Results 1 to 9 of 9

Thread: Border antivirus

  1. #1
    Join Date
    Apr 2007
    Location
    Calvert City, KY
    Beans
    41
    Distro
    Edubuntu 12.10 Quantal Quetzal

    Border antivirus

    I am curious because I know some Debian-based commercial products like Untangle offer border-based antivirus protection. I would not mind if I only got detection for that matter...

    I am not opposed to running a full web-based firewall suite, provided it will run under Ubuntu and not "be" the operating system so to speak.

  2. #2
    Join Date
    Nov 2012
    Beans
    12

    Re: Border antivirus

    Do you have an objection with an client-side firewall?

    Firestarter Howto

    And as far as anti-virus. There are not too many viruses for linux, in general I feel it's not a huge concern as it is extremely unlikely to get a virus (the majority of viruses are designed for Windows and cannot affect linux).
    But just in case it is a concern for you:
    Top 5 Anti-viruses
    Last edited by cariboo907; November 11th, 2012 at 02:36 AM. Reason: Fixed Windows spelling error

  3. #3
    Join Date
    Mar 2006
    Location
    Williams Lake
    Beans
    Hidden!
    Distro
    Ubuntu Development Release

    Re: Border antivirus

    Quote Originally Posted by LordXandor View Post
    Do you have an objection with an client-side firewall?

    Firestarter Howto

    And as far as anti-virus. There are not too many viruses for linux, in general I feel it's not a huge concern as it is extremely unlikely to get a virus (the majority of viruses are designed for Windows and cannot affect linux).
    But just in case it is a concern for you:
    Top 5 Anti-viruses
    Please don't recommend Firestarter, as it hasn't been updated except for a few bug fixes, in several years. Using firestarter itself isn't much of a problem, but if you use it to monitor incoming connections, it has to be run with escalated privileges, which may lead to security problems.

    I'd much rather see the op use ufw/gufw to set up the firewall. In most cases, the default rules are enough for a standard desktop system. You can start the firewall (iptables/netfilter) using the following commands, In a gui, press Alt-F2 and type:

    Code:
    gksu ufw enable
    or from the command line:

    Code:
    sudo ufw enable
    As far as an anti-virus program is concerned, if you aren't sharing files with Windows or Mac systems, there really isn't a need for it, as there aren't, as stated previously any Linux viruses in the wild.

    A much bigger problem in my eyes, is social engineering, and the only thing to prevent that is education, so spend some time learning the differences between the previous operating system you used and Ubuntu, and remember that most of what you know about your previous operating won't transfer to Ubuntu or any other Linux distribution.

  4. #4
    Join Date
    Apr 2007
    Location
    Calvert City, KY
    Beans
    41
    Distro
    Edubuntu 12.10 Quantal Quetzal

    Re: Border antivirus

    i am more interested in virus detection and blocking at the border (my linux server). i know i can install snort with an inline addon for clamav to handle virus activity. looking for something similar if there is anything else.

    inside of our home network are multiple windows machines for the wife, kids, etc... they all have antivirus installed, but wouldnt it be nice to stop them before they ever entered our network?

  5. #5
    offgridguy's Avatar
    offgridguy is offline Grande Half-n-Half Cinnamon Ubuntu
    Join Date
    Jul 2012
    Beans
    Hidden!

    Re: Border antivirus

    Quote Originally Posted by inspiteofmyself View Post

    inside of our home network are multiple windows machines for the wife, kids, etc... they all have antivirus installed, but wouldnt it be nice to stop them before they ever entered our network?
    I am curious, is this even possible?

  6. #6
    Join Date
    Nov 2012
    Beans
    12

    Re: Border antivirus

    Theoretically speaking a custom route or hub might be able to do this.

  7. #7
    Join Date
    Sep 2011
    Beans
    1,531

    Re: Border antivirus

    Beyond snort I don't know how you'd accomplish that without having a dedicated machine to filter incoming traffic. I suppose you could create a series of virtual machines on one dedicated machine (or maybe even on your linux server if it's beefy enough) to run all the individual Tangle appliances. No idea how that would work in terms of bandwidth and unacceptable delays to users.

    Other options: you could have the linux server function as a proxy for all web traffic on the windows machines. You could apply rules & blacklist/whitelist websites- use dansguardian or something similar. It's not what you're asking for but I guess it's kind of an alternative.

  8. #8
    Join Date
    Apr 2007
    Location
    Calvert City, KY
    Beans
    41
    Distro
    Edubuntu 12.10 Quantal Quetzal

    Re: Border antivirus

    i am really just somewhat interested in what untangle does with their products. they are able to offer border-antivirus on some relatively meager hardware. my linux server acts as little more than a router/firewall, and its a quad core machine with 6gigs of ram... pretty sure it would be up to the task of packet filtering.

  9. #9
    Join Date
    Nov 2009
    Beans
    919
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: Border antivirus

    With any in-line IPS there is a greater chance of false positives disrupting legitimate/intended activity than there is of threats being prevented. And with AV solutions of any kind it's important to keep in mind that all it's doing is matching against signatures based on known malware, which is always pretty far behind the malware itself. I wouldn't personally trust any vendor making the claim that they can stop malware at the premise of the network, especially if they make the claim without demonstrating it. Malware is more of a local system problem than a network problem. Until it runs on a target machine it's just a file. It's easy to make files appear harmless right up until the moment they actually do their damage.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •