Enterprise Anti-virus for Linux?

Question

I know this question is probably at risk of offending the guidelines but our IaaS provider was unable to offer us an anti-virus solution for our Linux servers. We are deployed in an enterprise cloud vSphere environment but it looks like a solution at the hypervisor level would not be available anyway since those anti-malware vendors that do offer a hypervisor solution leverage the vShield Endpoint Thin Agent and it only supports Windows guests.

So for the most part this means running an agent on the Linux server/guest. Here the vendors (e.g. Trend Micro) will list supported kernel versions. The problem here is that the supported versions will be older kernels that have had Important Security Advisories issued by Red Hat and we don't want to address one security concern by potentially increasing our risk elsewhere.

We have deployed IPS as a mitigating measure and harden our servers as well as submit our application to third-party penetration testing but we are required to deploy an anti-virus solution.

Note that on-demand scanning is inadequate. We are looking for an enterprise solution that provides on-access scanning, isn't dependent on kernel versions and updates to all servers can be automated (via an administrative/management interface that preferably runs on Linux as well).

McAfee's VirusScan Enterprise for Linux on the face of it looks like it isn't dependent on kernel versions. Their datasheet states the following:

Kernel module versioning—On-access scanning on new kernels without the need to recompile modules saves you time and effort when rolling out new Linux kernels.

and:

Runtime kernel module—Automatically supports the latest distribution, saving both time and effort. On-access scanning without kernel modules for kernels 2.6.38 with fanotify ensures Linux is always protected even after kernel updates.

But the latest version of McAfee's VirusScan Enterprise for Linux (2.0.0) doesn't even support RHEL!

What enterprise anti-virus solution doesn't support RHEL?!

What is a well-meaning sysadmin to do?

Answer 1

I've already answered this question a few times here. Have a look at this answer in particular:

Virus scanner on server

And in particular this part:

The concept of a virus implies a user at an interactive session. Someone opening email in Outlook or documents in Word, or running programs they received in an email. A virus implies a human element. Servers don't (or shouldn't) allow reading emails and browsing websites. Instead, attacks against servers are fully automated; no human required. They call that a "worm" rather than a "virus".

Worms are a concern on Linux. But protecting your server from that type of threat works differently. Protecting users from viruses requires something stopping users from doing things they shouldn't. Hence the "anti-virus". But protecting servers from worms and similar exploits involves fixing vulnerable software. If something is exploitable on your server, then the thing needs to be fixed.

A virus scanner watches files to see if they will hurt you if you run them. That's not a concern on servers because the only programs you're ever going to run are already there. As a rule, you're not downloading and running new programs on servers the way you do on desktops.

Assuming Linux is running as a server, (which RHEL pretty much always is) Running an anti-virus is the wrong kind of protection. It protects you against threats that can't hurt you, while ignoring the threats that can. This is why RHEL doesn't offer antivirus integration. Because Redhat understands server security.

This has nothing to do with how popular Linux is or whether virus writers will target it, as commonly argued. This has to do with how the server is used. There is no user browsing email in Outlook, or download flash movies and running them. So preventing dangerous user activity is not a valuable solution.

If your QSA is demanding you run an anti-virus on your Linux server, then you need a different QSA. This one hasn't a clue.