I want to upload .jpg images to my Linux server so that clients can re-download the files when they want. Supposing unknowingly there is a trojan, worm or malware in my computer, will these be uploaded and infect the client's computer ? how can this be prevented. where in the server should i check for any malicious programs.
Best way to secure your uploaded files is to keep them out of the home directory of website. If you can't keep them out of home dir of website .Try to make the folder where images are stored as secured either via password, or giving the permissions as no-one , so that the folder cant be accessed via http.
if you think there is virus in there, it cant infect unless its executed or if its backdoor.You can install kaspersky antivirus on linux server as thats the best i can suggest it really scans all the files and folders.
What i suggest is if you want to keep your website from being hacked. use .htaccess in folder where you have kept the files and this works if you have apache and running php.
What you do is , to stop php engine in the directory of uploads so that php shell cant be executed no matter what happens. Or through .htaccess file you can create 500 internal server error in uploaded files directory. so no matter what is in the folder it doesn't effect. And still your files can be read through php and this way, everything works , fine.
There are many vulnerability scanner , that can be used to check if your server is infected, and through ssh you can ensure that all the processes running are genuine, but hey you need to ensure security aspect before running that type of website
If you can, code a virus check into the file-upload handler. As in, when your HTTP posted file is received, scan it with an AV before making it available to your end users. If it fails the AV check, bin it off.
You should regularly update the AVDB and periodically schedule re-checking of these files, just in case there is a new trojan that wasn't in the signatures when it was first uploaded.
Of course, if you are really worried, you could pipe the file through
If performance is a factor, you might prefer to stream the file to a staging/ directory and end the HTTP request with an
As an aside, I would use a separate domain name to host user-uploaded data (and configure it so that the site should not be scanned by bots with
It is possible that an advanced piece of malware on your desktop machine could detect the presence of an open SSH session, and use it to infect the server.
From there the malware could insert browser exploits into your web documents on the server and in turn, infect other clients that visit your web pages.
So yes, your scenario is possible, but we are talking about a fairly advanced and aggressive malware here, but it could happen.
The other answers have covered steps that you can follow, I would just add that you should avoid logging into your server as root. However any user that has write access to the web root could potentially be used to subvert the webserver and infect client browsers.
But you can't, unfortunately, be 100% sure.
Another option is that, before uploading your jpeg, you upload it to virustotal and see what that gives. If it says one of your files is infected please jump to step 1.