virus protection on Unix

[vaibhav_1]

Does anybody know about virus threat for unix.
Is there anti-virus software available for Unix .

[Sridhar Bhaskarla]

Vaibhav,

There is nothing like virus on Unix so far.However, check the following thread for more opinions. I do believe that programs like Trojen Horses, unnecessary suids etc are cousins of viruses. But there are no standard viruses on Unix like we have on Windows.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x3c72abe92dabd5118ff10090279cd0f9,00.html

-Sri

[harry d brown jr]

virus's as in the microsoftie world don't exist in the unix world.

[linuxfan]

Hi Vaibhav,


As others have already said, virus'es do not affect the unix servers directly. However, sometimes virus checking is necessary if your

1. Unix machines are acting as servers for non-Unix client workstations (windoz)

2. Unix machines are being used as mail servers and can check email for worms and infected attachments before they reach the desktop.

There are both free and commercial anti-virus software available.

-HTH
Ramesh

[Mark Vollmers]

Hi-

McAffe has a virus protector for Unix, but it is designed to run on a UNIX platform and search for windows virus' (for a web server or something). As the others have said, it really isn't a concern. Just be sure that your system is secure and try to make sure that there are no holes (permissions set right, etc) and you should be fine.

Mark

[G. Vrijhoeven]

there is anti virus software build in to the shell just type virus at you promt.....:) sorry but if you fix the holes like others have mentioned you should be fine.

[John Bolene]

As others have said, no viruses for HPUX yet.

You might be interested in the following though:

The IDS/9000 intrusion detection software will now be bundled with HP-UX, HP's flavor of the Unix operating system, said Mark Crosbie, security architect at HP, speaking at the RAID 2001 conference here at the University of California at Davis. HP will also put
out version 2.0 of the product in "a few weeks" and is considering making the software available for other operating systems, Crosbie said. IDS/9000 is already available as a free download from HP.


I have been unable to find the download link.

[John Bolene]

Found it finally.


http://www.hp.com/security/products/ids/papers/brief/

[Mark Crosbie]

Now that my fame has preceded me.... :-)

IDS/9000 will detect exploitation of common UNIX vulnerabilities: creating setuid root files, modifying files, creating world-writeable files, race condition exploits.

Nowhere in that list was "virus detection" because there is no such thing for UNIX. In reality a virus has to make some sort of modification to the system (either binaries, libraries or config files) and that modification attempt is detected and reported by IDS/9000.

*But* if the filesystem is NFS exported and the NFS client makes a change to it locally, IDs/9000 won't detect the change - we don't do file signature checking.

You can thank marketing for the "virus detection" stuff in the product brief :-)

Regards,
Mark
--
Mark Crosbie IDS/9000 Product Architect
http://www.hp.com/security/products/ids

[harry d brown jr]

This thread clearly shows the only potential virus in unix:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0xfdcacf38d6bdd5118ff10090279cd0f9,00.html

live free or die
harry