Antivirus for HP-UX

[Tom Brown]

Hi everyone,
We have several large PA-RISC servers running HP-UX and Oracle backends for applications (no email gateways, no web servers). A gradual migration to Itanium (HP-UX blades) is planned.

Management has decided that every computer in the organization must run antivirus software, preferably Kaspersky.

I'm wondering if people will chime in here to share their knowledge and experience with viruses in the HP-UX world. How many HP-UX viruses are out there in the wild and how frequently are Oracle servers behind enterprise firewalls taken down by such malware? What are the options--among the world's largest and most trusted security companies, of course--as far as antivirus products to run on and continually protect HP-UX / Oracle servers from malware?

Any thoughts from the community would be greatly appreciated, as we have only begun to shop. However, there will be deadlines, I'm sure.

[Peter Godron]

Tom,
please see thread on virus on UNIX:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=955210

In general, not too much of a threat, unlike for some other OSs.
You are more likely to get Oracle buffer/listener issues, patches for which are issues on a regular/emergency basis.

[Peter Nikitka]

Hi,

we are currently using McAffee for Linux at our Mailhost (qmail) to check incoming mail for viruses. This product is available for HP-UX as well - but not for free.
Since it works well at our SuSE9, it should do well under HP-UX, too.

Using a virus checker for pure HP-UX + Oracle internal data in the environment you described seems a rather overdose of security - IMHO.

mfG Peter

PS: Never heard of a HP specific virus alert.

[James R. Ferguson]

Hi Tom:

The Technical Knowledge Base document (#KBRC00008034) as referenece in Peter's post, above, offers a good explanation for your question.

Beyond that, I would certainly make sure that you have configured your kernel with:

executable_stack = 0

secure_sid_scripts = 1

The manpages for 11iv2 offer the pertinent details for each. 'executable_stack' is available on 11iv1.

Regards!

...JRF...

[hbkrules]

Does HP even support AV on their HP-UX machines. Our former HP-UX Admin, told me he spoke to a few of his HP buddies and they replayed to him that HP does not support any AV software installed on their machines. Reason I am asking is, I have mentioned this to co-workers, who are still insisting on moving forward to putting AV on the boxes.

Thanks

[Tom Brown]

Peter G,
Thanks for pointing me to that thread. The comments about SAMBA in there are pertinent because we do make limited use of SAMBA. However, if all the Windows machines are using high-dollar AV solutions, how on earth could anyone put (to) or get (from) a virus on a SAMBA share? Such a virus would have to be at least a Kaspersky hour ahead of the police (if you get my drift).

By the way, I think I can scan mapped drives with Kaspersky (others too, probably).

----------------

Peter N,
That P.S. is priceless (and instructive). I don't think an organization as large as we would ever use Qmail on Linux for our mail gateway [Unfortunately, most are choosing MS Exchange instead]. However, I can see where McAfee's product (if it is effective) would be necessary in a situation like that.

[TwoProc]

We use McAfee uvscan. It's not expensive, and it keeps us confident that there are no systems that are acting as "harbingers" of untested files out there that users are putting data in and out of that are hosting viruses (via samba, sftp, etc). It's low risk, but maintaining it is simple enough, and the cost is low as well.

[Tom Brown]

Hi John,
Where do you buy Mcafee uvscan? I just searched for "uvscan" on their website and got no hits.

[Tom Brown]

John,

I did find a link by looking for 'HP-UX'.

https://secure.nai.com/apps/downloads/free_e
valuations/default.asp?region=us&segment=smb

It doesn't look like 11iv23 is supported though, and that's where you start with Integrity.