It actually bothers me that I have to spend Enterprise levels of money to get access to any type of Linux endpoint security a la Bitdefender Gravityzone.
I get it, “they don’t make viruses for linux” or some nonsense. When a massive number of corporate servers run Linux, I think it’s fair to say that’s a target surface for people to develop attacks that can include viruses. I’m just over this idea that we’re safe by default or something. You’re not really safe unless you make your own personal computer use a giant pain in the ass of security steps just to access basics, anyway.
Anywhodles, anyone got the deets on some actual quality Linux virus/worm/malware protection beyond stuff like security hardening, key authorization, firewalls, dns blackholing for ads, and everything else I already have and set up beyond “virus protection.” My servers may not be important, but they’re still servers I’d rather not go through the pain of rebuilding.
Honestly…as far as I’m concerned, for linux servers (any servers, but linux servers especially), there isn’t much value in a traditional AV client that runs on the server itself.
Viruses and malware come from people downloading crap and going to shady websites. People shouldn’t do that on servers, and it should be blocked anyway by web filters.
Honestly if a linux server even has a web browser and xorg/wayland installed, you already fucked up. I’d allow lynx in niche circumstances.
There should be security layers long before anybody gets to the linux server…namely IPS’s and firewalls.
Most enterprise firewalls have a way to block known-baddies on their first SYN. There are probably several community-driven blocklists that can be imported to other firewalls, or even directly into the host-based firewall (which should also be running, along with SELinux or AppArmor or whatever)
The real threats with linux servers are:
lateral spread
compromised accounts, poor privileged account management, or insider threat
exploited vulnerability, which is most likely the entrypoint.
Keep SELinux/AppArmor up, manage permissions properly, have webfilters, IPS, L4 Firewall, WAF (if appropriate) in-line, and have an automated patching strategy. AV software does none of this (and would probably ask you to disable SELinux as step 1 in troubleshooting…)
Oh, yeah, and run applications in unprivileged containers wherever possible.
IOW, the solution is good cyber hygiene. At the server admin level, the biggest concern should be managing RBAC and patches.
I only wish I had a spare device with specs good enough to properly run Snort. Having an IPS isn’t always an option, sadly, for people doing this at home.
I was fortunate to build a homelab right before the market went crazy. I invested heavily into 7th/8th gen intel and DDR4.
I’m actually about to part out my lab – I just sidegraded my CPU from 5700G to 5600X3D…so I’m gonna put the 5700G to the task of ‘all my eggs in one basket’.
But my current lab consists of:
Lenovo M710s for OPNsense
2x Lenovo M710s and 1x Ryzen 5825U uSFF in a kubernetes cluster (used to be 3x M710s, but I put the 5825U in there for the vega transcoding)
A NAS (i7-6700, all the DDR3 I could fit on the board, LSI controller, some disks, etc)
I’m hoping to put all that into the 5700G, and squeeze in my old RX570 for a VM responsible for Jellyfin, but I’ll have it boot to retroarch and set up sunshine on it, so it’ll basically just be a persistent gaming VM like an always-on console. That way I can play practically any console, on any device in my house. Or PC game somewhat decently from my laptops.
It’s in the fun stages now of homelabbing…gear is fucking expensive, what can I do with what I’ve already got (especially w/r/t gpus, memory, and storage).
I’ve got some M910q’s I gotta find a use for. I’m thinking HTPC (as part of de-googling my life and getting rid of my Google TV’s), but I need to find a good 10-foot, controller/remote driven interface that isn’t Kodi. It looks like Plasma Bigscreen is out now, I’ll need to check that out.
Second, the thing about viruses (as opposed to other types of exploits) is that the user has to run them, and Linux doesn’t make downloaded files executable by default the way Windows does. Nor are Linux users conditioned to download programs from random sketchy sources the way Windows users do.
Nor are Linux users conditioned to download programs from random sketchy sources the way Windows users do.
I think about this every time install instructions for something are “run this terminal command to add our repo to your sources”. Would probably be pretty easy to get an auto-updating attack path for the unsuspecting. The first drop doesn’t even need to be malicious, just ship the virus as an update.
Yeah, if you’re doing some sort of curl | sh nonsense you’d better trust whoever is supplying that script implicitly. On the bright side, I’ve only ever seen that on the first-party website of the project being installed, so it could be worse.
I think about this every time install instructions for something are “run this terminal command to add our repo to your sources”.
Or when there’s an installation option that’s just piping curl/wget into bash, like
curl -sSL https://install.pi-hole.net/ | bash
It’s super convenient! But risky. Even if the fetched script is legit, the command is still one typo’d URL away from fetching and executing something entirely different (imagine squatters sitting on install.pi-hole.com instead of .net and serving a malicious script)
I appreciated that pi-hole was (and still is) transparent about the drawbacks of this installation method when I installed it years ago.
I think the biggest risk now is supply chain poisoning, where a system update or package installation runs executable code alongside it that can be malicious, as most supply chains for Linux distros don’t have automatic security checks in place but rather rely on the security of the identity of the package maintainer. If their setup gets compromised that’s the bigger risk rather than the traditional “virus” like you said
I don’t think people are saying there’s literally no viruses for Linux, just that because Linux desktop use is so low, malware developers l developers focus on Windows because that’s what most end users will be trying to run their software on.
It’s not a secret that lots of Enterprise systems run Linux. Almost all switching and routing operating systems that run the entire internet are Linux based. But there isn’t a person using those. They get configured and then run without user interaction. So their attack surface is different.
That’s what people mean when they say there’s no real malware for Linux.
Most “virus” infections this day are just programs that look legit and trick people into installing them. You’re not going to get a Linux server that way.
I think the day there’s a widespread apt or pacman hidden malware ala npm will be a watershed moment for the Linux community. A lot of people don’t even have clamav installed
I’m worried even some random package like fastfetch getting compromised. I never installed that, it came with CachyOS, and it’s an “official package”. Does anyone actually check all 70+ packages that update per week? I dunno, it gives me the same uneasy feeling when I first was introduced to NPM
Well, there’s a difference between that and NPM, which is that there are some manual steps involved. There’s no standard way to “push an update to every distribution in existence”, you just put out a sign somewhere saying “hey, new release” then everyone has to look at it and package it in whichever way they feel appropriate, oftentimes to a “testing” space first before the “regular” one. Some random Gentoo user who rebuilt just same day would notice way before Alpine stable people, for example.
Even Jia Tan wasn’t too successful, their backdoor only functioned when in a small set of distributions (Debian…) and yet got noticed almost right away.
The only major malware that isn’t for the big 4 right now are:
ones that are preinstalled in IoT and “smart” devices
targeting said devices with remote holes (ironically sometimes made available by the preinstalled malware)
Yea, I’ve got the same issue, i couldnt really find anything either so ive just been using portmaster and hopping that’ll catch the virus if i ever get one.
It actually bothers me that I have to spend Enterprise levels of money to get access to any type of Linux endpoint security a la Bitdefender Gravityzone.
I get it, “they don’t make viruses for linux” or some nonsense. When a massive number of corporate servers run Linux, I think it’s fair to say that’s a target surface for people to develop attacks that can include viruses. I’m just over this idea that we’re safe by default or something. You’re not really safe unless you make your own personal computer use a giant pain in the ass of security steps just to access basics, anyway.
Anywhodles, anyone got the deets on some actual quality Linux virus/worm/malware protection beyond stuff like security hardening, key authorization, firewalls, dns blackholing for ads, and everything else I already have and set up beyond “virus protection.” My servers may not be important, but they’re still servers I’d rather not go through the pain of rebuilding.
Honestly…as far as I’m concerned, for linux servers (any servers, but linux servers especially), there isn’t much value in a traditional AV client that runs on the server itself.
Viruses and malware come from people downloading crap and going to shady websites. People shouldn’t do that on servers, and it should be blocked anyway by web filters.
Honestly if a linux server even has a web browser and xorg/wayland installed, you already fucked up. I’d allow lynx in niche circumstances.
There should be security layers long before anybody gets to the linux server…namely IPS’s and firewalls.
Most enterprise firewalls have a way to block known-baddies on their first SYN. There are probably several community-driven blocklists that can be imported to other firewalls, or even directly into the host-based firewall (which should also be running, along with SELinux or AppArmor or whatever)
The real threats with linux servers are:
Keep SELinux/AppArmor up, manage permissions properly, have webfilters, IPS, L4 Firewall, WAF (if appropriate) in-line, and have an automated patching strategy. AV software does none of this (and would probably ask you to disable SELinux as step 1 in troubleshooting…)
Oh, yeah, and run applications in unprivileged containers wherever possible.
IOW, the solution is good cyber hygiene. At the server admin level, the biggest concern should be managing RBAC and patches.
I only wish I had a spare device with specs good enough to properly run Snort. Having an IPS isn’t always an option, sadly, for people doing this at home.
I was fortunate to build a homelab right before the market went crazy. I invested heavily into 7th/8th gen intel and DDR4.
I’m actually about to part out my lab – I just sidegraded my CPU from 5700G to 5600X3D…so I’m gonna put the 5700G to the task of ‘all my eggs in one basket’.
But my current lab consists of:
I’m hoping to put all that into the 5700G, and squeeze in my old RX570 for a VM responsible for Jellyfin, but I’ll have it boot to retroarch and set up sunshine on it, so it’ll basically just be a persistent gaming VM like an always-on console. That way I can play practically any console, on any device in my house. Or PC game somewhat decently from my laptops.
It’s in the fun stages now of homelabbing…gear is fucking expensive, what can I do with what I’ve already got (especially w/r/t gpus, memory, and storage).
I’ve got some M910q’s I gotta find a use for. I’m thinking HTPC (as part of de-googling my life and getting rid of my Google TV’s), but I need to find a good 10-foot, controller/remote driven interface that isn’t Kodi. It looks like Plasma Bigscreen is out now, I’ll need to check that out.
First of all, username checks out.
Second, the thing about viruses (as opposed to other types of exploits) is that the user has to run them, and Linux doesn’t make downloaded files executable by default the way Windows does. Nor are Linux users conditioned to download programs from random sketchy sources the way Windows users do.
I think about this every time install instructions for something are “run this terminal command to add our repo to your sources”. Would probably be pretty easy to get an auto-updating attack path for the unsuspecting. The first drop doesn’t even need to be malicious, just ship the virus as an update.
Yeah, if you’re doing some sort of
curl | shnonsense you’d better trust whoever is supplying that script implicitly. On the bright side, I’ve only ever seen that on the first-party website of the project being installed, so it could be worse.Or when there’s an installation option that’s just piping curl/wget into bash, like
curl -sSL https://install.pi-hole.net/ | bashIt’s super convenient! But risky. Even if the fetched script is legit, the command is still one typo’d URL away from fetching and executing something entirely different (imagine squatters sitting on install.pi-hole.com instead of .net and serving a malicious script)
I appreciated that pi-hole was (and still is) transparent about the drawbacks of this installation method when I installed it years ago.
I think the biggest risk now is supply chain poisoning, where a system update or package installation runs executable code alongside it that can be malicious, as most supply chains for Linux distros don’t have automatic security checks in place but rather rely on the security of the identity of the package maintainer. If their setup gets compromised that’s the bigger risk rather than the traditional “virus” like you said
I don’t think people are saying there’s literally no viruses for Linux, just that because Linux desktop use is so low, malware developers l developers focus on Windows because that’s what most end users will be trying to run their software on.
It’s not a secret that lots of Enterprise systems run Linux. Almost all switching and routing operating systems that run the entire internet are Linux based. But there isn’t a person using those. They get configured and then run without user interaction. So their attack surface is different.
That’s what people mean when they say there’s no real malware for Linux.
Most “virus” infections this day are just programs that look legit and trick people into installing them. You’re not going to get a Linux server that way.
Also people using Linux are some kind of brain and understanding of computers. Not necessarily the case on windows.
No, the ones who say this kind of stuff are literally believing that there is no malware on Linux, and there is precedence for it.
Something something history is doomed to repeat itself.
I think the day there’s a widespread apt or pacman hidden malware ala npm will be a watershed moment for the Linux community. A lot of people don’t even have clamav installed
You mean like all the recent exploits on the AUR? It’s already happening. Digital hygiene is a responsibility that many don’t take seriously.
Well, time to switch to BSD /s
I’m worried even some random package like
fastfetchgetting compromised. I never installed that, it came with CachyOS, and it’s an “official package”. Does anyone actually check all 70+ packages that update per week? I dunno, it gives me the same uneasy feeling when I first was introduced to NPMWell, there’s a difference between that and NPM, which is that there are some manual steps involved. There’s no standard way to “push an update to every distribution in existence”, you just put out a sign somewhere saying “hey, new release” then everyone has to look at it and package it in whichever way they feel appropriate, oftentimes to a “testing” space first before the “regular” one. Some random Gentoo user who rebuilt just same day would notice way before Alpine stable people, for example.
Even Jia Tan wasn’t too successful, their backdoor only functioned when in a small set of distributions (Debian…) and yet got noticed almost right away.
The only major malware that isn’t for the big 4 right now are:
Remember, kids: don’t do security by obscurity
Yeah for sure. AI has made that even more redundant now by removing the effort barriers also.
I know a corporation that runs on that premise, and it worked great up until they added modern frontends as “translator” to modernize the system.
You made me smile
Yea, I’ve got the same issue, i couldnt really find anything either so ive just been using portmaster and hopping that’ll catch the virus if i ever get one.