I’m about to install bazzite on my wife’s older (2017) Windows 10 machine, and I’ve been going over how to recreate everything she currently has. Most programs (even proprietary ones) are not an issue, but I’m not finding much in the antivirus department.
I never even thought to install one on my Linux machine (also on bazzite, but I have used other distros in the past). So although I am no stranger to Linux, this issue blindsided me.
I know clamav exists, and I’m educating myself on how to use it, but a GUI would be nice for the wife. She’s not afraid of the terminal, but she likes the convenience of GUI programs.
Any suggestions? What do you use? Or is it just generally accepted that one should be careful and keep things up-to-date and that’s enough?
I like to consider myself part of the exclusive and oh so elite club of linux users. everyone here saying that AV is not needed, because the best security is not to be stupid, is right. but is your grandma tech literate enough to not do stupid things on her computer? your teenage son?
as the linux user base grows, the platform becomes more interesting of a target. even for stupid attacks. and lets be honnest: lots of legitimate open source projects still use an install script to curl and pipe into the terminal as a suggested method to install. which is just horrible!
while an anti malware is a patch. it is the last line of defense after a stupid mistake. so it would be great to have an actual desktop AV for linux. eset used to sell one but it is long out of service.
i use clamAV. but i maintain it for the family, so it is not as simple as telling them exactly what to install and run with default configs.
anyway, for those interested: here are two videos of malware attacks against lunux in rather different fashions:
I’m not sure you really need an anti virus with Bazzite? Because it is immutable and has rolling releases it’s generally pretty up to date and secure
If you were running a more traditional distro it might be more of a requirement
The best Linux antivirus is a healthy dose of
dontclickshit.bin.She’s not afraid of the terminal, but she likes the convenience of GUI programs.
Your wife appears to have the same preferences as I do. I don’t mind using the terminal (I usually have one open any time I’m using my laptop or PC), but some things are far simpler in a GUI.
Bahahahaha
You might have issues trying to install clamav on Bazzite as it is an immutable distro
Antiviruses are rarely used, I wouldn’t install them on a newish distro for a non-tech user. It sounds like it may cause more issues than it will intercept
Linux viruses for desktop computers are so rare, they’re pretty much unheard of in practice. And that’s why virus scanners aren’t really a thing on regular computers. What we do is protect servers against malware and rootkits. And the Linux mailserver or fileserver will run a virus scan before forwarding the mails to the employee’s Windows computers. That’s why ClamAV doesn’t come with a GUI because it’s supposed to run in the background on your mailserver or NAS, not on your computer…
I’d recommend a virus scanner if you run Windows games and software (via Wine/Proton/Steam). Especially if they’re not from Steam but (pirated from) random places of the internet. If you run Linux software, ideally from the package repository, there’s little to no benefit in installing antivirus due to the lack of viruses.
Pay attention to security though. There’s a lot of other nefarious stuff out there. Password brute forcing, phishing, regular fraud, attacks if you don’t do updates, a harddisk might fail…
This.
You install a virus scanner on your smb fileshare or your mail server, for instance, and pipe attachments through it to protect windows boxes. That’s the only sensible use.
Yet, idiots make policies like “all servers must have AV installed for safety” and thus some shit app sucks down all the CPU time and scans memory (ohai PCI compliance) just because the CTO doesn’t know what ‘less’ does.
Can you share more about virus scanner for Windows stuff?
Is there one that can run completely locally? Or do they usually need to upload the file/signature online?
Usually how regular virus scanners work, they download a package with virus signatures every day or so and match the files against that local copy of the database. Unless you decide to use a service like virustotal… Sorry, I’m a bit of the wrong person to answer this question. I’ve been using Linux for the last 20 years or so. That means last antivirus I installed was about that long ago… I just hope Steam scans their game catalog, seems they do and that is my only source of Windows executables. So I’m fine on my private computers. And for work I’d just use whatever is provided to me.
Yeah, that’s out of date. While AV still uses file signatures, the modern stuff is behavioral. If you have a file whose instructions use undocumented or low-level APIs, it can look like an exploit and the AV flags it. Endpoint protection products like Sentinelone also take the role of endpoint firewall, managing access to network resources, not just the OS, disk, etc. So if you start sending encrypted requests through uncommon APIs to a cloud server in China, it’s gonna get you blocked.
for ease of mind just install clamtk but clamav pretty much runs automagically without intervention.
ClamAV is probably the way to go. While there are UIs available in various states of maintenance, it’s not really necessary. The way ClamAV works is that runs a scan on daemon (re)start then continually monitors the system from there. One of it’s best features is that you don’t really need to worry about it.
Thanks! I wasn’t aware that it was such a fire-and - forget software.
I believe Kaspersky has just released a commercial solution for desktop Linux. Kaspersky is a whole other can of worms, however seeing as they’re russians but that’s your call
Kaspersky isn’t there to protect us; just to fill a niche and create business for itself. Idiot nepo CTOs who don’t know better can be coerced to sign a fud-based invoice and then they make bank.
An antivirus is mostly unnecessary when care is taken to not install or use untrusted software. If you install everything as a Flatpak (and modify some of the default permissions), you can avoid allowing software to gain much access to her computer.
While I think people suggesting Linux is immune to malware is stupid, for reasons such as it is “too secure” or “too niche” to be effected by malware, anti malware is like a bandaid to a gaping wound. If you have malware, it is already too late and you should first unplug the device from the network and any connected devices, backup any important data, and fresh reinstall by overwriting the infected install.
If you still think you need some way to defend against malware, use the VirusTotal website, or a native Flatpak called Lenspect, to upload and scan files (such as an executable binary). Lenspect requires no permissions other than network access, so it is safe and the only risk is if you input a file containing personal data it will be uploaded to VirusTotal.
Though to stress again, antivirus is a bandaid! The real solution is to be smart about what you install and only take stuff from trusted sources. Try to make sure everything is a Flatpak and avoid apps with excessive permissions, which weaken the security of the sandbox.
I think there’s a few aspects to this whole subject.
First of all for a long time people have thought Linux not to be the target of malware. I would say that it has been a target and it has been for decades. I recall in the late 90s a Linux server at work was attacked, had a rootkit, IRC trojan and attack kit installed by script kiddies in Brazil. I think the nearest you can say is that desktop users aren’t usually a target, which is mostly true. But with the share of desktop installs hitting a high recently we should expect that to change.
Second I think most windows antivirus products (including the built in one) are doing some active useful things. Most of these are not relevant on Linux (we generally don’t run setup.exe from random websites). However! Here’s where things get interesting. The rise of flatpak and other containerised applications. These I would say are very similar to setup.exe, and would make it trivial to embed malware into such a file. A Linux virus scanner could be checking these. Also we’ve seen direct attacks on distro repositories lately. I don’t expect this to slow down. We are most certainly a target now.
Third, the other reason most Linux users don’t use virus scanners is because they’re usually technical people who would recognise (usually) something wrong and investigate/spot the malware. I would say two things are changing here. Simpler to install distros are bringing in less technical people to Linux and, the number of processes running on a machine doing effectively nothing in a desktop environment is way higher than it used to be. So technical people can be caught off guard. Also, a rootkit can hide all of these clues if done well.
So I would say there’s a really good space to have a well made virus scanner/antivirus now. It is probably the right time for it.
we generally don’t run setup.exe from random websites
We do run .deb/.rpm files from random websites though. And you mentioned flatpak too. Appimage is quite popular too, and afaik that doesn’t have any built-in sandboxing at all.
We do run .deb/.rpm files from random websites though.
In general with Linux sites with deb/rpm/etc files would usually include hashes for the genuine versions etc. Not to say the actual author of these could be malicious.
And you mentioned flatpak too. Appimage is quite popular too, and afaik that doesn’t have any built-in sandboxing at all.
Even with sandboxing, they generally need access to save files/load files etc from the host environment. Where are these connections defined? Could a malicious actor for example grant their malicious appimage/flatpak more access? Genuine questions, I’ve never looked into how these work.
AppImages have no sandboxing as you said. They also rely on the deprecated SUID-root binary FUSE2. AppImages are bad for security but they are convenient. A malicious AppImage could for example connect to org.freedesktop.secrets and access your keychain, or run a script that places a script called “sudo” in $HOME/.local/share/bin that is preferred over the real sudo and logs a password, or encrypt your files in a ransomware attack, or exfiltrate your session cookies from Firefox or Chromium browsers.
Flatpaks on the other hand are sandboxed. IIRC Flatpaks can’t access other Flaptak’s data folders in $HOME/.var/app (maybe even if home access is given?), but if given access to the “home” permission they can read and write to anywhere else in the user home, so stealing session cookies from a browser or ransomware could still be possible given the right permission. Modern apps that are designed to work as Flatpaks can use the xdg-desktop-portal to access only specific files/dirs upon user request, but it is only temporary access to a file. All the ways a Flatpak can access the system are defined by its permissions, so by giving more/dangerous permissions (such as devices or full filesystem access) a malicious app can possibly escape the sandbox and access arbitrary permissions. The worst permission an app can have is access to session bus for org.freedesktop.Flatpak, which allows it to arbitrary permissions, host command execution, and access to Flatpak configuration.
There is more to xdg-desktop-portal than I said, it is quite powerful.
https://wiki.archlinux.org/title/XDG_Desktop_Portal
https://flatpak.github.io/xdg-desktop-portal/docs/
This Flatpak shows the power of portals on your system, while also requiring no permissions at all: https://flathub.org/en/apps/com.belmoussaoui.ashpd.demo
Same with this one, but it requires arbitrary permissions: https://flathub.org/en/apps/xyz.tytanium.DoorKnocker
In general with Linux sites with deb/rpm/etc files would usually include hashes for the genuine versions etc. Not to say the actual author of these could be malicious.
Imho, these hashes are hardly a security feature. If a malicious actor can control the file that you download, they likely can also control the hash.
Even with sandboxing, they generally need access to save files/load files etc from the host environment. Where are these connections defined? Could a malicious actor for example grant their malicious appimage/flatpak more access? Genuine questions, I’ve never looked into how these work.
Good question. I hope there’s some form of security present, but I really don’t know.
But in the end, the most valuable stuff on a computer is user data anyway. Who needs root on a machine, if the attacker can also encrypt all your personal files?
deleted by creator
Guarantee my fifteen year old would run a random curl with sudo if it purported to install Sims mods. And one might say, “then don’t give her sudo,” but you have no idea how often I’d have to run to the basement to type in a password onto her computer, if it’s anything like Windows. (Haven’t moved her to Linux yet, but it’s coming.)
We definitely cannot rely on the technical savvy of Linux users any more. At least, I can’t.
but you have no idea how often I’d have to run to the basement to type in a password onto her computer,
For what it’s worth: It’s possible to configure
sudoin a way that allows users to execute specific commands without having to grant full, unrestricted access. That’s whatsudois for.I haven’t progressed my learning that far. I’ll look into it further, thanks!
I haven’t done it myself, I just know it’s possible 😅
To be more clear, antivirus in general are mostly scams because they are advertised to do much more than they are actually capable (especially proprietary ones that act as spyware such as Norton or Avast, which have been caught selling user data). Hash based antivirus solutions (such as ClamAV) aren’t effective either because they rely on “badness enumeration”, in which you try to determine all the bad samples (through a sample list(s)) and alert or delete them when detected. This isn’t a good solution because a threat actor only has to add for example a single whitespace character into the code and it will produce a wildly different hash (which has not been sampled before). Badness enumeration is shit way to deal with real problems, much better is an allowlist approach, such as a permission system where to minimize the access given and soften the security until the app runs.
TLDR: Antivirus bad at job of stopping malware, and sandboxed apps good for security of your device.
I agree with your demonstration, but not the conclusion. The main threat in OP case is random attack made by massive and standardize attack. So hashed signature are better than nothing. Of course it is not enough for all kind of attack, like a focus one
I’m not sure where you get the idea that antivirus is mostly a scam. Yes, there are some questionable vendors out there, but it doesn’t mean it’s a scam. I know antivirus has saved my ass a couple of times, at least when I was younger. Was I doing something stupid? Yes. Do we all do something stupid every once in a while? Also yes.
ClamAV is purely hash-based, not heuristic? I knew it scored incredibly poorly in AV tests, which would make sense if that’s still their approach.
clamAV has heuristic capabilities. just search through the documentation and see how many switches contain ‘heuristic’:
I think you’re missing the point that antivirus should kick in before the malware executes. It’s far from 100%, but if you download something stupid, the antivirus should in most cases flag that before you even have a chance to execute it. In that case, you delete it, and the problem is solved, no need to reinstall or anything of the kind.
Of course the “real” solution is to be smart about what you install, but no one is perfect and we also can’t expect the world to be super computer literate (unfortunately).
The “too niche” part is really weird to me. There’s an estimated 2 billion PCs in use right now. ~3% of that are running some form of Desktop Linux OS, so roughly 60 million.
Incidentally, that’s exactly the same number as the total number of Win95 licenses sold, and I can’t recall Win95 being “too niche” for malware. Quite the opposite.
Incidentally, that’s exactly the same number as the total number of Win95 licenses sold, and I can’t recall Win95 being “too niche” for malware. Quite the opposite.
In Win95 days, “always online” was simply not a thing for the average household. Getting on the Internet - if you even had a connection at all - was equivalent to making a phone call, in that you “called in” to do the thing you wanted to do, then “hung up” when you were done (yes, I know dial-up did almost exactly that in practice, but it’s still a good analogy).
Being “always online” is relatively recent, and anything online is going to be vulnerable to malware at some point in its life. Security patches need to keep up with that.
Exactly, and still the 60 million copies sold (of which maybe a quarter or so actually ever went online) was more than enough to make Win95 comically malware-infested.
I’d venture to say that close to every one of the 60 million copies of Desktop Linux OSes running goes online frequently, so there’s much more potential Linux targets than there ever were Win95 targets. That’s why I’m saying the “Linux is to niche to get malware” argument doesn’t really work.
OS security has gotten far better though, and there are a literal shitton more devices to target (like IOT crap) than someone’s slighty out-of-date Linux install.
But targets differ in value. Hack an IOT device and you can send some spam from it. Hack someone’s PC and you can ransomware their family pictures or steal their crypto crap.
ClamAV is the thing to use, AV-wise, but it makes no sense to use it and spend resources unless you know in advance you are going to get Windows stuff at risk.
No av on my machines on Linux.
What I understand, av on Linux is used to protect windows.
Use an ad blocker when surfing (ublock origin), install only via official repos and set up a DNS server with decent blocklist and you should be fine.
Yeah, that arrogance will hit you sooner or later.
As the popularity of Linux increases, so will the malware situation worsen.
What makes you think that a “antivirus” is going to do anything?
Security is hard
Security is hard and as Linux becomes a more lucrative target for malware something will slip through. We’ve already seen attempted supply chain attacks with xz and we know that Linux ransomware is out there. AV isn’t a silver bullet; it’s another layer in your defences.
This is exactly my point
Your comment seemed like you were saying not to have AV at all
I am not the guy you replied to, I am the guy calling out arrogance for not using AV
ah, sorry about that, I should have read the username…
No, that’s a different person
What will a antivirus do? It would just bork the system.
More lucrative target, than running most of the internet?
Ransomware is the money maker, and websites rarely contain valuable enough data that companies can’t just rebuild the site in an afternoon.
What arrogance?
As I have been told, for years, av on Linux is used to protect windows machines on the network. Companies use clamav to scan files on network shares used by windows machines. Also, what about virus database/definitions, are they having Linux signatures?
Since I have no windows machines on the network, why? Has this changed and I should run clamav to scan for Linux viruses? Do signature files actually have signatures for Linux viruses?
Android most often is compromised by malicious apps, not viruses, which is not really (yet) a problem on Linux. Once it becomes a problem, I will install av. So far it has not been an issue.
Anyway, effectiveness here is interesting
https://en.wikipedia.org/wiki/ClamAV
What do you run?
The reason that Linux systems are less prone to malware is twofold, historically Linux users have been more technical, but foremost due to it’s lower marketshare of desktop users, giving malware devs a lower return on their time writing software.
This is changing rapidly now, less technically skilled people are switching to Linux and more are running it on their desktops.
This makes for a more interesting target meaning more time is devoted to writing malware for Linux.
So, a good AV should now be used ahead of the incoming malware wave, ignoring it and suggesting that other’s do the same is arrogant.
Yeah, I’m fine without one two, I just:
1: want my wife to feel secure with her system, which I am setting up for her.
- believe that desktop Linux is becoming steadily more attractive as a target
She’s more likely to be the target of a phishing campaign or malicious mobile app.
Linux is essentially immune because we don’t install random software off the internet and instead use centralized repositories of software
if you get a virus from that, antivirus won’t help you, but this essentially never happens.
Npm says what? Random appimages and flatpaks would like a word as well.
It’s true we generally need no antivirus - so far every demand to install one is rooted in stupidity, including policy built by stupidity - but we’re losing the struggle to not install random shit like idiots.
Flatpaks are okay if you stick to verified, I don’t know about npm, don’t recommend appimages.
Thanks, very detailed answer. I’ll check out the lenspec option, that seems like a nice addition, especially when adding older windows programs from questionable sources, which is something that won’t happen often, but may be necessary.
No, thanks.
I’ve been using it since about 1995 and the only uses for ClamAV I had were as a mail scanner for a mail server with Windows clients, and as a file scanner for a Samba server with Windows clients.
If you keep your system up to date, don’t install stuff from random sites, and don’t run as root all the time, you’ll be ok.
Kinda mirroring the other points here, if you only install from the distro’s repos then you’re all good.
But…
Better than AV (blocks known bad), you’re better off looking into things that only allow known good, like selinux, etc, which might be part of bazzite anyway? (I don’t use it, so unsure)
