I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud vSphere environment but it looks like a solution at the hypervisor level would not be available anyway since those anti-malware vendors that do offer a hypervisor solution leverage the vShield Endpoint Thin Agent and it only supports Windows guests.
So for the most part this means running an agent on the Linux server/guest. Here the vendors (e.g. Trend Micro) will list supported kernel versions. The problem here is that the supported versions will be older kernels that have had Important Security Advisories issued by Red Hat and we don't want to address one security concern by potentially increasing our risk elsewhere.
We have deployed IPS as a mitigating measure and harden our servers as well as submit our application to third-party penetration testing but we are required to deploy an anti-virus solution.
Note that on-demand scanning is inadequate. We are looking for an enterprise solution that provides on-access scanning, isn't dependent on kernel versions and updates to all servers can be automated (via an administrative/management interface that preferably runs on Linux as well).
McAfee's VirusScan Enterprise for Linux on the face of it looks like it isn't dependent on kernel versions. Their datasheet states the following:
Kernel module versioning—On-access scanning on new kernels without the need to recompile modules saves you time and effort when rolling out new Linux kernels.
Runtime kernel module—Automatically supports the latest distribution, saving both time and effort. On-access scanning without kernel modules for kernels 2.6.38 with fanotify ensures Linux is always protected even after kernel updates.
But the latest version of McAfee's VirusScan Enterprise for Linux (2.0.0) doesn't even support RHEL!
What enterprise anti-virus solution doesn't support RHEL?!
What is a well-meaning sysadmin to do?