Antivirus and Antimalware for Linux/Ubuntu?

[patriciaduv]

One of our home computers used XP. As we already have a relatively new laptop and a relatively new tablet we had no intention of upgrading it, so I switched it to Linux ubuntu.

Could anyone advise me:
1. Whether I can get Avast for Lubuntu?
2. Where I can find an antimalware, it seems MBAM don't do a Linux version?
3. How I can find out whether I am a running a firewall please?

[crip720]

Most people will suggest you don't need antivirus, but if you want one can look for clamav in your software centre. Can also get gufw there for your firewall, will allow you to turn on or off. Probably the best antivirus for linux would be a good adblocker addon on your browser and not clicking every link you see. All or most of the software you want will be in the software centre, you don't go looking online for software downloads. 99% of malware will not work on linux. Software for windows won't work on linux, but there are some work arounds for some if you really need it.

[sulton]

i dont think you need antivirus for linux based OS

[TheFu]

There are some "sticky" threads at the top of the "Security" sub-forum here which answer these and other questions.
Also, searching for "Ubuntu Basic Security" will answer most security stuff in an organized way.

The Linux firewall is part of the kernel. There are different interfaces that humans and script use to control it. For simple needs, something like gufw or ufw are simple interfaces. Iptables is the industrial-strength firewall used by people with more complicated needs.

By default, when you install any Ubuntu desktop, no inbound services are "listening" on any ports, so the firewall doesn't have any rules. It is active, just without rules to alter any packets. If you setup any services or network daemons, as we call them in Unix, then you should consider setting up firewall rules to protect that specific service from access by remote addresses you don't want to have access.

Most network daemons have their own internal methods to restrict access too, based on something called tcp-wrappers, which has been around about 25 yrs now.

I don't run either AV or anti-malware on any of my Linux systems. Nothing can replace a human paying attention to their actions. Also, when doing risky tasks like using a web browser, Linux has multiple methods to lock down that specific program, for that specific userid, to allow access only to very specific directories. I've been running browsers in these containers for about 5 yrs now. I believe in the next Ubuntu release, it will become a default for most programs.

With the Unix security model, it is nearly impossible for a normal userid to harm the OS. That is partially why every popular OS out in the world, except 1, uses Unix as their basis.

[Autodave]

13 machines here: 2 open to the public. Never had an issue with viruses. Save your RAM for something useful.

As far as an ad blocker, I recommend uBlock add-on in Firefow. Easy on the system and works rather well.

[SeijiSensei]

Antimalware? You mean the kinds of crap that comes in through emails? Pro-tip: don't open emails that come from random unknown senders. The first line of defense against all forms of malware is you.

I've never run any antivirus program of any kind on a Linux desktop and have never been infected in over two decades.

[TheFu]

I've been hacked 3 times.

1st time (1994-ish), when I was really new, but running with known root passwords outside a firewall, on the internet. This was long before firewalls were common. The system was a total loss - well, the data and OS were, not the hardware.

2nd time (2002), I was running a 3 month unpatched service that didn't need to be on the internet, but was. Totally my fault. The service was BIND. Nothing bad happened after the hack. I had system backups ( just lucky ) and was able to see what had been modified on the system, nothing outside their hack and some scripts in /tmp/.../.hidden/..... Nothing was actually harmed on the server or the network.

3rd time (2016-ish?), I was at a security conference with a freshly installed and patched Ubuntu desktop. The only networking enabled was bluetooth, which I had neglected to disable, because I don't use it. Ubuntu had installed and enabled it and a security guy there hacked in while I was helping to run a KoTH contest. Before going to the conference, I had wiped and loaded a fresh install. When I returned home, I planned to wipe and reload my normal stuff from backups. This is a normal process for attending security conferences with any technology. I take a $40 cell phone to these conferences too. The normal cell phone stays home. Nothing was lost or harmed. If you are going to be hacked, do it at a security conference. If you lived in a apartment building full of locksmiths, would you bother locking your door? I would, but I wouldn't be surprised to find a neighbor watching TV, having a beer, when I came home.

Turns out that bluetooth hasn't ever been safe to use: https://www.howtogeek.com/438712/cou...acked-in-2019/

The best security tool that I know is to have daily, automatic, versioned, backups that are "pulled" by a backup server, not pushed.

[Artim]

Since switching to Linux almost 10 years ago now (9.04 was my first distro) I have not used any antivirus software, and never had an issue. The only reason any Linux user might want one is to avoid passing on some virus that might be in an e-mail forwarded to a friend who uses Windows.

[Frogs Hair]

Whether I can get Avast for Lubuntu?

Avast doesn't support a free home version for Linux anymore AFIK. I too have never had any virus or malware on Linux nor have I infected Windows from Linux either.

[SeijiSensei]

2nd time (2002), I was running a 3 month unpatched service that didn't need to be on the internet, but was. Totally my fault. The service was BIND. Nothing bad happened after the hack. I had system backups ( just lucky ) and was able to see what had been modified on the system, nothing outside their hack and some scripts in /tmp/.../.hidden/..... Nothing was actually harmed on the server or the network.\

BIND supports running in a chrooted environment with the -t switch. It's easy to set up on RedHat-flavored systems. Never tried it with Ubuntu.