Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #206102 > unrolled thread

Group thoughts on: Anti-virus tools

Back to article view | Back to linux.debian.user

Contents

  Group thoughts on: Anti-virus tools deb <deb@rangingthoughts.org> - 2019-03-10 16:00 +0100
    Re: Group thoughts on: Anti-virus tools Sven Hartge <sven@svenhartge.de> - 2019-03-10 16:10 +0100
      Re: Group thoughts on: Anti-virus tools Paul Sutton <zleap@disroot.org> - 2019-03-11 12:00 +0100
        Re: Group thoughts on: Anti-virus tools Curt <curty@free.fr> - 2019-03-11 13:10 +0100
          RE: Group thoughts on: Anti-virus tools Michael Grant <mgrant@grant.org> - 2019-03-11 14:00 +0100
    Re: Group thoughts on: Anti-virus tools Reco <recoverym4n@enotuniq.net> - 2019-03-10 16:30 +0100
      Re: Group thoughts on: Anti-virus tools Richard Owlett <rowlett@cloud85.net> - 2019-03-10 16:40 +0100
        Re: Group thoughts on: Anti-virus tools Reco <recoverym4n@enotuniq.net> - 2019-03-10 17:40 +0100
          Re: Group thoughts on: Anti-virus tools Joe <joe@jretrading.com> - 2019-03-10 18:20 +0100
            Re: Group thoughts on: Anti-virus tools Stefan Monnier <monnier@iro.umontreal.ca> - 2019-03-10 19:50 +0100
            Re: Group thoughts on: Anti-virus tools mick crane <mick.crane@gmail.com> - 2019-03-10 20:50 +0100
              Re: Group thoughts on: Anti-virus tools Joe <joe@jretrading.com> - 2019-03-10 21:20 +0100
            Re: Group thoughts on: Anti-virus tools Reco <recoverym4n@enotuniq.net> - 2019-03-10 21:00 +0100
        Re: Group thoughts on: Anti-virus tools Curt <curty@free.fr> - 2019-03-10 17:40 +0100
          And now, from the Nice people? Re: Group thoughts on: Anti-virus  tools deb <deb@rangingthoughts.org> - 2019-03-10 18:20 +0100
            Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus  tools Felmon Davis <davisf@union.edu> - 2019-03-10 21:10 +0100
            Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus  tools Brian <ad44@cityscape.co.uk> - 2019-03-10 21:20 +0100
              Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus  tools Ric Moore <wayward4now@gmail.com> - 2019-03-12 05:20 +0100
            Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools deloptes <deloptes@gmail.com> - 2019-03-11 08:40 +0100
              Re: And now, from the Nice people? Re: Group thoughts on:  Anti-virus tools Curt <curty@free.fr> - 2019-03-11 09:30 +0100
                Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools deloptes <deloptes@gmail.com> - 2019-03-11 23:20 +0100
                  Re: And now, from the Nice people? Re: Group thoughts on:  Anti-virus tools Curt <curty@free.fr> - 2019-03-12 10:00 +0100
                    Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools deloptes <deloptes@gmail.com> - 2019-03-12 19:50 +0100
            Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools Stefan Monnier <monnier@iro.umontreal.ca> - 2019-03-11 13:40 +0100
              Re: And now, from the Nice people? Re: Group thoughts on:  Anti-virus tools Curt <curty@free.fr> - 2019-03-11 14:50 +0100
                Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools Stefan Monnier <monnier@iro.umontreal.ca> - 2019-03-11 16:50 +0100
                  Re: And now, from the Nice people? Re: Group thoughts on:  Anti-virus tools Joe <joe@jretrading.com> - 2019-03-11 19:20 +0100
    Re: Group thoughts on: Anti-virus tools Gene Heskett <gheskett@shentel.net> - 2019-03-10 16:40 +0100
    Re: Group thoughts on: Anti-virus tools Mart van de Wege <mvdwege@gmail.com> - 2019-03-10 19:00 +0100
      Thanks Mart -- Re: Mart -- [Solved] [Well, not solved,. but sickened  by] Re: Group thoughts on: Anti-virus tools deb <deb@rangingthoughts.org> - 2019-03-13 00:30 +0100
        Re: Thanks Mart -- Re: Mart -- [Solved] [Well, not solved,. but  sickened by] Re: Group thoughts on: Anti-virus tools Brian <ad44@cityscape.co.uk> - 2019-03-13 00:40 +0100
    Re: Group thoughts on: Anti-virus tools Stefan Monnier <monnier@iro.umontreal.ca> - 2019-03-10 19:50 +0100
    Re: Group thoughts on: Anti-virus tools deloptes <deloptes@gmail.com> - 2019-03-11 08:10 +0100
    Re: Group thoughts on: Anti-virus tools didier gaumet <didier.gaumet@gmail.com> - 2019-03-12 09:50 +0100
      Re: Group thoughts on: Anti-virus tools Alessandro Vesely <vesely@tana.it> - 2019-03-12 13:20 +0100
    Re: Group thoughts on: Anti-virus tools mick crane <mick.crane@gmail.com> - 2019-03-12 11:40 +0100

Page 1 of 2  [1] 2  Next page →

#206102 — Group thoughts on: Anti-virus tools

Starting assumption: I do want to run A/V.

  * I get that it may actually INCREASE attack surface.

  * But I have Windows & Mac stuff going back and forth to Debian 9.8 
and just want to check.

  * (Clamscan already caught 4 things)


a. What does the group suggest running on debian beyond

     - chkrootkit

     - rkhunter

     - ClamAV

b. Does the list keep a ~ "pinned" answer for these kinds of questions?


Thank you!

[toc] | [next] | [standalone]

#206103

deb <deb@rangingthoughts.org> wrote:

> a. What does the group suggest running on debian beyond

>     - chkrootkit

Useless.

>     - rkhunter

Crap, unmaintained.

Both tools produce more false positives than finding anything, just
creating a false sense of security while providing no security benefit
whatsoever.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#206146

On 10/03/2019 15:04, Sven Hartge wrote:
> deb <deb@rangingthoughts.org> wrote:
>
>> a. What does the group suggest running on debian beyond
>>     - chkrootkit
> Useless.
>
>>     - rkhunter
> Crap, unmaintained.
>
> Both tools produce more false positives than finding anything, just
> creating a false sense of security while providing no security benefit
> whatsoever.
>
> Grüße,
> Sven.
>

Not just a false sense of security, but for anyone who is new or
inexperienced a false positive creates extra worry as you are unsure if
it real or otherwise.  

Paul

-- 

Paul Sutton
http://www.zleap.net
https://www.linkedin.com/in/zleap/
gnupg : 7D6D B682 F351 8D08 1893  1E16 F086 5537 D066 302D

[toc] | [prev] | [next] | [standalone]

#206147

On 2019-03-11, Paul Sutton <zleap@disroot.org> wrote:
>
> On 10/03/2019 15:04, Sven Hartge wrote:
>> deb <deb@rangingthoughts.org> wrote:
>>
>>> a. What does the group suggest running on debian beyond
>>>     - chkrootkit
>> Useless.
>>
>>>     - rkhunter
>> Crap, unmaintained.
>>
>> Both tools produce more false positives than finding anything, just
>> creating a false sense of security while providing no security benefit
>> whatsoever.
>>
>> Grüße,
>> Sven.
>>
>
> Not just a false sense of security, but for anyone who is new or
> inexperienced a false positive creates extra worry as you are unsure if
> it real or otherwise.  

They actually create a false sense of insecurity, which is the basis of many
neuroses.

> Paul
>


-- 
“Let us again pretend that life is a solid substance, shaped like a globe,
which we turn about in our fingers. Let us pretend that we can make out a plain
and logical story, so that when one matter is despatched--love for instance--
we go on, in an orderly manner, to the next.” - Virginia Woolf, The Waves

[toc] | [prev] | [next] | [standalone]

#206150

[Multipart message — attachments visible in raw view] — view raw

I use clamav along with clamav-unofficial-sigs, Sanesecurity and Securiteinfo (which I pay for)

Secondly, I use “Bitdefender Security for Mail Servers – Linux”, again which I pay for.

I use clamav-milter and the bdmilterd to scan mail using clamav and Bit Defender.

I must say that it was pretty difficult to convince someone to actually sell me Bit Defender for Linux!  It’s like a totally hidden product of theirs, but it does work and is effective.

[toc] | [prev] | [next] | [standalone]

#206104

	Hi.

On Sun, Mar 10, 2019 at 10:58:12AM -0400, deb wrote:
> Starting assumption: I do want to run A/V.
>  * I get that it may actually INCREASE attack surface.
>  * But I have Windows & Mac stuff going back and forth to Debian 9.8 and just want to check.
>  * (Clamscan already caught 4 things)

Ok. If it's the poison you want - we'll pour you a cup.


> a. What does the group suggest running on debian beyond
>     - chkrootkit

Thing was good like 15 years ago. The thing is - the world has moved,
chrootkit stayed the same.
Save yourself CPU cycles and do not install the thing.


>     - rkhunter

It's primary purpose - i.e. rootkit detection is severely lacking.
The thing has its uses as IDS and 'best practices auditor toolkit', but
that's it.

But if it's the IDS you need - there are tripwire and debsums.


>     - ClamAV

Can catch a Windoze virus or two. The intended purpose of clamav is to
sit on e-mail relay and scan the mail, which is does fulfill.


> b. Does the list keep a ~ "pinned" answer for these kinds of questions?

Not that I'm aware of. The thing is - instead of taking an insecure OS
and building assorted kludges (in the form of anti-virus) around it,
it's considered wise here to use a secure OS from the beginning.

Reco

[toc] | [prev] | [next] | [standalone]

#206106

On 03/10/2019 10:20 AM, Reco wrote:
> 	Hi.
> 
> On Sun, Mar 10, 2019 at 10:58:12AM -0400, deb wrote:
>> Starting assumption: I do want to run A/V.
>>  [*SNIP*]
> 
>> b. Does the list keep a ~ "pinned" answer for these kinds of questions?
> 
> Not that I'm aware of. The thing is - instead of taking an insecure OS
> and building assorted kludges (in the form of anti-virus) around it,
> it's considered wise here to use a secure OS from the beginning.
> 

Recommended reading list applicable to Debian?

[toc] | [prev] | [next] | [standalone]

#206109

	Hi.

On Sun, Mar 10, 2019 at 04:32:42PM -0000, Curt wrote:
> On 2019-03-10, Richard Owlett <rowlett@cloud85.net> wrote:
> > On 03/10/2019 10:20 AM, Reco wrote:
> >> 	Hi.
> >> 
> >> On Sun, Mar 10, 2019 at 10:58:12AM -0400, deb wrote:
> >>> Starting assumption: I do want to run A/V.
> >>>  [*SNIP*]
> >> 
> >>> b. Does the list keep a ~ "pinned" answer for these kinds of questions?
> >> 
> >> Not that I'm aware of. The thing is - instead of taking an insecure OS
> >> and building assorted kludges (in the form of anti-virus) around it,
> >> it's considered wise here to use a secure OS from the beginning.
> >> 
> >
> > Recommended reading list applicable to Debian?
> >
> 
> I thought he was saying the surest approach is not touching Windows with
> a ten foot pole,

You're aiming too low. Not touching any non-free OS with a ten foot pole
would be much more like it.


> for which I doubt there's a list to read.

True.

Reco

[toc] | [prev] | [next] | [standalone]

#206115

On Sun, 10 Mar 2019 19:35:18 +0300
Reco <recoverym4n@enotuniq.net> wrote:

> 	Hi.
> 
> On Sun, Mar 10, 2019 at 04:32:42PM -0000, Curt wrote:
>
> > 
> > I thought he was saying the surest approach is not touching Windows
> > with a ten foot pole,  
> 
> You're aiming too low. Not touching any non-free OS with a ten foot
> pole would be much more like it.
> 
> 
While bearing in mind that 'free' doesn't mean 'problem-free'. 

Remember how many people audited the Heartbleed code before it was
released?

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#206120

> While bearing in mind that 'free' doesn't mean 'problem-free'.
> Remember how many people audited the Heartbleed code before it was
> released?

Indeed.  But it doesn't take more time to update openssl than to update
a virus scanner.


        Stefan

[toc] | [prev] | [next] | [standalone]

#206130

On 2019-03-10 17:13, Joe wrote:
> On Sun, 10 Mar 2019 19:35:18 +0300
> Reco <recoverym4n@enotuniq.net> wrote:
> 
>> 	Hi.
>> 
>> On Sun, Mar 10, 2019 at 04:32:42PM -0000, Curt wrote:
>> 
>> >
>> > I thought he was saying the surest approach is not touching Windows
>> > with a ten foot pole,
>> 
>> You're aiming too low. Not touching any non-free OS with a ten foot
>> pole would be much more like it.
>> 
>> 
> While bearing in mind that 'free' doesn't mean 'problem-free'.
> 
> Remember how many people audited the Heartbleed code before it was
> released?

didn't I read openSSL just had the one full time guy for thousands of 
lines of code ?

mick
-- 
Key ID    4BFEBB31

[toc] | [prev] | [next] | [standalone]

#206136

On Sun, 10 Mar 2019 19:46:42 +0000
mick crane <mick.crane@gmail.com> wrote:

> On 2019-03-10 17:13, Joe wrote:
> > On Sun, 10 Mar 2019 19:35:18 +0300
> > Reco <recoverym4n@enotuniq.net> wrote:
> >   
> >> 	Hi.
> >> 
> >> On Sun, Mar 10, 2019 at 04:32:42PM -0000, Curt wrote:
> >>   
> >> >
> >> > I thought he was saying the surest approach is not touching
> >> > Windows with a ten foot pole,  
> >> 
> >> You're aiming too low. Not touching any non-free OS with a ten foot
> >> pole would be much more like it.
> >> 
> >>   
> > While bearing in mind that 'free' doesn't mean 'problem-free'.
> > 
> > Remember how many people audited the Heartbleed code before it was
> > released?  
> 
> didn't I read openSSL just had the one full time guy for thousands of 
> lines of code ?

I believe only one person other than the writer audited the code, and
this was a piece of core open-source security code. While "given enough
eyeballs, all bugs are shallow", it is clear that code being open
source does not automatically deliver the eyeballs.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#206131

	Hi.

On Sun, Mar 10, 2019 at 05:13:35PM +0000, Joe wrote:
> On Sun, 10 Mar 2019 19:35:18 +0300
> Reco <recoverym4n@enotuniq.net> wrote:
> > On Sun, Mar 10, 2019 at 04:32:42PM -0000, Curt wrote:
> >
> > > 
> > > I thought he was saying the surest approach is not touching Windows
> > > with a ten foot pole,  
> > 
> > You're aiming too low. Not touching any non-free OS with a ten foot
> > pole would be much more like it.
> > 
> > 
> While bearing in mind that 'free' doesn't mean 'problem-free'. 
> 
> Remember how many people audited the Heartbleed code before it was
> released?

And that's why security is a process, not a state.
CVE-2014-0160 was fixed upstream days after the discovery, but it took
certain software vendors almost a year to fix openssl 'bundled' with
their 'software products'.

Reco

[toc] | [prev] | [next] | [standalone]

#206110

On 2019-03-10, Richard Owlett <rowlett@cloud85.net> wrote:
> On 03/10/2019 10:20 AM, Reco wrote:
>> 	Hi.
>> 
>> On Sun, Mar 10, 2019 at 10:58:12AM -0400, deb wrote:
>>> Starting assumption: I do want to run A/V.
>>>  [*SNIP*]
>> 
>>> b. Does the list keep a ~ "pinned" answer for these kinds of questions?
>> 
>> Not that I'm aware of. The thing is - instead of taking an insecure OS
>> and building assorted kludges (in the form of anti-virus) around it,
>> it's considered wise here to use a secure OS from the beginning.
>> 
>
> Recommended reading list applicable to Debian?
>

I thought he was saying the surest approach is not touching Windows with
a ten foot pole, for which I doubt there's a list to read.



-- 
“Let us again pretend that life is a solid substance, shaped like a globe,
which we turn about in our fingers. Let us pretend that we can make out a plain
and logical story, so that when one matter is despatched--love for instance--
we go on, in an orderly manner, to the next.” - Virginia Woolf, The Waves

[toc] | [prev] | [next] | [standalone]

#206114 — And now, from the Nice people? Re: Group thoughts on: Anti-virus tools

I posted a question A/Vs and got negative waves like the below.


Several people ASS-UMED I was trying to kludge Windows into Linux,
(see Canonical if you want to find Linux-folk sucking up to Windows)
instead of working to bring Linux into Windows strongholds (and
be aware of the problems there.)

Some just crushed my starting points, without alternatives.


N.I.C.E.


It is little wonder that Linux can not beat Windows on the desktop (as 
it should),

if this is how people are helped who are trying to Bring In Linux.


Crumogeon tip: It is no longer 1972.   If you have nothing nice or at 
least helpful to say on a  USER list, say nothing at all.

But you will anyways...


"assorted help"


Not that I'm aware of. The thing is - instead of taking an insecure OS
and building assorted kludges (in the form of anti-virus) around it,
it's considered wise here to use a secure OS from the beginning.

> I thought he was saying the surest approach is not touching Windows with
> a ten foot pole, for which I doubt there's a list to read.
>

[toc] | [prev] | [next] | [standalone]

#206133 — Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools

[Multipart message — attachments visible in raw view] — view raw

On Sun, 10 Mar 2019, deb wrote:

>
> I posted a question A/Vs and got negative waves like the below.
>
>
> Several people ASS-UMED I was trying to kludge Windows into Linux,
> (see Canonical if you want to find Linux-folk sucking up to Windows)
> instead of working to bring Linux into Windows strongholds (and
> be aware of the problems there.)
>
> Some just crushed my starting points, without alternatives.
>
>
> N.I.C.E.
>
>
> It is little wonder that Linux can not beat Windows on the desktop (as it 
> should),
>
> if this is how people are helped who are trying to Bring In Linux.
>
>
> Crumogeon tip: It is no longer 1972.   If you have nothing nice or at least 
> helpful to say on a  USER list, say nothing at all.

I haven't been able to follow the core of the discussion, partly 
because I don't know the technical issues and partly because I didn't 
quite understand your question but for a different perspective on 
'nice' I actually thought the responses you received were trying to be 
helpful; they were warning you against a certain approach to your 
issue (especially about using Windows or thinking AV is needed on 
Linux).

I think curmudgeons can put people off but I didn't think people were 
being curmudgeonly to you (or didn't intend to be) but instead 
critical of Windows or Windows-like approaches.

they were pressing the case one doesn't need AV on Linux as such, at 
least not if properly configured. this seems helpful.

>
> But you will anyways...
>
>
> "assorted help"
>
>
> Not that I'm aware of. The thing is - instead of taking an insecure OS
> and building assorted kludges (in the form of anti-virus) around it,
> it's considered wise here to use a secure OS from the beginning.
>
>> I thought he was saying the surest approach is not touching Windows with
>> a ten foot pole, for which I doubt there's a list to read.

this seems to support my interpretation.

f.

-- 
Felmon Davis

[toc] | [prev] | [next] | [standalone]

#206134 — Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools

On Sun 10 Mar 2019 at 13:18:54 -0400, deb wrote:

> I posted a question A/Vs and got negative waves like the below.

It only looks "negative" because you have an agenda. I myself thought
the responses were reasonable and balanced.

> Several people ASS-UMED I was trying to kludge Windows into Linux,
> (see Canonical if you want to find Linux-folk sucking up to Windows)
> instead of working to bring Linux into Windows strongholds (and
> be aware of the problems there.)

Knocking Canonical (who produce a premier Linux distribution) doesn't
advance your argument; it is unclear what that is.
 
> Some just crushed my starting points, without alternatives.
> 
> 
> N.I.C.E.

Your argument (for what it was) was demolished. Explicit alternatives to
it are unnecessary when it hasn't a leg to stand on.

> It is little wonder that Linux can not beat Windows on the desktop (as it
> should),

Is that part of the agenda?

> if this is how people are helped who are trying to Bring In Linux.

Or is this the nub? The Lone Ranger syndrome.

> Crumogeon tip: It is no longer 1972.   If you have nothing nice or at least
> helpful to say on a  USER list, say nothing at all.

All the responses were helpful. You just have to fit them into your
World View and accomodate them

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#206180 — Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools

On 3/10/19 3:53 PM, Brian wrote:
> On Sun 10 Mar 2019 at 13:18:54 -0400, deb wrote:

>> Crumogeon tip: It is no longer 1972.   If you have nothing nice or at least
>> helpful to say on a  USER list, say nothing at all.
> 
> All the responses were helpful. You just have to fit them into your
> World View and accomodate them


Thanks Brian for introducing some sanity to the issue. Ric

[toc] | [prev] | [next] | [standalone]

#206143 — Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools

deb wrote:

> Not that I'm aware of. The thing is - instead of taking an insecure OS
> and building assorted kludges (in the form of anti-virus) around it,
> it's considered wise here to use a secure OS from the beginning.

If you have windows users in your network, the best is to pay for a server
license for linux and integrate it into clamav. I think most of the popular
anti virus software companies have their products running on linux and able
to integrate in clamav. You have to pay but it pays off, if you have
employes or simply people using windows in your network.

The security of course is not only the antivirus, but also the firewall, VPN
and similar - 1. reduce the risk of intrusion and 2. increase the chance of
detection. Anti virus software is only part of it all.

regards

[toc] | [prev] | [next] | [standalone]

#206145 — Re: And now, from the Nice people? Re: Group thoughts on: Anti-virus tools

On 2019-03-11, deloptes <deloptes@gmail.com> wrote:
> deb wrote:

I don't believe he did, actually. I believe that's what Reco wrote.

>> Not that I'm aware of. The thing is - instead of taking an insecure OS
>> and building assorted kludges (in the form of anti-virus) around it,
>> it's considered wise here to use a secure OS from the beginning.
>
> If you have windows users in your network, the best is to pay for a server
> license for linux and integrate it into clamav. I think most of the popular
> anti virus software companies have their products running on linux and able
> to integrate in clamav. You have to pay but it pays off, if you have
> employes or simply people using windows in your network.
>
> The security of course is not only the antivirus, but also the firewall, VPN
> and similar - 1. reduce the risk of intrusion and 2. increase the chance of
> detection. Anti virus software is only part of it all.
>
> regards
>
>


-- 
“Let us again pretend that life is a solid substance, shaped like a globe,
which we turn about in our fingers. Let us pretend that we can make out a plain
and logical story, so that when one matter is despatched--love for instance--
we go on, in an orderly manner, to the next.” - Virginia Woolf, The Waves

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web