Anti-Virus software for HP-UX ?

[Tan Shirley]

Hi,

Anyone has any idea if there's any Anti-virus software for HP-UX v10.20 or v11.00 ?
If so, any recommendation ?
Any free downloads ?
Thanks !

Regards,
Shirley

[Rainer von Bongartz]

Check out the product from Trend Micro Inc. which is available for HP-UX

www.trendmicro.com

Regards

rainer

[harry d brown jr]

Are you looking for email virus scanning products that run on hpux for end-users that use MS os mail products?

[Greg OBarr]

I am curious as to why you would want this. I have never heard of a UNIX "virus". Typically, you just want to protect against hacks on a UNIX system.

[Rainer von Bongartz]

Greg,

in times where you have interoperability between UNIX and NT you really have to worry about VIRUS protection even on UX systems.
Think i.e. about SAMBA which allows you to share UNIX servers in an NT environement and place your (Virus infected ) documents in an HP-UX environement.

Regards
Rainer

[Greg OBarr]

Rainer, OK, I can see it if you're using Samba. I suppose that some viruses could affect Samba or be propagated to other NT systems that also access the same files via Samba.

[Mike Burk]

I use McAfee Virus Scan for HP-UX. www.nai.com

[Tan Shirley]

Hi Mike,

Thanks ! I've downloaded a trial version and have installled on my test server, did a scan and it works !

Thanks to the rest of you as well for your suggestions !

Actually my HP-UX system is running our ERP system. It does not run anything like Samba or anything related to Windows.
I'm just trying to be on the safe side in case the HP-UX gets virus. Anyone heard of virus found in HP-UX ? Or any victims got attacked by virus in their HP-UX box before ?

Alright, back to the anti-virus software.
I realise dthat it does not have the auto-protect feature like the ones we find in Windows, hence I intend to schedule a cron job to maunally run it every say one hour or so. But I have no idea which path or directory to scan. I can possibly scan the whole root (/) as it's going to take a very very long time.
Do I scan the data only, or do I need to scan other volumes like /etc or /var, etc.... ?

Any advise ?

Thanks so much !

Will reward you guys with points later on...

Regards,
Shirley

[Mark Vollmers · Accepted solution]

Shirley,

As far as what to scan, I would scan areas where there is activity (if you have directories that constantly have files moving in and out). To be on the safe side, you could also schedule full scans monthly or whatever.

Concerning virus' and UNIX, there have been a few very good threads about that. In general, there is little to no threat of being hit by a virus becuase of how Unix runs. the virus really needs to have root access to do serious damage. Most of the critical files are unreachable unless you have this. Others can chime in here, but I think the general concensus is that if you protect root access and have decent security procedures (like permissions) set up, you don't need to worry about anything.

Mark

[Mark Vollmers]

hey, look at that. Got myself a new cap. To quote from the great philospher Homer, Woo-hoo!

[Tan Shirley]

Hi Mark,

Thanks for your reply.

But I'm still not too sure what to scan (to be exact). Could someone advise me, eg /etc, /var, /sbin, or what ?

And did anyone really got attacked by UNIX virus before ?

I'm really hesitating whether to install onto my production ERP server as I'm afraid it will take up the resources just to do the scanning, hence slowdown the whole HP-UX box.

Any advise, anyone ?

Regards,
Shirley

[harry d brown jr]

Tan,

If your ERP software allows users to store mircosoft documents on your unix box, then you probably should run your virus protection software. Otherwise, if you aren't sharing your disks with windows users, with products like Samba, then there is no need to run virus protection software. The only reason you would run a virus protection program is to protect your other windows users, and being that you aren't, then you don't need to.

There are no documented cases of virus's in Unix (any flavor), although there are "exploits" that are documented, but these are not virus's, therefore "anti-virus" software will not find these "exploits".

[Bill McNAMARA_1]

I've heard of one virus.. the .sig virus. ;)
http://www.tuxedo.org/~esr/jargon/html/entry/sig-virus.html

http://home.wxs.nl/~faase009/Signindex.html

Vi virus signature
Email viruses can be written to work with very simple editors like vi, as my example below illustrates. vi has an option to use modelines, these are lines at the begining or end of a file which contain code to be executed as editor commands. Major window for security to fly out of. (The metaphore is deliberate.)
Below they are used to form a .signature virus, how it works is left as an exercise for the reader.

ex: /sig virus!$/w!>>~/.signature : Eli's vi modeline sig virus!

A slightly more vicious (but also more effective) version would have the `>>' removed.
By `Eli the bearded'.

Later,
Bill

[harry d brown jr]

Bill,

That's not really a virus, because it can not replicate itself without someone manually propagating it.

http://www.logophilia.com/jargon/jargon_34.html

[Mark Vollmers]

Wow. There actually is a Unix virus. Of course, there are about 12 billion windows ones... Anyway, I think that Harry has a good point on the type of files. Normally, directories like /sbin and even /var and /etc won't (or shouldn't) have files that are being modified on a regular basis (log files would be the exception, especially in /var), so I wouldn't worry about these too much. You can do the heavy scans at night or weekends, when you can commit resources to scanning. You have said that there are no programs running to link in windows (like Samba). How isolated is your ERP server? If you do not have mounted file systems (through NFS) and if you do not run email through this server, then it will be extremely difficult to get a virus in. I'd say that the best advice would be to figure out all entry points into the server (email, NFS, user home directories, etc) and keep an eye on them.

As an aside, keep good backups, just in case...

Good luck

Mark

[Tan Shirley]

Hey guys,

Thanks for all the advice !
I've just assigned points for all of you.

Thanks once again, and have a good day !

Regards,
Shirley

[Stefan Schulz]

Hi Shirley,

after reading all those replies to your question i would like to add my thoughts.

1. Virus scanners don't just scan for viruses. They also check for backdoors and trojans. So if you buy a virus scanner you get more than just protection against viruses. Which means even if there are nearly no known real UNIX viruses a virus scanner should protect you against the other stuff.

BUT:

2. The UNIX virus scanners i have seen so far will not scan for UNIX viruses or backdoors. They are made to protect your Windows boxes which access this UNIX System or recieve their emails from this UNIX box. AFAIK there is no virus scanner which will check for UNIX viruses or UNIX backdoors, trojans ....

Please check the whitepapers to see what this scanner is designed for.

Hope this helps.

Regards Stefan

[Magdi KAMAL]

Hi Tan,

You would have a look on this :

http://www.docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90742/B2355-90742_top.html&con=/hpux/onlinedocs/B2355-90742/00/00/63-con.html&toc=/hpux/onlinedocs/B2355-90742/00/00/63-toc.html&searchterms=virus&queryid=20010830-035340

Magdi