microsoft boxes. Also, you might want to look at the IDS/9000 intrusion detection software, and the Bastille hardening software which is available from HP.

Here are a couple of posts that discuss HP-UX and the anti-virus question:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xcfc091ccb36bd611abdb0090277a778c,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x82af3fa720f3d5118ff40090279cd0f9,00.html


JP

Rajeev Shukla
Honored Contributor

Re: antivirus software for hpux

I have heard of virus scanning software for emails on unix, i dont think you should be really bothered about virus on Unix as long as you take care of all security issuses and keep updated with recent security patches. But if you still want some search on google or try this one out
http://www.opsec.com/opsecdownload.html
http://www.ucalgary.ca/it/virus/#unix
http://www.mcafeeb2b.com/naicommon/buy-try/try/products-evals.asp

Rajeev
Michael Tully
Honored Contributor

Re: antivirus software for hpux

I've never seen a virus, for a HPUX system. What is the danger is having files on your system with in-appropriate permissions where a hacker can attempt to control of your system, or the activation of a trojan horse.

As suggested you need to probably look into something like, HPUX Bastille, IDS.

Once of the best things is to set up your system as a Bastion Server. You can get a copy of the white paper from here. I've got some systems in a DMZ, that were built as bastions servers, and have not had a problem.
http://people.hp.se/stevesk/bastion11.html
Anyone for a Mutiny ?
Shannon Petry
Honored Contributor
Solution

Re: antivirus software for hpux

Here's a clip of something I wrote a few years back. Still holds true for the most part...

I am not an HP official, but have been working in the UNIX environment for more than a decade. (Old timer kindof). Here is an explenation of why virii do not exist for UNIX. Let me say that the pointer in the previous reply says some of this too.

First, I should say that there are many "trojans" for UNIX, and are very easy to make. I.E. A script that calls /sbin/rm -f /* executed by root will delete the files under / (exception would be /sbin and /sbin/rm and the shell because they are in use). While some people consider trojans a virus, they are not.

Virii have certain characteristics which would define them as virii. First, a virus is usually memory resident. This means that the virus sits in memory and looks for keys to attack files. Usually the dos extension to the file name. I.E. .exe files and .com files. Also virii must be at least a nuisance. like writing "eat my shorts" into a text file would cause an unwanted change to the file. A program that sat in memory and wrote our ficticous message to files would be a virus. A virus must also spread itself in one way or another.

Because the virus usually needs a trigger (like the dos extension) UNIX virii are much more difficult to create. Since /usr/bin/rm is an executable not denoted by rm.exe, the virus would not be able to tell by name what is an executable to infect and spread, and what is not. /etc/hosts would look the same to a virus as /etc/ping. A virus would have to be huge to sit in memory and be able to stat all files, run magic, check bits, etc... to know how to spread.

Next, in UNIX the kernel is memory resident. When the system boots the kernel, it is read only. The kernel sits in memory until system shutdown. If a virus was to infect the kernel, it would not be effective until the system was rebooted with the bad kernel. In Win/XXXX the kernel sits on a disk, and is constantly accessed. Sorry Gates and Clan, but a 100MB kernel just does not fit into most PC's memory :). If the kernel is corrupted, the corruptions are instantly read in, and accepted. Microsoft was supposed to fix this in Win NT 4.0, then in 2000, but I guess they will just let saps keep buying their products and spending tons of cash on anti-virus software and think that is has to be that way.....How easily some of us are fooled :)

The next problem with running a virus in UNIX is that the virus can only run at the access level of the user who executes the program. I.E. If johndoe executes the program, the program can only affect "johndoe"'s processes and files. Anything owned by "root", and "bettysue" would be unaffected. The virus could only do wide spread system damage if the super user "root" executed the virus. This severely limits the ability of a virus in UNIX. Windows NT and 2000 also have multi leveled access for processes, but Microsoft's implementation is very easy to bypass. Another fine programming job by the wonderfull folks at Microsoft! :)

In SunOS and Linux, the virus scanning software that is available is NOT for UNIX and Linux protection, but Microsoft Windows protection. The software is made to scan data shared to and from Windows boxes.

The best defense in UNIX to the Virus threat is common sense, built in UNIX functionality, and basic security measures available in more locations than I would care to give in this reply.

Tell the person asking for Norton AV for HP-UX that it is only necessary in Microsoft world. While him and sooo many others think that Crashes and Virus threats are daily concerns, us UNIX folks know better!

Sincerely,
Shannon Petry
Systems Engineer
Microsoft. When do you want a virus today?
Hank Eggers
Frequent Advisor

Re: antivirus software for hpux

We currently use McAfee virus scan unix command line software on our Linux based mail server.

It auto-updates the .dat file every night and scans all incoming and outgoing email.

If it detects a virus, we have it setup to move the email to a quarantine folder and email the admin and sender that the email was not sent.

It works great for us.
Scott_14
Regular Advisor

Re: antivirus software for hpux

Hi there:

One thought, if you have users saving data to your server, in an area, you could use a pc to mount the drive, then run mcaffee virus scan on thier data.
I used to do this at one site, mount thier drive as a root, and scan thier data, to clean up mostly macro viruses they would get from the pcs.

scott

Martha Mueller
Super Advisor

Re: antivirus software for hpux

Shannon,

Thank you very much for that explanation. I have saved it to a file - keeping your name as author, of course - to use as a reference. This is the first time I have seen such an in-depth discussion, one that was appropriate to use for the general public.

martha
Shannon Petry
Honored Contributor

Re: antivirus software for hpux

Im glad you enjoyed, and flattered that you thought to save the file ;)

Sincerely,
Shannon
Microsoft. When do you want a virus today?
CJENSEN_1
Regular Advisor

Re: antivirus software for hpux

Thanks.